Privacy policy

Updated 23 October 2026 · Suomeksi

1. Controller

Afir · info@afir.fi. Contact the same address for privacy matters.

2. Data we collect

• Account data: email address, password (stored hashed) and name.
• Profile data (optional): phone number, profile picture, employee/reference ID, and company name, business ID and address. Only you can see it and it is added to your own reports.
• Vehicles: make, model, registration number and odometer reading.
• Driving log entries: date, distance, odometer readings, purpose, vehicle type, extra passengers and notes.
• Location data: in the full version, automatic tracking records a trip’s route and stops when you have granted location permission (including in the background). Route planning uses the search terms you type. You can grant and withdraw permission in iPhone settings. The free version does not need location.
• Favourite places: addresses you save yourself (home, work, others).
• Subscription data: whether you have the full version and its validity. We do not receive your payment card details; Apple processes payment.
• Technical data: log data necessary to run the Service, such as error reports.

We do not use your data for advertising or track you across other apps or websites. We do not sell your data.

3. Purposes and legal bases

• Providing the Service: account, driving log, reimbursement calculation and reports (contract).
• Location features: automatic tracking and route planning (consent, which you can withdraw at any time).
• Subscription management and support (contract, legitimate interest).
• Security and improving the Service (legitimate interest).

4. Recipients

We use processors that handle data on our behalf:

• Supabase – database, authentication and file (profile picture) storage.
• Mapbox – address search, routing and maps. It receives search terms and the coordinates of a route’s start and end points.
• Apple – App Store and subscription payments.
• RevenueCat – subscription status management (when in use).
• Cloudflare – hosting of this website.

Some providers process data outside the EU/EEA (for example in the United States). For such transfers we rely on the European Commission’s standard contractual clauses or another lawful transfer mechanism.

5. Retention

We keep your data while your account is active. When you delete your account in the app, your account and all related data are permanently deleted. You can also delete individual trips, vehicles and favourite places.

6. Your rights

You have the right to access, rectify and erase your data, to restrict and object to processing, and to data portability. You can manage most of your data directly in the app (Settings → Your details). For other requests contact info@afir.fi. You also have the right to lodge a complaint with the supervisory authority: the Finnish Office of the Data Protection Ombudsman.

7. Security

Connections are encrypted (HTTPS) and database access is restricted so that each user can only see their own data.

8. Changes

We update this policy when needed. The latest version is always on this page.