Privacy Policy

The controller of your personal data is Scaling.pt Unipessoal Lda, tax number (NIF) 516184610, registered in Portugal, which operates the DriveAlert service (drivealert.pt).

For privacy questions or to exercise your rights, contact [email protected]. For support, use [email protected].

We have not appointed a data protection officer, as we are not required to (Article 37 GDPR). The contact above is our point of contact for all data protection matters.

• Owners: people who create an account to receive alerts about their vehicles.
• Reporters: people who scan a sticker's QR code and send an alert, without an account.
• Visitors: anyone browsing our website.

We collect only what the service needs. We don't ask for your address, date of birth or identity documents, except where stated.

Where we rely on legitimate interest, we have assessed that the processing is necessary, kept to a minimum and expected by people using the service. You can object at any time (section 12).

We don't use your data for advertising, we don't build marketing profiles and we don't sell or rent data. If we ever want to send marketing communications, we will only do so with your prior consent.

• You don't need an account or to identify yourself. We don't ask for your name, phone or email.
• The owner only receives the type of problem, the message and photo you choose to send, and the time of the alert. They never receive your IP address or anything that identifies you.
• To prevent abuse, we compute a technical identifier from the IP address and browser type, using a secret key that changes every day. We don't store the IP address. This identifier only tells us whether the same device sent several alerts on the same day.
• If the owner marks an alert as abusive, alerts with the same identifier are blocked for 24 hours.
• We automatically remove hidden metadata from photos, including GPS location and device model.
• Please don't include personal data in the message and avoid photographing people or other vehicles' plates.
• Because we don't know who you are, we may be unable to link a rights request to your alerts (Article 11 GDPR). If you contact us with the sticker code and the approximate date and time, we will do our best to help.

• The QR code only contains a web address with a random code. It contains no plate, name or contact details.
• The sticker page doesn't show your number, email, plate or address.
• Your first name only appears if you allow it in your account settings.
• There is no plate search and no way to find an owner from a plate.

We only share data with providers that help us run the service, acting on our behalf, following our instructions and under a contract meeting Article 28 GDPR (processors):

We may also disclose data to judicial, police or administrative authorities where the law requires it. Otherwise, we don't share data with third parties. An up-to-date list of processors is available on request at [email protected].

Browser push services may process data outside the European Economic Area (EEA), notably in the United States. These transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or on the standard contractual clauses approved by the Commission (Implementing Decision (EU) 2021/914). Notification content travels encrypted and can only be read on your device.

If another processor ever handles data outside the EEA, we will apply the same safeguards and update this policy.

When the period ends, data is deleted or irreversibly anonymised.

We don't use advertising, analytics or third-party cookies, nor social media trackers. We only use what is strictly necessary to provide the service you ask for, so we don't need your consent (Article 5(2) of Portuguese Law 41/2004 and Article 5(3) of Directive 2002/58/EC).

You can delete this data at any time in your browser settings. If you do, you will need to sign in again.

• All connections use HTTPS (TLS).
• The PIN is stored with argon2id and never in readable form. After 5 wrong attempts, access is temporarily locked.
• Sessions use a cookie inaccessible to scripts, renewed on each use, and can be ended on any device.
• Photos and documents are not public: they are only reachable through signed links that expire.
• Photo metadata, including location, is removed on upload.
• Administrative access is restricted and every action is logged.
• We make regular backups and apply security updates.

No system is infallible. If a personal data breach occurs, we will notify the CNPD within 72 hours where required and inform affected people without undue delay if there is a high risk to their rights (Articles 33 and 34 GDPR).

• Access and portability: in Account › Privacy, use “Download my data” to get a complete copy in a structured file (JSON).
• Rectification: you can correct your data in your account at any time.
• Erasure: in Account › Delete account. Deletion is immediate and permanent, except for data the law requires us to keep.
• Restriction and objection, in particular to processing based on legitimate interest.
• Not being subject to solely automated decisions with legal effects (section 13).
• Lodging a complaint with the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.

To exercise rights not available in your account, write to [email protected]. We reply within one month, extendable by two further months for complex requests, in which case we will let you know. Exercising your rights is free. To protect your account, we may ask you to confirm the request from the email linked to it.

To prevent abuse, the system may automatically limit alerts sent from a device (for example, after many alerts in a short time) and temporarily lock an account after several wrong PIN attempts. These measures are temporary, have no legal effects and can be reviewed by a person on request at [email protected]. We make no other automated decisions and do no profiling.

Accounts are for people aged 18 or over. We don't knowingly collect data from minors through accounts. If we learn that a minor created an account, we will delete it.

We may update this policy to reflect legal or service changes. If changes are significant, we will notify account holders by email or in the app at least 15 days in advance. The version in force is always shown at the top of this page.