Privacy policy

This policy explains how Notixv processes personal data when you use the Vroom app for iOS and Android, the web app (app.notixv.com), the website vroom.notixv.com and related services (together, the “Service”). The EU General Data Protection Regulation 2016/679 (“GDPR”) and Greek Law 4624/2019 apply.

1. Who we are

The data controller is Konstantinos Mavrelis (Κωνσταντίνος Μαυρέλης), a sole proprietorship trading as “Notixv”, registered at Ioannou Glyka 33, 82200 Vrontados, Chios, Greece, VAT number 172802117, GEMI number 180012159000 (“Notixv”, “we”).

Privacy contact: hello@notixv.com. We have not appointed a Data Protection Officer; please use the email above for any matter.

2. Our two roles

As controller, we process the data of your account, your business, your subscription, your use of the app and what people send us through the website.
As processor (Article 28 GDPR), we process, on your business’s behalf, the data of its own customers (for example plates, vehicle details, names and phone numbers, receipts). Your business is the controller of that data, and the processing is governed by the Data Processing Agreement that forms part of the Terms of use. A business’s customers should contact the business first about their rights; we help it respond.

3. What we collect

Account and sign-in. Name, email address, profile picture (if your sign-in provider shares it), the provider’s user identifier, language, your role in the business, sign-in history.

Business. Legal name, VAT number, tax office, main activity, billing email, billing address, type of business, monthly number of customers, team size and how you heard about us (the last two optional). When you type a VAT number, we fill in the business’s public details from the relevant registries.

Connection to AADE. The credentials needed to transmit to myDATA and the Digital Client Registry (for example the myDATA user name and API key). They are stored encrypted and used only for the transmissions you ask for.

Operational data (processed on your business’s behalf): licence plates, vehicle make, model and colour, entry and exit times, notes, customer names and phone numbers, invoices and receipts, amounts, AADE registration numbers.

Camera and photos. With your permission, the app uses the camera, or a photo you pick from your library, to read a vehicle’s plate. The image is sent, encrypted, to the Google Gemini artificial intelligence service, which reads the plate number and returns it to us. The image is used only for that purpose and is deleted immediately after reading: we do not store it, and the recognition service does not keep it. We keep only the plate number that was read. We have no access to your other photos.

Payments. Payments are handled by Stripe. We receive the payment result, the plan, the amounts and the card’s last digits and expiry. We never see or store the full card number.

Device and usage. Device model, operating system, app version, language, push notification token, IP address, error and security logs, and information on how you use features (for example which screens you open). We do not collect your precise location.

Website and contact. When you fill in the form: first name, last name, phone, email, company, your answers (type of business, customers a month) and a reCAPTCHA token. Also whatever you send us by email or tell us by phone.

4. Where it comes from

From you; from the sign-in provider you choose (Google or Apple); from your device, only with the permissions you grant; automatically, as you use the Service; from public registries, for your business details; and from your business, for its customers.

5. Why we process it, and on what legal basis

Purpose	Legal basis (Article 6 GDPR)
Creating and managing your account, signing in	Performance of a contract
Providing the Service: scanning, records, transmission to AADE	Performance of a contract; for your business, compliance with its legal obligation
Billing, invoicing, tax records	Contract and legal obligation
Push notifications	Consent (asked by your device, withdrawn in its settings)
Security, fraud and abuse prevention, reCAPTCHA	Legitimate interest
Usage statistics to improve the app	Legitimate interest or, where required, consent
Answering website enquiries and pre-contract contact	Steps taken at your request before entering a contract
Updates about new features	Consent, or legitimate interest for existing customers; opt out any time
Establishing or defending legal claims	Legitimate interest

Plate reading is done automatically by an artificial intelligence system (Google Gemini) and can be wrong, which is why the number is always shown for you to check before the record is saved.

We do not use your data for advertising, we do not sell it, and we make no decisions based solely on automated processing that produce legal effects for you. The plan suggested at sign-up is only a suggestion; you can change it freely.

If you sign in with Google, we receive from your Google Account only your name, email address, profile picture and a user identifier (the openid, email and profile scopes). We use them solely to sign you in, create and recognise your account, and contact you about the Service. We do not request access to Gmail, Drive, contacts or any other Google data.

We do not transfer Google user data to third parties, except to providers that help us run the Service, when the law requires it, or as part of a merger or acquisition. We do not use it for advertising, and we do not use it to develop, improve or train generalised artificial intelligence or machine learning models. We do not allow humans to read it unless you consent, for security purposes, to comply with the law, or once it has been aggregated and anonymised.

