PRIVACY POLICY FOR BYBORDER

Version: 5

Effective Date: October 9, 2026

ByBorder (the "Application", "we", "us", or "our") is committed to respecting and protecting your personal data and privacy. This Privacy Policy explains how we collect, use, process, and safeguard your personal data when you access or use our mobile application.

This Privacy Policy is drafted in strict compliance with the European Union General Data Protection Regulation (Regulation (EU) 2016/679, hereinafter "GDPR"), the Polish Act on Personal Data Protection, and applicable mobile app marketplace guidelines.

1. DATA CONTROLLER IDENTIFICATION

The Data Controller responsible for your personal data under this Privacy Policy is:

• Legal Entity / Business Form: Sky Stork sp. z.o.o.
• Country of Registration: Poland
• Official Contact Email: [email protected].
• Registered Address: 29, Długa str., 00-238 Warszawa
• Tax ID (NIP / REGON): 5252927176
• Lead Supervisory Authority: President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych — UODO), Warsaw, Poland.

2. CATEGORIES OF PERSONAL DATA WE COLLECT AND PROCESS

To provide our services, authenticate users, deliver navigation features, and predict border crossing wait times, we process the following categories of personal data:

A. Account Authentication Data (Google Sign-In)

• Data Types: Google OAuth Profile Data (specifically: account name, primary email address, and Google Account ID / OAuth Token).
• Purpose & Usage: Creating and authenticating your user account, securing system endpoints, identifying user sessions, and processing user requests (such as account deletion under Art. 17 GDPR).
• Legal basis: Performance of Contract (Art. 6(1)(b) GDPR). Necessary to identify, authenticate, and manage your account to provide access to the Application.

B. Precise Location & Navigation Data (GPS)

• Data Types: Precise geographic coordinates (latitude, longitude), speed, bearing/heading, altitude, and associated timestamps.
• Purpose & Usage:
• Route Guidance: Assistance in choosing the best possible route from user’s location to the destination through existent EU-Belarus border crossing points (CPPs).
• Border Queue Analytics & Forecasting: Detecting vehicle arrival/movement in designated border checkpoint queue zones, tracking velocity, and calculating real-time estimated crossing times.
• Foreground & Background Processing: Location tracking operates actively in the foreground while using the app. Background location tracking operates when enabled by the user to allow continuous queue monitoring while the device screen is locked or the app is minimized.
• Legal basis: Consent (Art. 6(1)(a) GDPR). Explicit consent provided by the user via onboarding screens and OS device permission prompts.

C. Technical Identifiers & Device Telemetry

• Data Types: Device model, operating system version, mobile network status, Push notification tokens (Firebase Cloud Messaging - FCM), and temporary session tokens.
• Purpose & Usage: Delivering push notifications (e.g., queue updates and navigation alerts), maintaining session security, preventing location spoofing, and ensuring system stability.
• Legal basis: Legitimate Interest (Art. 6(1)(f) GDPR). Maintaining server infrastructure integrity, preventing fraudulent GPS manipulation, and mitigating security threats.

D. Advertising & Mobile Analytics Data

• Data Types: Mobile Advertising Identifiers (Google Advertising ID / GAID, IDFA), IP address, coarse location (country and city inferred from IP), interaction data with advertisements (impressions, clicks, ad format), and consent management choices collected via Google User Messaging Platform (UMP) SDK.
• Purpose & Usage: In-app monetization, serving personalized and non-personalized advertisements, ad mediation, ad fraud prevention, and frequency capping. GPS location coordinates collected for border queue analytics are strictly isolated and are never shared with or processed by advertising networks.
• Legal basis: Consent (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive) obtained through the Google UMP consent banner prior to serving personalized ads or accessing device storage. With regard to Non-Personalised Advertising & Ad Fraud Prevention - Legitimate Interest (Art. 6(1)(f) GDPR).

E. User Feedback Data (Optional)

• Data Types: Optional user-submitted reports regarding app performance or border conditions, wait durations which could help us to improve the prognostic capabilities of the app.
• Purpose & Usage: Processed strictly for app improvement and predictive algorithm enhancement. Feedback is kept internal and is never published or shared publicly.
• Legal basis: Consent (Art. 6(1)(a) GDPR). Feedback is voluntary and serves as the means of communication between us and users.

F. Vehicle Registration Number Data

• Types of data: Vehicle registration number (license plate number).
• Purpose and use: Required for the operation of the notification feature informing the User when their vehicle is called from the Waiting Area on the Belarusian side of the border. The registration number is stored in the User’s profile and used exclusively to track the status and send notifications.
• Legal basis: Legitimate Interest (Art. 6(1)(f) GDPR).

3. DATA STORAGE, INFRASTRUCTURE, AND RETENTION PERIODS

A. Proprietary Managed Server Infrastructure

All core personal data, user account profiles, session telemetry, and location records are stored and processed on our proprietary, secured server infrastructure directly owned, operated, and controlled by the Data Controller within the European Economic Area (EEA). All data stored within our internal server infrastructure is protected by strict technical measures.

B. Data Retention Limits

• Google profile & account data, GPS Telemetry & Session Tracks, license plate numbers: are retained for the entire period during which the User’s account exists. When the User deletes their account through the Application settings, all associated personal data, linked tokens, and permissions are completely and immediately deleted, while trip analytics data is anonymized.
• Technical Logs: Operational backend logs and security diagnostic records are purged on a rolling 30-day schedule.
• Advertising Identifiers & Consent Preferences: Consent state strings and choices recorded via the Google UMP SDK are stored locally on your device and refreshed or reset upon consent revocation. Advertising interaction telemetry processed by third-party ad networks is retained in accordance with their respective retention policies.

