Privacy policy
KMklopt is a mileage log (rittenregistratie) app for Dutch lease drivers. This policy explains what data the app and our server process, why, where it is kept and for how long. The controller is KMklopt (Nurhak Altin), reachable at nurhakaltin@gmail.com.
In short
- Your log is on your iPhone and, once you sign in, copied to our server in the EU.
- Raw GPS points of your routes never leave your iPhone.
- No ads, no analytics, no tracking, no selling of data.
- You can delete your account in the app. After 30 days everything is erased for good.
What data
| Data | Purpose | Where |
|---|---|---|
| Account: name, email address and the id of your Apple or Google account | Signing in, linking your data to you | Server (EU) |
| Your log: trips with date, times, start and end address, odometer readings, character, purpose and detour; car and licence plate; saved places with coordinates; routines; absences; reconstructions; export history; the revision log | The app: keeping your log, syncing between devices, making audit packs | iPhone and server (EU) |
| Raw GPS points of a trip | Measuring a trip's distance | Only on your iPhone; deleted 90 days after a trip is final unless you choose to keep them |
| Photos of your dashboard and receipts | Evidence for readings and trips | Only on your iPhone |
| Purchases (Plus, Gap pass) | Access to paid features | Apple processes the payment; we receive no payment details |
KMklopt uses your location only during a trip (also in the background, with the blue indicator showing) and stops when the trip ends. Motion data is used only on your iPhone to notice that you are driving. Face ID is used only through iOS; we receive no biometric data.
When you look up your licence plate, your iPhone asks the RDW's open data for the vehicle details directly. Only the plate is sent.
Legal basis
We process this data to provide the service you use (performance of a contract, GDPR Article 6(1)(b)). The legal duty to keep a mileage log is yours as the driver; KMklopt helps you with it.
Where and how it is protected
Our server runs on Cloudflare. Your data is stored in the EU (Cloudflare D1 and R2 with EU jurisdiction). Everything is encrypted in transit (TLS) and at rest, and every request is checked per account. The data is not end-to-end encrypted: that is needed to recover your account and, later, to share it with your accountant. So we can technically see your data; we do not, except at your request for support or when the law requires it.
Every change to your log is kept in a revision log that the server seals per record in a hash chain, so any later change is visible.
Who we share data with
- Cloudflare: hosting of our server and storage (processor, EU).
- Apple: Sign in with Apple, App Store purchases and subscriptions.
- Google: only if you sign in with Google.
- RDW: only the licence plate you look up.
- Stripe: only for companies that pay for KMklopt for their drivers. Stripe handles the payment and invoices and receives the company name, billing address, VAT number and the admin's email address. Stripe receives no data about drivers, only how many there are.
- Your employer: only if you join yourself with an invite code. Your employer then sees, per car, the totals the app computes (whether your log is up to date, open checks, private km against the limit or business km) and, if you allow it, the km statements and audit packs you send yourself. Never your trips, addresses or locations. You can limit or stop this at any time in Settings → Employer; it takes effect at once. Every join and change is recorded.
We do not sell data and use no advertising or analytics services.
How long
As long as your account exists. When you delete your account (Settings → Delete account) it is locked at once and the data is removed from your devices. Within 30 days you can restore it by signing in again; after that we erase everything for good, including your revision log. Database backups age out within a further 30 days.
Note: the Belastingdienst can ask for your log up to 7 years back. Make an audit pack (PDF and CSV) before deleting your account; the app offers to.
Your rights
You may access, correct, delete and take your data with you. Much of this works directly in the app: correct trips, take your data with the audit pack (PDF and CSV), delete with Delete account. For anything else, email nurhakaltin@gmail.com. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Changes
When this policy changes we update the date at the top. We tell you in the app about important changes.