Vroom’s (Notixv’s) use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke access at any time on the Third-party apps and services page of your Google Account.

If you sign in with Apple, we receive a user identifier, your name (only the first time, if you choose to share it) and an email address, which may be Apple’s private relay address (“Hide My Email”). We use them only to sign you in and to contact you about the Service. You can stop using Sign in with Apple in your Apple ID settings. When you delete your account, we also revoke your Sign in with Apple tokens.

8. Device permissions

Camera: to scan licence plates.
Photos: to pick a photo of a plate from your library.
Notifications: for operational alerts (for example a failed transmission).

Each permission is requested when the app first needs it and is optional; the app still works without it, with limits (for example you type the plate instead). You can revoke it in your device settings. We do not use your microphone, contacts or location.

AADE (myDATA, Digital Client Registry): the data you transmit through the app, on your instruction.
Service providers that process data on our behalf, under contract and with equivalent protection:
- Hetzner Online GmbH (hosting, databases and backups, in data centres within the European Union)
- Google (Gemini, to read the plate from the image, without storing the image)
- Google (Firebase Cloud Messaging for notifications, Sign in with Google, reCAPTCHA)
- Apple (Sign in with Apple, iOS notifications)
- Stripe (payments and subscriptions)
- PostHog (usage statistics)
- Resend (sending email)
- Discord (internal alerts to our team about new website enquiries)
Advisers (accountants, lawyers), bound by confidentiality.
Authorities, when required by law or court order.
A successor, in a merger, acquisition or transfer, after informing you.

We do not sell personal data and do not share it for advertising. We do not track you across other companies’ apps and websites, as Apple defines tracking, and we do not use your device’s advertising identifier.

10. Transfers outside the EEA

Some providers (for example Google, Apple, Stripe) may process data outside the European Economic Area. In those cases we rely on an adequacy decision (such as the EU-US Data Privacy Framework for certified providers) or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.

11. How long we keep it

Account and business: while the account is active. After deletion, deleted or anonymised within 30 days.
Operational data and invoices: as your business decides or until the account is deleted, except what must be kept under tax law (as a rule five years from the end of the tax year they relate to). Data already transmitted to AADE is held by AADE and cannot be deleted by us.
Our charges and invoices to you: as long as tax law requires.
Security logs: up to 12 months.
Website enquiries: up to 24 months from the last contact, if you do not become a customer.
Plate images: deleted immediately after reading.
Backups: taken every day and kept for as long as your subscription is active and for one (1) year after it ends or is deleted, so that data can be recovered after a failure. During that time backups are used for nothing else and are restored only to recover from a failure. They are then permanently deleted.

12. Deleting your account and data

You can delete your account inside the app: More → Delete account. You can also request it on the Delete your account page, or by emailing notixvdigital@gmail.com from your account’s address. Deletion is permanent; deactivation does not count as deletion. What is deleted and what must be kept is described in section 11.

If you want only some data deleted (for example vehicles, customers, notes, team members) and to keep your account, make a request on the Data deletion request page. We reply within 30 days.

13. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw any consent you have given, without affecting the lawfulness of processing before withdrawal. Send your request to hello@notixv.com (data or account deletion requests to notixvdigital@gmail.com); we reply within one month and may ask you to confirm your identity.

You may also lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).

14. Security

We use encryption in transit (TLS), encryption at rest for sensitive credentials, role-based access control, activity logging and regular backups. No method is perfectly secure; if a breach affects you, we will inform you and the Authority as the law requires.

15. Children

The Service is for businesses and adults acting on their behalf. It is not directed at anyone under 16, and we do not knowingly collect their data.

16. Cookies on the website

The website sets no cookies of its own. For the duration of your visit only (sessionStorage), your browser keeps a note that you have seen the intro and where you came from (for example an ad’s UTM parameters), so we can record it if you send the form. None of it remains once the tab is closed. The contact form loads Google reCAPTCHA to prevent spam, which is subject to Google’s Privacy Policy and Terms. Analytics or advertising tools load only if you consent.

17. Changes

If we change this policy materially, we will tell you in the app or by email before the changes take effect. The last-updated date is shown at the top.

18. Contact

Konstantinos Mavrelis (“Notixv”), Ioannou Glyka 33, 82200 Vrontados, Chios, Greece, email: hello@notixv.com.