Opt'o'moto

Privacy Policy

1. Controller

Christian Döhl
Am Gellert 6a
85084 Reichertshofen, Germany
Email: service@optomoto.de

2. General Data Processing

We process personal data of our users only to the extent necessary to provide a functional platform and our content and services. Processing is based on Art. 6(1) GDPR.

We do not use any analytics, tracking or advertising tools. No data is passed on to advertisers.

3. Data We Store

When you create an account and use our platform, we store the following personal data:

  • Email address and password (hashed)
  • Display name and username
  • Profile information: home location (city/postal code), riding style, experience level, short bio
  • Motorcycles: brand, model, year, engine size, fuel consumption
  • Planned and completed tours including route data (GPS coordinates, waypoints, GPX tracks)
  • Overnight stop locations along tours
  • Tour reports and photos
  • Notifications and their read status
  • Friend connections (friendships)
  • Web push subscription (if push notifications are enabled)

Legal basis: performance of a contract (Art. 6(1)(b) GDPR), as this data is required to provide the platform features.

4. Hosting (Vercel)

This platform is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit our pages, information is automatically stored in server log files, including your IP address, browser type, operating system and the page requested.

The legal basis is our legitimate interest in the stable and secure operation of the platform (Art. 6(1)(f) GDPR). Vercel processes data, among other places, in the USA. The EU Standard Contractual Clauses apply.

5. Registration & Authentication (Supabase)

For registration and login, we use Supabase (Supabase Inc., USA) as our authentication service and database. The database is hosted on AWS eu-west-1 (Ireland). The EU Standard Contractual Clauses apply.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

6. Map Services (OpenStreetMap, Mapbox)

For interactive maps we use OpenStreetMap tiles (via Leaflet) and Mapbox for route calculation and map preview images. When loading map tiles, your IP address is transmitted to the tile servers of OpenStreetMap (OpenStreetMap Foundation, UK). For route calculations and map previews, coordinates and your IP address are transmitted to Mapbox Inc. (USA).

Legal basis: our legitimate interest in providing map and routing functionality (Art. 6(1)(f) GDPR).

7. Weather Data (OpenWeatherMap)

For weather forecasts along planned tours, we use the OpenWeatherMap API (OpenWeather Ltd, UK). The coordinates of pass locations and overnight stops along the tour are transmitted to this service. Weather data is cached in our database for up to 24 hours to minimise requests.

Legal basis: our legitimate interest in providing tour-relevant weather data (Art. 6(1)(f) GDPR).

8. Geocoding (Nominatim / OpenStreetMap)

For location search (geocoding and reverse geocoding), we use the Nominatim API from OpenStreetMap. Your search queries and IP address are transmitted to OpenStreetMap Foundation servers (UK).

Legal basis: our legitimate interest in providing a search function (Art. 6(1)(f) GDPR).

9. Email Delivery (Resend)

We use Resend (Resend Inc., USA) to send transactional emails such as tour invitations, account activation notices and password reset emails. For this purpose, recipient email addresses and the email content are transmitted to Resend. The EU Standard Contractual Clauses apply.

Legal basis: performance of a contract or our legitimate interest in notifying users about relevant events (Art. 6(1)(b)/(f) GDPR).

10. AI Tour Planning (Google Gemini / OpenAI)

The AI-assisted tour planning feature uses large language models — either Google Gemini (Google LLC, USA) or OpenAI (OpenAI Inc., USA). When using this feature, tour planning preferences such as desired region, number of days, distance per day and riding style are transmitted to the respective AI provider. No personal data such as name or email address is included in these requests.

Legal basis: our legitimate interest in providing AI-assisted planning (Art. 6(1)(f) GDPR).

11. Live Location Sharing (Buddy Location)

The optional Buddy Location feature allows users to share their real-time GPS position with other riders during a tour. Participation is entirely voluntary and requires explicit action (starting a session or joining via invite link).

During an active session, GPS coordinates (latitude, longitude), speed and heading are transmitted and stored in our database. This data is associated with the session and the participant name you provide.

Data minimisation: When a session is ended, all GPS coordinates of all participants are immediately and irreversibly deleted. Inactive sessions (already ended) are automatically removed from the database after 7 days.

Legal basis: consent through voluntary participation (Art. 6(1)(a) GDPR).

12. Cookies & Local Storage

We use only technically necessary cookies: a session cookie for authentication (Supabase Auth) and a language preference cookie. These are required for the platform to function correctly and cannot be disabled.

We do not use tracking, analytics or advertising cookies. On first visit, an informational banner is displayed to notify you about our exclusive use of technically necessary cookies. Your acknowledgement is stored in your browser's local storage (localStorage).

13. Your Rights

Under GDPR you have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR) — download a complete overview of your stored data via Edit profile → Download my data, or contact service@optomoto.de
  • Right to rectification (Art. 16 GDPR) — correct inaccurate data directly via your profile settings
  • Right to erasure (Art. 17 GDPR) — delete your account yourself via Edit profile → Delete account. This permanently removes all personal data (profile, tours, motorcycles, notifications, GPS data, profile picture). Alternatively: email service@optomoto.de
  • Right to restriction (Art. 18 GDPR) — request restriction of processing
  • Right to data portability (Art. 20 GDPR) — export your tour data in GPX format via the tour export function; full data export via Download my data
  • Right to object (Art. 21 GDPR) — object to processing based on legitimate interest

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Bavaria is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach.

14. Contact

For questions about data protection or to exercise your rights, contact us at: service@optomoto.de

Last updated: June 2026