REVV
Privacy Policy
Last updated: 15 September 2026
In short. REVV is the companion app for a motorcycle tour you booked with us. We keep the minimum needed to run it: your email address, an optional name, your booking, and the technical records that keep your account secure. Your location is used on your phone to guide you along the route and is sent to Mapbox to calculate directions; it is never stored on our servers. We do not sell data, show ads, or use analytics or tracking SDKs.
1. Who we are
The REVV app and the website app.revvtravel.com are operated by Revv driving tours SL, a company established in Spain (“REVV”, “we”). We are the data controller for the personal data described in this policy. You can reach us at info@revvtravel.com.
2. What this policy covers
This policy covers the REVV iOS app and the pages we serve at app.revvtravel.com, including the sign-in link landing page. Our public website revvtravel.com and the booking of the tour itself may be covered by their own notices, which we give you when you book.
3. The data we process
| Category | What exactly | Where it comes from |
|---|---|---|
| Account | Email address; a display name if you choose to set one. | You, when you sign in and in the Profile screen. |
| Booking | The tour, its start date, the motorcycle model assigned to you, booking status. | Created by REVV staff from the tour reservation you made with us. The app does not take bookings or payments. |
| Sign-in security | A hashed copy of each sign-in link and code we email you, the IP address that requested it, timestamps and attempt counts. The link and code themselves are never stored in clear. | Generated when you ask for a sign-in link. |
| Sessions and devices | Hashed session tokens, and for each installation the platform, device model, iOS version and app version, with the time it was last seen. | The app, when you sign in and while you stay signed in. |
| Location | Your precise location while you use navigation, including in the background if you allow it, so guidance continues with the screen off. | Your device. It is processed on the phone and sent to Mapbox for directions (see section 5). It is not sent to or stored on REVV servers. |
| Trip progress | Which stops of the day you have reached, and the position to resume from. | Stored only on your device. Deleted when you sign out. |
| Server logs | IP address, request metadata, a request identifier, error diagnostics. The app shows the request identifier in error messages so a support request can be matched to a log line. | Our hosting provider, when the app talks to our API. |
We do not collect payment details, contacts, photos, health data, advertising identifiers or any data for profiling. The app contains no analytics, attribution or advertising SDK, and it does not track you across other apps or websites.
4. Why we process it and on what legal basis
- To provide the app to you (performance of our contract with you): sign you in, show your booking and the tour, keep the tour available offline, guide you along the route.
- To keep accounts secure (our legitimate interest, and yours): verify sign-in links, rotate and revoke sessions, rate-limit abusive requests by email address and IP address, detect stolen tokens.
- To operate and support the service (legitimate interest): diagnose errors, answer your support requests, tell you when an app update is required.
- To meet legal obligations: keep records of tours we have delivered for as long as Spanish accounting and tax law requires.
We do not use your data for marketing and we do not make automated decisions about you.
5. Location, maps and navigation
Navigation is powered by Mapbox. When you start guidance, the app sends your coordinates to Mapbox’s routing service to calculate and recalculate the route, and requests map tiles for the area around you. Mapbox processes this data under its own privacy policy, available at mapbox.com/legal/privacy. We do not attach your identity to these requests, and REVV servers never receive your position.
You control location access in iOS Settings → Privacy & Security → Location Services → REVV. “While Using” is enough for guidance with the screen on; “Always” lets guidance continue when the screen is locked. Without location access you can still read the tour, but turn-by-turn guidance will not work.
6. Who we share data with
We share personal data only with the service providers that run the app for us, each bound by a data processing agreement and acting on our instructions:
- Vercel (hosting of our API and website, server logs, file storage for tour content). Our servers run in Frankfurt, Germany.
- Neon (our Postgres database).
- Upstash (short-lived counters used for rate limiting, keyed by email address and IP address).
- Mapbox (maps, directions and navigation, as described in section 5).
- Our email delivery provider, to send you sign-in links and codes.
- Apple, which distributes the app through the App Store and TestFlight under its own terms.
We do not sell or rent personal data. We may disclose it when the law requires it, to protect our rights or the safety of riders, or as part of a merger or sale of the business, in which case this policy continues to apply.
7. International transfers
Some of these providers are established in the United States or may process data outside the European Economic Area. Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses or on an adequacy decision such as the EU-US Data Privacy Framework, together with the safeguards the provider offers.
8. How long we keep data
- Sign-in links and codes: deleted 24 hours after they are used or expire.
- Sessions: deleted 30 days after they expire. Sessions you revoke by signing out are kept until then so that a stolen token can be recognised.
- Rate-limit counters: 15 minutes to 1 hour.
- Account and bookings: for as long as you keep your account. When you delete it (section 10) your email address and name are removed immediately; the record of the tour you took stays in our books without anything that identifies you, for as long as accounting and tax law requires.
- Server logs: for a limited period, for security and troubleshooting.
- Data on your phone (tour content, offline maps, trip progress): until you sign out, switch account or delete the app.
9. Your rights
Under the General Data Protection Regulation you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and you can withdraw a consent at any time. Write to info@revvtravel.com from the email address of your account and we will answer within one month.
If you believe we handle your data unlawfully you can complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority of the EU country where you live.
10. Deleting your account
In the app, open Profile and choose Delete account. This signs you out of every device, deletes the data the app kept on your phone, and removes your email address and name from our records straight away. You can also ask us by email. Deleting the account does not cancel a tour you have booked; contact us for that.
11. Children
REVV tours involve driving a motorcycle, so the app is meant for adults. We do not knowingly collect data from anyone under 18. If you think a minor has an account, tell us and we will delete it.
12. Security
All traffic between the app and our servers is encrypted. Sign-in links, codes and session tokens are stored only as cryptographic hashes; access tokens are short-lived and sessions are rotated on every use and revoked as a whole if a token is reused. Staff access to the operations dashboard is logged.
13. Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your data in a way that matters to you, we will tell you in the app before it takes effect.
14. Contact
Revv driving tours SL, Spain. info@revvtravel.com.