Privacy Policy

This Privacy Policy explains how GEO Ride ("we", "our", or "us"), operated by Milan Petkovski (Milan Web Portal) at playgeoride.com, handles data, respects statutory privacy frameworks, and safeguards user rights across our 3D real-world driving simulator.

1. Statutory Scope & Legal Framework

This policy adheres to the strictest international data protection laws, including:

• European Union General Data Protection Regulation (GDPR - Regulation (EU) 2016/679);
• United Kingdom Data Protection Act 2018 (UK GDPR);
• California Consumer Privacy Act of 2018 as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.);
• Republic of Serbia Law on Personal Data Protection (Zakon o zaštiti podataka o ličnosti - ZZPL, Sl. glasnik RS br. 87/2018).

2. Categories of Data Processed & Lawful Bases

We apply strict data minimization principles under Article 5(1)(c) of the GDPR. We process only the bare minimum data strictly required to deliver simulation features:

• Client-Side Local Storage (Zero Transmission): Vehicle physics preferences, custom keybindings, camera perspectives, audio volume levels, high-contrast HUD modes, and diagnostic telemetry counters are stored locally on your device via browser localStorage. This data never leaves your device and can be erased at any time through your browser settings.
• Paid Pro Subscriptions: If you purchase GEO Ride Pro ($4.99/month or $2.99/month billed annually), your email address is transmitted to our encrypted Supabase database strictly to verify Pro entitlements (God Mode, 10-player private rooms, Pro badge) upon subsequent visits. Lawful basis: Article 6(1)(b) GDPR (Performance of Contract).
• Payment Data (Merchant of Record): All financial transactions, credit card processing, and invoicing are handled exclusively by our authorized Merchant of Record, Fungies.io. We never process, see, or store your credit card numbers, CVVs, or bank account credentials on our servers.
• Ephemeral Real-Time Multiplayer Telemetry: Public and private multiplayer rooms transmit temporary vehicle coordinates (latitude, longitude, heading, speed, steering angle) and your chosen room nickname over encrypted WebSockets (wss://). Movement packets are routed purely in server RAM to synchronize 3D vehicle models across active players in that room and are never permanently recorded or stored on disk.
• Performance Analytics (Google Consent Mode v2): Anonymized Core Web Vitals and frame-time metrics (Google Analytics 4 / gtag.js) operate in a default state of denied. Analytics scripts are strictly blocked from loading or running until you explicitly click Accept on our GDPR consent banner. Lawful basis: Article 6(1)(a) GDPR (Affirmative Consent).

3. Third-Party Service Providers & Sub-Processors

We partner solely with reputable, security-audited infrastructure providers to operate the simulator:

• Mapbox, Inc.: Supplies 3D satellite tiles, elevation terrain heightmaps, and vector street geometry via Mapbox GL JS v3.3. When map tiles are requested, your browser transmits standard IP headers directly to Mapbox global edge servers in accordance with Mapbox's privacy policy.
• Fungies.io: Serves as our Merchant of Record, providing PCI-DSS Level 1 compliant payment processing, fraud prevention, global sales tax and VAT collection, and subscription management.
• Supabase (PostgreSQL Cloud): Encrypted database infrastructure hosted in secure, SOC-2 compliant data centers, storing user Pro entitlement email records with AES-256 encryption at rest.
• Cloudflare / Netlify: Edge CDN hosting, TLS 1.3 certificate termination, and DDoS mitigation to ensure uninterrupted simulator availability.

4. Data Retention & Security Architecture

All transmissions across GEO Ride utilize strict Transport Layer Security (TLS 1.3 / HTTPS). Ephemeral multiplayer coordinates exist only for fractions of a second in server memory during live sessions and are completely discarded when players disconnect. Pro email records are retained only for the duration of your active subscription and deleted upon account termination requests.

5. Your Statutory Privacy Rights

Under GDPR (Articles 15 through 22), the Serbian ZZPL, and the CCPA/CPRA, you possess comprehensive enforceable rights regarding your personal data:

• Right of Access (Art. 15): Right to obtain confirmation and a copy of any personal data we hold about you.
• Right to Rectification (Art. 16): Right to correct inaccurate or incomplete email records.
• Right to Erasure / Right to be Forgotten (Art. 17): Right to request total deletion of your Pro email record from our database.
• Right to Restriction of Processing (Art. 18): Right to restrict data processing under specific statutory criteria.
• Right to Data Portability (Art. 20): Right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21): Right to object to any data processing grounded in legitimate interests.
• Right to Withdraw Consent: You can withdraw cookie consent at any time by clearing your browser cookies or clicking the cookie settings trigger.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority (e.g., the Commissioner for Information of Public Importance and Personal Data Protection in Serbia, or your local EU Data Protection Authority).

To exercise any of these statutory rights, email our Data Protection Desk at contact@milanwebportal.com. We respond to all verified requests within 30 calendar days at zero cost to the user.

6. Children's Online Privacy Protection

GEO Ride does not knowingly solicit or collect personal information from individuals under the age of 16. If we discover that a user under 16 has submitted personal information without verifiable parental consent, we will promptly purge that information from our records.