Privacy Policy

1. Controller

The provider listed above is the controller within the meaning of the GDPR and other applicable data protection laws for the processing described in this Privacy Policy.

2. General information and legal bases

We process personal data only to the extent necessary to provide the Betabace website, web application and native mobile app, deliver requested features, maintain security, prevent abuse, manage contracts, comply with legal obligations or pursue legitimate operational interests.

Depending on how you use the platform, this may include account and contact data, technical and device data, content and community data, precise or approximate location and motion data, camera images, video and audio, AR and depth data, uploads and file metadata, subscription and payment references, local preferences and moderation metadata.

• Article 6(1)(b) GDPR for contract performance or pre-contractual measures, for example when you create an account, upload data, access maps or manage a subscription.
• Article 6(1)(c) GDPR where storage or processing is required by statutory retention, tax or compliance obligations.
• Article 6(1)(f) GDPR for security, abuse prevention, moderation, product integrity and platform operations where our interests are not overridden by your interests.
• Article 6(1)(a) GDPR where we explicitly ask for consent.

3. Website provision and technical access data

Whenever you access the website, technically necessary connection and log data may be processed. This can include IP address, request time, requested URL, browser type, operating system, referrer, language settings, status codes, transferred data volume and technical diagnostics.

This processing is necessary to deliver the website, analyse faults, secure the infrastructure, detect attacks or misuse and ensure system stability. The legal basis is Article 6(1)(f) GDPR.

4. Account, sign-in and authentication

If you create an account or sign in, we process the data required for registration, authentication and account management. Based on the current product state, this may include your email address, internal user identifier, name, handle, avatar reference, session data and technical authentication information.

We use Supabase for authentication, secure session handling, database-backed account management and storage-related backend functions. Betabace currently offers email magic-link sign-in and, depending on platform and availability, Sign in with Google and Sign in with Apple. When you choose Google or Apple, we receive the identifiers and basic account information that you authorise that provider to share, such as your email address, name and profile image where available. We do not receive your Google or Apple password. Authentication tokens are used only to establish and maintain your Betabace session and are stored securely, including in the iOS Keychain on supported devices.

At the current product stage, Betabace may also process structured references to people who do not themselves have a registered account, for example where users identify route setters, authors or other involved persons by name. Where technically provided for, such references are marked as unregistered mentions or profile references and are not presented as active user accounts.

• creating and maintaining user accounts
• recognising signed-in users and securing protected areas
• storing and updating account fields such as name, handle and avatar
• support processing, fraud detection and misuse prevention

5. Profile, route, area and community data

When you create, edit or save content on Betabace, we process the information you enter and the technical metadata generated by that activity. This can include route and area data, free text, grades, categories, geo-references, images, profile fields, author references, edit timestamps and moderation metadata.

This may also include personal data about third parties who are not themselves registered with Betabace where users provide names, roles or other attributions, for example as route setters or other mentioned persons. Such information generally comes from user submissions and serves to describe, contextualise and document route and community content.

Even though Betabace is not currently positioned as a full public social profile network, some user-supplied data may still become visible within the product where required by the feature itself, for example route titles, author references, route images, area-related entries or unregistered mentioned profiles.

Where personal data about unregistered persons is processed in this context, we generally rely on Article 6(1)(f) GDPR. Our legitimate interests lie in documenting and attributing community content and in the functional presentation of route, area and profile relationships. Affected persons can contact us at the email address stated above if they want us to review, correct or erase such information.

Where personal data has not been obtained directly from the data subject, it will generally originate from user submissions or other user-generated attributions. If direct individual notice to the affected person is not possible in the individual case or would involve a disproportionate effort, we provide the information required under Article 14 GDPR through this Privacy Policy.

6. Payments, checkout, billing and subscriptions

If you use paid features or subscriptions, we process the contractual and billing-related data necessary for order handling, subscription administration, fraud prevention and accounting. The technical payment flow is currently handled through Stripe.

This may include Stripe customer identifiers, checkout and billing portal session data, subscription status, product and price references, transaction metadata, invoice references and webhook-based status updates. We generally do not receive full payment card details ourselves.

• creating checkout sessions
• creating billing portal links for subscription management
• processing webhook events to synchronise product, price and subscription state
• storing billing and tax-related records where required

7. Maps, geo data and search services

Betabace is a map-centric platform. To display maps, markers, 3D scenes, place search, autocomplete and georeferenced route content, third-party services such as Mapbox and services from the Google Maps Platform may be integrated.

When such features are called, your IP address, browser information, requested map tiles, referrer, approximate location data or search terms may be transmitted to the relevant provider to technically deliver the map, tile, place or 3D functionality you requested.

8. Uploads, files and photogrammetry workflows

Certain Betabace features allow users to upload, store and further process images and other files. Based on the current product state, this may include route images, avatar images and photogrammetry-related upload workflows.

Depending on the function, this may involve file contents, file names, file sizes, technical file metadata, processing status data, previews, generated point clouds, meshes, temporary objects and storage references.

For these workflows, third-party infrastructure may be involved, such as Supabase Storage, S3-compatible upload targets or compute environments used for photogrammetry processing, including RunPod-based jobs where applicable.

