Privacy Policy
Last updated: September 20, 2026
This Privacy Policy explains how Be in Cloud Solutions Szolgáltató Korlátolt Felelősségű Társaság ("BrevetCard", "we", "us", or "our") collects, uses, discloses, and retains personal data when you use the BrevetCard mobile application, website, organizer services, and related features (together, the "Service"). We are the controller of the personal data described in this policy unless another controller is identified.
Personal data we collect
The data we collect depends on the features you use.
- Account and contact data: email address, account and user identifiers, password hash and other authentication records, optional profile name or nickname, secondary email addresses, account settings, and roles.
- Ride and fitness activity: event registrations, brevet cards, routes, distances, start and finish information, control check-ins, timestamps, progress, results, and notes such as a DNF reason.
- Location data: approximate or precise location used for maps, check-ins, background check-in when you enable it, ride progress, fraud prevention, and photo location. Location access is controlled through the app and your device settings.
- Messages and user content: organizer announcements, group and direct messages, On the Road posts, photos, captions, comments, reports, assistant questions and feedback, and other information you choose to submit.
- Search and interaction data: event and rider search terms, favorites, reactions, follows, subscriptions, blocks, hides, mutes, read status, reports, and similar actions in the Service.
- Device and notification data: device, app, and installation identifiers; push notification tokens; platform, operating system, and app version; notification preferences; IP address; and technical request metadata.
- Diagnostics and support data: crash information, app and map diagnostics, check-in and photo-import logs, and information included when you contact support or choose to send a diagnostic report. A diagnostic report may include your account email and device or app details. The app does not attach your photos, photo coordinates, or filenames to its photo-import diagnostic report.
- Website data: browser and device information, IP address, requested pages, dates and times, and essential cookies or similar storage needed for authentication, security, and website functionality.
We do not use BrevetCard data for third-party advertising or cross-app tracking, and we do not sell personal data.
How we use personal data
We use personal data to:
- create and secure accounts, authenticate users, and provide account management;
- operate events, brevet cards, check-ins, ride progress, results, maps, and organizer functions;
- deliver messages, public or participant-facing content, notifications, and requested communications;
- provide search, favorites, reactions, moderation, blocking, reporting, and other app features;
- answer support requests, diagnose failures, maintain availability, and improve the reliability and performance of the Service;
- detect abuse, fraud, unsafe behavior, and violations of our terms, and protect users and the Service;
- comply with legal obligations, resolve disputes, and enforce our agreements; and
- manage a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to appropriate safeguards.
Legal bases for processing
Where the European Economic Area, United Kingdom, or similar law applies, we rely on one or more of the following legal bases:
- Contract: processing needed to provide the Service you request and administer your account.
- Consent: for optional permissions or features, such as precise or background location, photo access, and some communications. You may withdraw consent through the app, device settings, or by contacting us, without affecting earlier lawful processing.
- Legitimate interests: operating and improving the Service, providing support, protecting security, preventing abuse, and maintaining necessary business records, balanced against your rights.
- Legal obligation: processing required by law, including accounting, regulatory, and lawful authority requests.
When data is visible or shared
- Event organizers and participants: organizers may see information needed to manage an event, including registrations, card activity, progress, results, messages, reports, and relevant check-in or location information. Other participants see information that a feature is designed to share with them, such as a group or direct message.
- Public features: information you publish to an enabled public On the Road feed may be visible without an account. This can include a photo, caption, comment, profile name, event, and posting time. The public On the Map view uses aggregated location areas and does not publish a photo's precise coordinates or name its rider.
- Service providers: we use providers to host the Service, store data and photos, deliver email and push notifications, provide maps, and process assistant requests. These include Microsoft Azure services (including hosting, storage, email delivery, and Azure OpenAI), Google Maps and Firebase Cloud Messaging on Android, and Apple MapKit and Apple Push Notification service on iOS. Providers process data under their contracts and applicable privacy terms.
- Legal and safety disclosures: we may disclose information when reasonably necessary to comply with law or a valid authority request, protect rights or safety, investigate wrongdoing, or defend legal claims.
- Business transfers: personal data may be transferred as part of a merger, acquisition, financing, reorganization, or asset sale. We will provide notice where required before the data becomes subject to a materially different privacy policy.
When you use the in-app assistant, your question, relevant conversation context, and the generated answer are processed through Azure OpenAI so the assistant can respond. Do not include information in an assistant question that you do not want processed for this purpose.
Data retention
We retain personal data only for as long as needed for the purposes described above, including providing the Service, maintaining security, resolving disputes, and meeting legal obligations. Retention depends on the type of data:
- Account data and user-created content are generally retained while the account or relevant feature remains active, unless you delete the content or request deletion.
- When an account is deleted, its profile, push devices, settings, favorites, On the Road posts and photos, comments, reactions, messages, blocks, reports, and linked assistant content are deleted or disassociated as applicable.
- Completed ride records may remain as anonymous event results so the event history remains accurate.
- Assistant questions, answers, feedback, and the user reference are normally retained for up to 90 days and are then removed from the retained usage-and-cost record. Anonymous operational metrics may remain.
- Security, moderation, transaction, and server records may be retained for a limited period when needed to investigate abuse, protect the Service, comply with law, or establish legal claims.
- Service providers may retain technical records according to their own documented retention periods and legal obligations.
Your choices and rights
- You can change location, photo, and notification permissions in the app or your device settings. Turning off a permission may prevent the related feature from working.
- You can edit available profile and notification settings in the Service.
- You can delete your own On the Road post in the app. Deleting a post also removes its stored photo and the associated comments, reactions, and reports.
- You can request access to, correction of, deletion of, restriction of, or a portable copy of your personal data, and you may object to certain processing where applicable.
- You may withdraw consent at any time where processing is based on consent.
- You may complain to the data-protection authority in your country of residence, work, or the place of an alleged infringement.
To exercise a right or request deletion of particular data without closing your account, contact support@brevetcard.com. We may need to verify your identity before acting on a request.
Deleting your account
You can delete your BrevetCard account from the Profile screen in the application. If you have uninstalled the application or cannot sign in, follow the instructions on our account deletion page.
If your account owns an organizer or created events involving other people, we may need you to transfer or resolve that responsibility before deletion. After deletion, completed rides remain only as anonymous event results. We may retain information where required for security, fraud prevention, accounting, another legal obligation, or legal claims, and only for the applicable period.
International transfers
BrevetCard is operated from Hungary and uses providers that may process data in other countries. Where required, we use recognized safeguards for international transfers, such as adequacy decisions or approved contractual protections.
Security
We use technical and organizational measures designed to protect personal data, including encrypted network connections and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Children's privacy
The Service is not directed to children under 13, and we do not knowingly collect personal data from a child under 13 without the authorization required by applicable law. If you believe a child has provided personal data improperly, contact us so we can investigate and remove it where appropriate. A higher minimum age or parental consent requirement may apply in some countries.
Third-party links
The Service may link to websites or services we do not operate. Their privacy practices are governed by their own policies, and we are not responsible for those practices.
Changes to this Privacy Policy
We may update this policy as the Service or legal requirements change. We will post the revised policy here, update the date above, and provide additional notice where required. Changes apply when posted unless a later effective date is stated.
Contact us
For privacy questions or requests, contact Be in Cloud Solutions Szolgáltató Korlátolt Felelősségű Társaság:
