How we handle your data.
Short version: we collect the minimum we need to run smove.city and the SMOVECITY application, we don't sell your data, and you can ask us to delete it at any time by writing to contact@smove.city.
On this page
1. Who we are
SMOVE.CITY LIMITED is a private company limited by shares, registered in the Republic of Cyprus under company number HE 406652, with registered office at 81, Griva Digeni Avenue, 6043 Larnaca, Cyprus. For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for personal data collected through smove.city and the SMOVECITY mobile application.
2. What we collect on the website
On smove.city we deliberately keep data collection to a minimum:
Contact form. If you write to us through /contact, we receive the name, email address, optional organisation, the topic you selected, and the message you typed. This goes into our support database so we can reply.
Cookies. We use a single first-party cookie that records
your choice on the cookie banner (cookieConsent in your
browser's local storage). No advertising trackers, no cross-site
cookies, no fingerprinting. See the
cookie policy for the full list.
Server logs. Our hosting provider (Netlify) keeps short-lived request logs containing your IP address, user-agent and the URLs you requested, for the purpose of running the site, debugging problems and blocking abuse. These logs are retained for up to 30 days.
3. What the mobile application collects
The SMOVECITY mobile application has its own data practices, which are disclosed in the App Store and Google Play privacy labels and presented again on first launch. In summary, the app uses your device location (only while the app is open, and only after you grant permission) to show nearby transport options and to plan journeys. It does not sell or share your location with advertisers. A full app-specific privacy notice is bundled with the app and is available on request from contact@smove.city.
4. Why we collect it (legal basis)
Under GDPR Article 6, we rely on the following legal bases:
Performance of a contract — for journey planning, account features and bookings inside the app, because those are the service you asked for.
Legitimate interests — for security logs, fraud prevention and replying to messages you send us.
Consent — for any non-essential cookies or analytics that may be added in the future. Consent can be withdrawn at any time from the cookie banner or by clearing your browser storage.
5. Who we share it with
We don't sell personal data. We share it only with the service providers who help us run the platform, under written processing agreements:
Hosting. Netlify (United States) for the website. Database & backend. Supabase (EU region) for the contact form and the app's backend. Email delivery. Resend (EU region) for transactional email. App stores. Apple and Google for distribution and crash reporting.
We share personal data with public authorities only where the law obliges us to do so.
6. How long we keep it
Contact-form messages are retained for up to 24 months from the date of receipt, after which they are deleted unless an active conversation is still open. Server logs are retained for up to 30 days. App account data is retained for as long as the account is active, plus a short grace period for backups, and is deleted on request.
7. Your rights
Under GDPR you have the right to access the personal data we hold about you, to have it corrected if it's wrong, to have it deleted ("right to be forgotten"), to restrict or object to processing, and to portability. To exercise any of these rights, write to contact@smove.city and we will respond within 30 days. You also have the right to lodge a complaint with the Cypriot Commissioner for Personal Data Protection or with the supervisory authority in your country of residence.
8. International transfers
Some of our service providers are based outside the European Economic Area (notably Netlify in the United States). Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or on an adequacy decision to ensure your data continues to receive an essentially equivalent level of protection.
9. Changes to this policy
We may update this policy from time to time — typically when we add a new service or change a sub-processor. Material changes will be announced on the website at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the most recent change.
10. Contact us
For any privacy question or to exercise a GDPR right, write to:
SMOVE.CITY LIMITED
81, Griva Digeni Avenue
6043 Larnaca — Cyprus
contact@smove.city