9. Cookies, local browser storage and IndexedDB

We use technically necessary cookies and other browser-side storage technologies where this is required for security, session management, language preferences, account recognition and platform usability. The application may also store local draft, editor and preference data in the browser.

In the current product state, this can include session and authentication information, language settings, route draft data, editor state and larger temporary browser-side working data via Local Storage or IndexedDB.

Further information is available in the separate Cookie Policy.

10. Recipients, processors and third-country transfers

Personal data may be disclosed to processors and service providers where this is necessary for operation of the platform. Depending on the feature used, this may involve infrastructure, payment, map, storage or compute providers.

• authentication providers, including Supabase and, when selected by you, Google or Apple
• database and storage providers, in particular in connection with Supabase
• payment and subscription providers, in particular Stripe
• map, geo, places and 3D providers, in particular Mapbox and Google Maps Platform
• cloud, storage and compute providers for uploads and photogrammetry processing, including S3-compatible storage and RunPod-based execution environments
• hosting, security and technical infrastructure providers where operationally required

Some of these providers may process data outside the EU or EEA. Where this happens, we rely on appropriate legal transfer mechanisms such as adequacy decisions, standard contractual clauses or another legally recognised transfer basis.

11. Retention and deletion

We store personal data only for as long as necessary for the relevant purpose, where statutory retention obligations apply, where legitimate security or evidence interests exist or where storage remains necessary for the establishment, exercise or defence of legal claims.

• account and profile data generally until account deletion or removal of the relevant content
• billing and tax data for the duration required by statutory retention obligations
• technical logs only for appropriate purpose-bound periods
• local browser or app data until you delete it, clear the relevant storage, uninstall the app or it is overwritten by the application
• private approach backups until you delete the associated account or request deletion, subject to limited backups and legal obligations
• backups for limited timeframes where technically required

12. Your rights

Subject to the statutory requirements, you have the right to request access, rectification, deletion, restriction of processing, data portability and objection to processing based on Article 6(1)(f) GDPR.

• access to information about whether and which personal data we process
• rectification of inaccurate data and completion of incomplete data
• deletion where there is no overriding legal basis for further retention
• restriction of processing in the cases provided by law
• data portability for data you have provided where the legal requirements are met
• withdrawal of consent with effect for the future
• objection to processing based on legitimate interests

You can exercise these rights by contacting us at the email address stated above. You also have the right to lodge a complaint with a competent data protection supervisory authority.

13. Security and updates

We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised disclosure. These measures may include access controls, authentication mechanisms, secure transport, logging and role-based permissions.

No internet-based transmission or storage can be guaranteed to be completely secure. We therefore update this Privacy Policy whenever legal requirements, third-party integrations or relevant platform functionality change.

14. Native iOS app permissions and sensors

The iOS app asks for protected device access only when a relevant feature needs it. You can refuse or later change permissions in iOS Settings, although the related feature may then be unavailable.

• Camera and AR: route scanning and beta recording can process rear- or front-camera images, video frames, camera position and orientation, camera calibration data and, on supported devices, depth information or derived point clouds and meshes.
• Microphone and speech recognition: the microphone records audio when you choose to record beta. Speech recognition may process spoken commands when you enable hands-free scan controls.
• Location: precise or approximate location may be used to show your position, provide directions, associate a scan with a place and record an approach you start through navigation.
• Background location and motion: if you explicitly enable automatic approach recording, iOS motion activity and location data may be used to detect walking or running near climbing areas and record an approach while the app is in the background or the screen is locked. Automatic recording is optional and can be disabled in the app or iOS Settings.

15. Local app data, approach backups and contributions

The iOS app stores data on your device to provide its features. This can include secure session tokens in the iOS Keychain, saved-route and saved-area identifiers, preferences, offline map data, scan drafts and their images, generated previews or point clouds, temporary beta videos and recorded approach tracks.

Beta videos currently remain local unless you choose to share them using the iOS share sheet. Scan material is uploaded for photogrammetry or publication only when you start the corresponding upload, generation or submission workflow.

When you are signed in and connected, a private copy of a recorded approach may be backed up to your Betabace account so that it can be restored. Removing only the local copy does not remove that account backup. If you separately choose to contribute an approach for review, Betabace creates and transmits a contribution copy with approximately the first 100 metres removed. A contributed copy is reviewed and is not published directly as a trail.

16. Google and Apple account data

Google and Apple sign-in data is used to authenticate you, create or connect your Betabace account, display the profile details you authorised and protect the service against abuse. Betabace does not use Google or Apple account data for advertising and does not sell it. We share it only with processors needed to provide authentication and account functions, when required by law or with your explicit direction. Revoking Betabace in your Google or Apple account settings stops future provider access but does not by itself delete your Betabace account.

17. Deleting an account and withdrawing permissions

You may request deletion of your Betabace account and associated personal data through the account-deletion function where available or by contacting contact@betabace.com. We delete or anonymise associated data unless retention is legally required or a narrowly limited exception applies. Shared route and community records may need to be removed, anonymised or detached from your identity depending on the record and applicable law. You can withdraw device permissions at any time in iOS Settings and disable automatic approach recording in the app.