Privacy Policy

01

Who We Are

ASAP Safety is a personal safety app founded by Yeline Hoogmans. The app helps users, especially women, feel safe by sharing their location with trusted contacts and triggering emergency alerts when needed.

For the purposes of GDPR, ASAP Safety acts as the Data Controller for all personal data processed through the application.

• Operating name: ASAP Safety
• Legal entity: ASAP Safety B.V. (in oprichting) — to be registered with the Dutch Chamber of Commerce (KvK)
• Country of establishment: The Netherlands
• Email: contact@asapsafety.nl
• Website: asapsafety.nl

02

Data We Collect

We apply the principle of data minimisation: we only collect data that is strictly necessary to provide the app's safety features.

Account & Profile

• Phone number — used for authentication via Firebase Phone Auth
• Name and username — used to set up your profile and identify you to trusted contacts
• Email address — used for account management and notifications
• Gender — optional, used only for in-app personalisation; never shared with third parties

Location Data (Sensitive)

• GPS location (precise) — collected only while an active SOS session or Check-In is running. We do not track your location in the background outside of these active sessions.
• Location data is never stored permanently. It is transmitted in real-time to your Safety Circle only and is deleted immediately when the session ends.

Contacts & Safety Circle

• Contacts you add manually — we store only the phone number and/or username of contacts you explicitly invite to your Safety Circle. We do not access or scan your device's phonebook.
• Invited contacts are notified when added and can refuse or remove themselves from your Safety Circle at any time.

Push Notifications

• Device push token (FCM) — stored to deliver SOS alerts, check-in updates, and contact requests

App Usage Analytics

• Firebase Analytics — anonymised usage events (e.g., "SOS started") to help us improve the app. No personally identifiable information is linked to these events.
• During the beta phase, additional anonymised crash logs and performance data may be collected to identify and fix issues.

03

Legal Basis for Processing

Under GDPR Article 13, we are required to inform you of the legal basis for each processing activity. The table below sets out our legal bases:

Where we rely on consent as our legal basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Where we rely on legitimate interest, you have the right to object. We have conducted a balancing test in each case and determined that our interests do not override your fundamental rights.

04

How We Use Your Data

We use your personal data solely for the purposes described below. We do not use your data for advertising, profiling, or any purpose unrelated to app functionality.

05

How We Store Your Data

All data is stored in Google Firebase (Firestore), with servers located in europe-west1 (Belgium). This means all data remains within the European Economic Area (EEA) and is subject to EU data protection law.

We apply Firebase Security Rules so that users can only access their own data and the data of contacts they have an active trusted relationship with.

Security Measures

• All data is encrypted in transit using TLS 1.2 or higher
• All data is encrypted at rest using AES-256 encryption (provided by Google Firebase)
• Authentication is enforced via Firebase Phone Auth with rate limiting
• Access to production data is restricted to authorised personnel only
• Location data is transmitted in real-time and is never written to persistent storage

06

Third-Party Processors & Data Processing Agreements

We engage the following third-party processors to operate our service. Each processor has been selected for GDPR compliance, and we have entered into (or rely on) a Data Processing Agreement (DPA) with each party as required under GDPR Article 28.

We do not sell, rent, or otherwise transfer personal data to any other third parties. We will update this section if additional processors are engaged.

07

Data Sharing

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

• With your trusted contacts — when you start an SOS session or check-in, your name and real-time location are shared with the contacts in your Safety Circle, and only for the duration of the session
• With Google (Firebase / FCM) — for authentication, database storage, and push notifications, as described above
• If required by law — we may disclose data if required by applicable law, court order, or legal process. Where permitted, we will notify you before disclosing your data
• In the event of a business transfer — if ASAP Safety is acquired or merges with another entity, your data may be transferred as part of that transaction. You will be notified in advance and given the opportunity to delete your account

08

Data Retention

We retain personal data only for as long as necessary to provide the service or as required by law.

When you delete your account, all personal data associated with your account is permanently removed from our systems within 30 days, except where retention is required by law.

09

Your Rights (GDPR)

If you are located in the European Union or EEA, you have the following rights under GDPR. We will respond to all requests within 30 days.

To exercise any of these rights, contact us at contact@asapsafety.nl. We may ask you to verify your identity before processing your request.

10

Automated Decision-Making & Profiling

ASAP Safety does not engage in any automated decision-making or profiling as defined under GDPR Article 22. No decisions that produce legal or similarly significant effects are made about you solely on the basis of automated processing.

We do not use your data to build behavioural profiles, target advertising, or make inferences about your characteristics, preferences, or behaviour beyond what is strictly necessary to provide the safety features of the app.

11

Children's Privacy

ASAP Safety is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13.

Age verification during beta: All beta testers are required to confirm they are 13 years of age or older during the registration process. Invited testers are screened before being granted access.

If you believe a child under 13 has provided us with personal information without parental consent, please contact us immediately at contact@asapsafety.nl. We will promptly delete the relevant data.

For users between the ages of 13 and 16 who are located in the Netherlands or other EEA member states where a higher minimum age applies, parental or guardian consent may be required. Please contact us if you have questions about this.

12

Data Breach Procedure

We take data security seriously. In the event of a personal data breach, we will follow the procedure below in accordance with GDPR Articles 33 and 34:

1. Detection & containment: We will immediately contain the breach and assess its scope and severity.
2. Notification to the AP: If the breach is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours of becoming aware of the breach.
3. Notification to you: If the breach is likely to result in a high risk to your rights and freedoms (e.g., exposure of location data or contact information), we will notify you directly without undue delay via email or in-app notification.
4. Documentation: All breaches, regardless of severity, will be documented internally in our breach register.

To report a potential security vulnerability, contact us at contact@asapsafety.nl.

13

Deleting Your Account

You can delete your account directly from the app. Please see our How to Delete Your Account page for step-by-step instructions.

Upon deletion:

• All personal data associated with your account will be permanently deleted within 30 days
• Your phone number will be removed from the Safety Circles of any contacts who have added you
• Anonymised analytics data (which cannot be linked back to you) may be retained
• Any legal holds or retention obligations will be communicated to you at the time of your request

14

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Notify you via in-app notification or email at least 14 days before the changes take effect
• Where changes require new consent, prompt you to provide it before continuing to use the app

Continued use of the app after the effective date constitutes acceptance of the updated policy.