4. THIRD-PARTY RECIPIENTS AND PROCESSORS

4.1. We do not sell, rent, or trade your personal data. We share pseudonymized or authentication data only with essential third-party service providers bound by strict Data Processing Agreements (DPAs) compliant with Article 28 of the GDPR:

Google Ireland Limited

• Role: Identity Provider (Google Sign-In) & Advertising Service (Google AdMob)
• Data Shared: OAuth authentication tokens, OS metadata, Mobile Advertising IDs (GAID), IP address, coarse geolocation, ad performance telemetry, and GDPR consent state. GPS coordinates are never shared.
• Safeguards & Location: EEA / Global. Governed by Standard Contractual Clauses (SCCs) and GDPR Data Processing Terms.
• How Google uses information from apps that use its services: https://policies.google.com/technologies/partner-sites

Google Play (Google Commerce Limited / Google Ireland Limited)

• Role: App store and subscription payment provider (Google Play Billing), if a subscription is introduced; an independent controller with respect to payment data.
• Data Shared: Pseudonymized Application account identifier, product and base plan identifiers. From Google Play we receive the purchase token, subscription status and validity dates. Payment details are never shared with us.
• Safeguards & Location: EEA / Global. Governed by the Google Play Terms of Service and the Google Privacy Policy.

OpenStreetMap

• Role: Map Rendering Provider
• Data Shared: Anonymized tile request coordinates
• Safeguards & Location: Open-source mapping layers. No persistent user identifiers transmitted.

Third-Party Advertising & Mediation Partners

• Role: In-App Advertising Delivery & Mediation Waterfall Networks
• Data Shared: Mobile Advertising Identifiers (GAID), device technical specifications, IP address, coarse geolocation, and ad interaction logs.
• Third-Party Networks: We utilize Google AdMob as our primary ad server and mediation platform, which routes ad requests to international third-party ad networks. These networks operate under their own privacy policies and are bound by GDPR compliance standards and Google’s EU User Consent Policy.
• Safeguards & Location: EEA and International transfers safeguarded by EU Standard Contractual Clauses (SCCs) and Data Processing Agreements.

External Navigation Applications

• Role: Applications used by Users to display routes exported from the Application.
• Data Shared: Coordinates of border crossing points or designated locations.
• Safeguards & Location: The collection, processing, and protection of data after the User is redirected to third-party services are governed by the privacy policy of the relevant third-party service.

4.2. The User may, at their own initiative, generate and share with other persons a unique link providing access to information about a trip. By following such a link, third parties gain access to view the real-time geolocation, route track, and name of the trip owner. The trip owner can view the contact details (email addresses) of users who have been granted access.

We shall not be liable for any further sharing or forwarding of the link by third parties. The User may revoke access to the trip at any time through the Application settings.

4.3. When submitting feedback messages or technical bug reports, or enabling notification duplication via a Telegram bot, certain data (including the profile name, email address, device/trip identifiers, message content, and screenshots) may be forwarded to ours bots and administrative channels on the Telegram platform (Telegram Group Inc.). By using these features, the User consents to the transfer of the aforementioned data to Telegram, whose servers may be located outside the European Economic Area (EEA).

5. TECHNICAL AND ORGANIZATIONAL SECURITY MEASURES

In accordance with Article 32 of the GDPR, we enforce comprehensive physical, technical, and administrative safeguards:

• Encryption: Reasonable organizational and technical safeguards are applied to all external API communications and databases.
• OAuth Security: Authentication is handled strictly via official Google Identity SDKs; credentials are tokenized and validated without storing sensitive user credentials.
• Access Controls: Administrative access to our managed server infrastructure is strictly restricted to authorized engineering personnel.

6. YOUR RIGHTS UNDER GDPR (DATA SUBJECT RIGHTS)

Under GDPR, you possess the following statutory rights regarding your personal data:

• Right of Access (Art. 15 GDPR): Request confirmation and access to a copy of your personal data processed by us.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate personal data.
• Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): Delete your personal data and account directly through in-app account settings.
• Right to Withdraw Consent (Art. 7(3) GDPR): Revoke location tracking consent at any time via device OS settings or in-app permission toggles without affecting prior lawful processing.
• Right to change your advertising choices: Change or withdraw your consent to personalized advertising at any time in the Application settings ("Security" section), or reset or delete your advertising ID in the Android settings. Opting out of personalization does not remove ads — the “Ad-Free” subscription may be introduced for this purpose in the future.
• Right to Restriction & Data Portability (Art. 18, 20 GDPR): Request restricted processing or export your data in a structured, machine-readable format.
• Right to Lodge a Complaint: File a complaint with a supervisory authority mentioned in the Chapter 1 of this Policy.

7. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect functional updates or legal adjustments. Revisions will be published inside the Application with an updated "Effective Date" and "Version" tag.

8. CONTACT INFORMATION

For questions or privacy requests, please contact:

Sky Stork sp. z.o.o.

Topic: Personal data protection

Email: [email protected]

Address: 29, Długa str., 00-238 Warszawa

Country: Poland.