Privacy policy – VeiligSamen

Who we are

VeiligSamen is a product of Gold Development, registered with the Dutch Chamber of Commerce under number 61213535. Gold Development is the data controller for the data the app and the website process. You can reach us at info@veilig-samen.nl.

This policy applies to the VeiligSamen app (Android and iOS) and to the website veilig-samen.nl. The app is intended for people aged 18 and over; we do not target children and do not knowingly collect data from children.

What data

We process only what is needed to run an account and to alert neighbours. We do not ask for access to your contacts, photos or messages, and we show no advertising.

Data we process
Data	What it is	What for
Email address and password	You sign in with your email address. We store your password hashed only; we cannot read it.	Account, signing in, email confirmation and password recovery.
Display name	The name you choose yourself.	Visible to you in your profile. Neighbours do not see your name — except a helper you accept yourself during an alert, and you then see theirs.
Abuse reports and blocks	If you report someone, we record who reported, who it was about, which reason you chose, what you wrote yourself and — if you reported a message — a copy of that message. If you block someone, we keep only who blocked whom, and when.	So that a person can judge what is going on and act. The copy of the message is needed because the original is erased after 90 days, and a report without the text cannot be judged.
Device data	A device id the app creates, platform (Android/iOS), model, operating system version, app version, language and a push token from Firebase Cloud Messaging.	Delivering notifications to the right device, managing your sessions, and being able to sign out or remove devices.
Precise location	While the app is open it occasionally sends your position to our server ("presence"). If you send an SOS, the app keeps refreshing your position for as long as that alert runs — also when you turn the screen off or move to another app — so neighbours see where you are now. That lasts two hours at most: after that the alert closes regardless and the sharing stops. Outside a running alert we use your location in the background only if you switch that on yourself under Reachability; it is off by default, your phone asks you for a separate permission, and you can switch it off again at any time.	Determining which neighbours are within the alert distance and showing them the distance and a pin on the map. That distance starts at 500 metres and grows to at most 2 kilometres for as long as nobody offers to come and help.
SOS alert	Time, position, status (active, reported safe, cancelled, unanswered or closed) and an optional short note you type yourself. We also record which devices received the alert, whether we asked you if you are safe and whether you answered.	Showing the alert to neighbours nearby, showing how many neighbours were reached, and being able to investigate abuse.
Crash logs	Technical error reports from the app (device type, app version, what went wrong). No location, no content of alerts.	Finding faults and keeping the app stable.
Technical log files	IP address, time and requested function in our server's logs.	Security, for example limiting the number of sign-in attempts, and resolving faults.
Support requests and deletion requests	What you email us, and the email address you enter if you request deletion of your account through the website.	Handling your request, and for a deletion request checking whether the address belongs to an account and sending you a confirmation link.
Fixed addresses (reachability)	If you add an address yourself, we keep that address and its coordinates, plus the days and times you choose with it. You fill in a postcode and a house number; the street, the town and the coordinates come from PDOK (the Dutch land registry). At most two addresses.	Alerting you about an incident near that address, even when the app is closed. Neighbours never see your address — if you offer to help they see the same rounded distance as always, and nothing more.
Stars for helpers	If the alert was yours, you can give the neighbours who came to help one to five stars afterwards. Stars only: there is no text field. We record who gave which helper how many stars, and keep an average per helper along with how often they turned out.	A future creator sees the average and the number of times somebody has helped next to their offer — so you know who may be standing at your door. They do not see who gave which stars.
Phone number	If you want to respond to a neighbour’s alert, we ask for a mobile number and text a code to it. The number is visible only to you, in your own profile.	Confirming that a real person is behind an offer to help. Neighbours never see your number — not even once you have been accepted.

What neighbours see of you: a pin on the map at the place of your alert, the distance to them (rounded) and, if you wrote one, the note you typed. Not your name and not your email address.

What for

We use your data solely for these purposes:

Creating, securing and managing your account, including confirming your email address and recovering your password.
Sending neighbours within the alert distance a push notification with your position and distance when you send an SOS, and sending you a notification when a neighbour does.
Stopping alerts again when you choose "I am safe" or cancel them. If you do not answer the check-in, the alert does not stop by itself: it stays active and your location stays shared until you answer or until the two-hour limit.
Securing the app and the server against abuse and resolving faults.
Answering your questions and requests.

The legal basis for this is the agreement you enter into with us by using the app (Article 6(1)(b) GDPR). For your location we also ask your consent through your phone's location permission; you can withdraw that at any time in your phone's settings. Without location you can go on using the app, but you cannot send an SOS and cannot receive alerts from neighbours. Security, log files and crash logs we process on the basis of our legitimate interest in providing a reliable service (Article 6(1)(f) GDPR). On that same basis we keep a record for one year of how an alert went — who received it, who helped and how it ended — so that we can investigate a complaint or abuse afterwards.

We do not use your data for advertising, profiling or automated decision-making, and we do not sell it.

