Controller. The individual who develops and runs Rotta; the contact is at the bottom of this page.
Data. Email, hashed password, language; accepted consents with date and version; boats, favorites and routes you save; reports with their position, votes and confirmations; for notifications the device token, the position rounded to about 1 km and the active route; your boat's position only if you turn on live sharing; technical errors of app and server (Sentry).
Purposes and legal bases. Providing the service you ask for (contract, GDPR art. 6.1.b); security and abuse prevention (legitimate interest, art. 6.1.f); live sharing only with your consent (art. 6.1.a), revocable in the app.
Retention. While you have the account; deletion becomes final 7 days after the request (signing in again cancels it); exported archives can be downloaded for 7 days; the account operations log, without email, 12 months.
Processors. OVH (servers in the European Union, where the data is kept), Sentry (diagnostics, with standard contractual clauses outside the EU), Google Firebase Cloud Messaging (notifications), an SMTP provider once email is turned on: during the beta Rotta sends no email. We do not sell data and show no ads.
Your rights. Access and portability (Account → Export my data), rectification, erasure (Account → Delete account, or on the web at /legal/account-deletion), objection and restriction by writing to the contact; complaint to the Italian Data Protection Authority (Garante).