DriveFlow ("we", "our", "us") respects your privacy. This Privacy Policy explains how we collect, use, share, retain, and delete personal information when you use www.driveflow.ie and the DriveFlow mobile app (together, the "Services").
DriveFlow is the data controller. We operate from Ireland. For privacy requests, contact us at driveflowweb@gmail.com.
1. Information We Collect
Depending on how you use the Services, we may collect:
- Account details — email address, username, and related account metadata.
- Password information — when you create a password-based account, we store a password hash only. We do not store your password in plain text.
- Sign-in identifiers — if you use Google Sign-In or Sign in with Apple, we receive and store the relevant provider identifiers (such as Google or Apple subject IDs) needed to authenticate your account. We may also receive a profile image URL where the provider supplies one.
- Mock-test progress — scores, timing, category breakdowns, and related practice history when you take mock or example tests while signed in.
- Purchased test-centre access — records of which centres you have unlocked, licence periods, and related purchase identifiers.
- Contact and support messages — information you submit through contact forms or by email.
- Authentication tokens — on the website, a session/auth token may be stored in your browser (for example in localStorage). In the mobile app, authentication tokens are stored using SecureStore on your device.
- Technical and usage data — such as IP address, device/browser type, pages viewed, and similar diagnostic data needed for security, rate limiting, and (with consent on the website) analytics.
2. How We Use Your Information
We use personal information to:
- Create and manage your account, and keep you signed in
- Provide driving test routes, theory resources, and mock-test features
- Track and display your mock-test progress
- Process purchases and manage access to paid test-centre content
- Send transactional emails (for example password resets, purchase confirmations, and replies to contact requests)
- Protect the Services against abuse, fraud, and unauthorised access
- Improve the website and app experience
- Analyse website traffic only where you have given cookie/analytics consent (see our Cookie Policy)
3. Legal Basis for Processing
Where the GDPR applies, we process personal data based on:
- Contract — to provide the Services you request (account, purchases, content access)
- Consent — for non-essential website analytics/advertising cookies, and where otherwise required
- Legitimate interests — security, fraud prevention, service improvement, and basic operations, balanced against your rights
- Legal obligation — where we must retain or disclose information to comply with law
4. Payments and Purchases
- Website purchases are processed by Stripe. DriveFlow does not store your full card details.
- App purchases (including test-centre access) are processed through the Apple App Store and managed with RevenueCat. Apple and RevenueCat process payment information according to their own policies. DriveFlow receives purchase/entitlement information needed to unlock content.
5. Emails
We use MailerSend to send emails such as contact-form messages, password-reset emails, and purchase confirmations. These emails contain the personal data needed to deliver the message (for example your email address and reset link).
6. Hosting and Infrastructure
Our API and database are hosted and processed using Railway. Website content is served from our web hosting for www.driveflow.ie. These providers process data on our behalf to operate the Services.
7. Other Service Providers
We may also use:
- Google Analytics and Google Ads on the website — only after you accept non-essential cookies
- Cloudflare Turnstile — to help prevent spam and abuse on forms such as signup and contact
- OpenAI — where a website chatbot is available, to process messages you send to the assistant
We do not sell your personal information.
8. Sharing of Data
We share personal data with the processors and platforms needed to run the Services, including:
- Apple (Sign in with Apple; App Store purchases)
- Google (Sign-In where used; Analytics/Ads on the website with consent)
- RevenueCat (app purchase entitlements)
- Stripe (website payments)
- MailerSend (transactional email)
- Railway (hosting and database)
- Cloudflare (Turnstile)
- OpenAI (chatbot, where used)
These parties process data under their terms and applicable law. We may also disclose information if required by law or to protect rights, safety, or the integrity of the Services.
9. International Data Transfers
Some providers (including Apple, Google, RevenueCat, Stripe, MailerSend, Railway, Cloudflare, and OpenAI) may process data in countries outside Ireland/the EEA, including the United States. Where required, we rely on appropriate safeguards such as the providers' standard contractual clauses or other lawful transfer mechanisms.
10. Data Retention
We retain personal data only for as long as needed to provide the Services and meet legal obligations:
- Account data (including email, username, password hashes, and Google/Apple sign-in identifiers) — while your account remains active
- Mock-test progress and purchased centre access — while your account remains active and access is relevant to the service
- Purchase records — as needed for accounting, tax, and dispute handling
- Authentication tokens — until they expire, you sign out, or you delete your account
- Contact messages — for as long as needed to respond and keep a reasonable support record
When you delete your account, we delete or anonymise associated personal data from our systems, except where we must retain limited records for legal or accounting reasons.
11. Account Deletion
If you have a DriveFlow account in the mobile app, you can delete it in-app:
- Open the app and go to Account
- Choose Delete Account and confirm
This permanently deletes your account and related data we hold (such as profile details, mock-test progress, and centre access records linked to your account), subject to any limited legal retention. Where applicable, we also request cleanup of related RevenueCat subscriber data.
If you need help deleting an account, or used the website only, email driveflowweb@gmail.com and we will assist.
12. Your Rights and Withdrawing Consent
Under the GDPR, you may have the right to:
- Access your personal data
- Request correction or deletion
- Object to or restrict certain processing
- Data portability, where applicable
- Withdraw consent at any time where processing is based on consent
You can withdraw website analytics/advertising cookie consent at any time via the cookie banner controls (or by clearing site data and choosing Reject when prompted again). Withdrawing consent does not affect the lawfulness of processing before withdrawal.
To exercise your rights, contact driveflowweb@gmail.com. You may also lodge a complaint with the Irish Data Protection Commission.
13. Cookies
The website may use cookies and similar technologies. Non-essential analytics and advertising cookies are used only with your prior consent. Details are in our Cookie Policy.
The native mobile app does not use browser cookies.
14. Children
The Services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided personal data, contact us and we will take appropriate steps.
15. Security
We use appropriate technical and organisational measures to protect personal data, including hashed passwords, encrypted transport (HTTPS), and secure on-device token storage in the app (SecureStore). No system is completely secure.
16. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top of this page. Please review this page periodically. Material changes that require consent will be handled as required by law.