Retention periods

How long we keep data
Data	Retention period
Presence (your position while the app is open)	At most 30 minutes after the last update; after that it is deleted automatically.
Messages in an alert's conversation	90 days after the alert has ended. After that we remove the text; the conversation still shows that there was a message, so the order makes sense. If you want to keep a conversation, a copy to yourself is the first route: you email it to yourself from the app and we need keep nothing longer. If you would rather leave it here, then as the person who raised the alert you can ask for it to be kept, and the text stays for a year. If the police, an insurer or a court asks for one specific conversation, we keep that conversation for as long as is necessary.
The alert itself: who received it, who helped and how it ended	One year after the alert has ended; after that we delete it entirely. We keep this so that it is possible to establish afterwards what happened — for example in the case of a complaint or abuse — on the basis of our legitimate interest (Article 6(1)(f) GDPR).
An abuse report	One year after we have dealt with it, including the copy of the reported message — which therefore remains when the message itself has already been erased. A block we keep for as long as you leave it in place; unblock someone and the rule goes at once.
Account, display name and devices	For as long as your account exists. If you delete your account it is disabled at once: all your devices are signed out, their push tokens erased and your presence removed, so nothing more arrives or is shared from that moment. The data itself — your account, your device records and your alerts — we delete permanently 90 days after your request (see "Deleting your account"). If you remove a single device, the same happens for that device: it is signed out, loses its push token and disappears from your list, while the record of which devices received an alert stays intact.
Sessions (sign-in tokens)	At most 7 days after last use, or immediately on signing out, on removing that device, or on account deletion.
Confirmation and recovery codes	15 minutes (email confirmation) and 60 minutes (password recovery).
Crash logs	90 days.
Technical log files	Briefly, only for as long as is needed for security and fault analysis.
Support requests	Until your question has been dealt with, and after that for as long as we must be able to demonstrate it.
Fixed addresses and their times	For as long as you leave them there. Remove an address, or your account, and they are gone at once.
Stars for helpers	The stars themselves go with the alert they belong to (one year). The average and the number of times somebody helped sit with that helper and stay for as long as their account exists.
Phone number	For as long as your account exists. Delete your account and the number goes with the rest of your data. The text-message codes themselves expire after 10 minutes.

Deleting your account

You delete your account yourself: in the app via Menu → Delete account, or via veilig-samen.nl/en/delete-account, where you confirm it by email. As soon as you confirm, your account is disabled at once: you receive no more alerts, neighbours no longer see you as a neighbour nearby, and any running SOS alert is ended.

90 days after your request your data is deleted for good; until then your account is disabled. We use that period only so that abuse can be checked. If you sign in to the app within those 90 days you can re-enable your account; after that it is no longer possible.

Alerts you sent or received do not disappear with it straight away: they keep their own periods (messages 90 days, the alert itself a year). Your name is no longer attached — it is replaced by "Deleted account" — but the alert stays linked to an account number, because without it we can no longer establish who did what. If there is a request from the police or a court concerning one conversation, that conversation stays until it has been dealt with.

Processors

We use a few parties that process data on our behalf. With each of them we have agreements about protecting your data; they may not use it for their own purposes.

Parties that process data for us
Party	What they do	Which data
Brevo (Sendinblue SAS, France)	Sends our emails: confirmation code, password recovery and the confirmation link for deleting your account.	Email address, display name and the content of that email.
Google Firebase Cloud Messaging (Google Ireland Ltd.)	Delivers push notifications to your phone. Google may process data outside the EU; that happens under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.	Push token and the content of the alert: distance and the position of the SOS.
TransIP B.V. (Netherlands)	Hosts our server and database in a data centre in the Netherlands.	All data from the table above, encrypted in transit (HTTPS).
Google Firebase Crashlytics (Google Ireland Ltd.)	Collects the app's crash logs so that we can find faults. Google may process data outside the EU under the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.	Device type, operating system, app version, an installation id and the technical error message; no location, no account data.
PDOK (Kadaster)	Supplies the map background in the app. When map tiles load, PDOK sees your IP address and which map area you are looking at.	IP address and map area; no account data.
CM.com (CM.com Group N.V., the Netherlands)	Sends the text message with your confirmation code. The company is Dutch and sends from the Netherlands.	Your phone number and the text of that one message. No name, no email address, no location.

Beyond that we share your data with nobody, unless we are legally obliged to. All traffic between the app, the website and our server is encrypted, passwords are stored hashed, and only VeiligSamen's administrators have access to the server.

Your rights

You have the right of access to your data, to rectification, to erasure, to restriction of processing, to portability of your data, and to object to processing based on our legitimate interest. Consent you have given you can always withdraw.

Your display name and email address you change yourself in the app under Menu.
Your account you delete yourself in the app via Menu → Delete account, or via veilig-samen.nl/en/delete-account with a confirmation by email (see "Deleting your account").
Lost a device, or no longer using one? Remove just that device via Menu → Devices; your account and your other devices go on working.
Location access you withdraw in your phone's settings.
One thing you do not have to ask us for: a copy of an alert you were part of, you send yourself from the app — you get the conversation and what happened by email, at the address your account was created with. For access, portability or other requests, email info@veilig-samen.nl. We respond within a month and may ask you to demonstrate that the account is yours.

Unhappy with how we handle your data? Let us know and we will work out a solution together. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

Contact

Gold Development · Coolsingel 139, 3012 AG Rotterdam · Dutch CoC 61213535 · info@veilig-samen.nl · veilig-samen.nl/en/support

If we change this policy, we publish the new version on this page with a new date. For significant changes we also say so in the app.