Privacy policy

What data Leopol processes, why, who it is shared with and what your rights are.

Last updated: 8 November 2026

On this page

1Data controller

Leopol is a trading name of TrapSpotter BV.

Address: Trekschurenstraat 245, 3500 Hasselt, Belgium

Company number: 1031.603.017 (VAT BE1031603017)

Privacy email: privacy@trapspotter.com

General contact: contact@trapspotter.com

2What data do we collect?

We collect the following data to provide and improve our services:

Account data: email address, username, name, telephone number, password (stored only as a hash), your Apple or Google account identifier if you sign in with them, and the language of your account
Location data: while you are signed in and the app is open on your screen, it sends your position to our server every 30 seconds. In the web app and from app version 2.7.80, the position is sent only while nearby alerts with notifications are on, while you navigate, and once right before you send a report or a vote; in the web app also while its map follows your location, every five minutes or after 1 km, so that it can show you the alerts around you. From app version 2.7.81 this also applies while the app is shown on your car’s screen and not on your phone’s, for example with your phone locked: the same rules, for the same purposes. We use it to warn you about reports near you, to check that a report or a vote you send comes from near the place, and to apply the rules of the country you are in to notifications, and to protect user reports against bulk copying (section 8); if you switched on Help improve maps and alerts, also to count where the app is used (section 12). We keep only the latest position, for at most 24 hours: each new one replaces the previous one, and every 15 minutes we delete positions older than a day. While you navigate, the app also sends your planned route, so that we can warn you about reports along it. Your drives only if you switch that on (section 12)
Where you parked: from app version 2.7.80, after a drive the app keeps the place where your car stopped and the time, on your phone only, to show them on the map, lead you back and let the assistant answer “where did I park?”. They are not sent to us or to an AI provider (for the street and, when you walk back to your car, for the walking route, the app asks our own server, as the map does, without our keeping it), they are wiped when you sign out, and you can delete them at any time
Reports and votes: the kind of report, its tags, its place and the time. Other users see it without your name; our staff can see who posted it. With a vote, the app sends your position; we keep only whether you were near. From app version 2.7.80, a report also says whether your phone moved at driving speed in the last 15 minutes: a yes or no, never a speed or a route, used for that report only and not kept. A police or hazard report from a phone that was not moving, or, when the phone cannot tell, made at your own saved home or work or on a third day at the same spot, is shown only to you until another driver reports the same thing nearby or you drive on (which we see from your latest position); otherwise it ends after its usual time. Traffic jams are never held back. From app version 2.7.80, while you drive, the app may ask whether a report you just passed is still there, or whether a speed camera other drivers reported is there; your answer counts as a vote. We keep which camera you were asked about and your answer for 24 months; they are deleted with your account
Usage data: your saved places (such as home and work), settings and points; and, only with your consent to product analytics, how you use the app (see section 11)
Device data: device type, operating system, app version, push token, and your phone’s time zone (so that nearby alerts pause at night on your own clock)
Device check: from app version 2.7.80 the app has Apple (App Attest) or Google (Play Integrity) confirm that it is a genuine, unmodified Leopol app, to protect the reports and our map data against fakes and mass copying. We keep the result with your installation (the platform, Apple’s or Google’s verdict and the app’s key) and the last position the checked app sent us (see section 8)
Payment data: processed by Apple, Google, or Stripe; we do not receive card details
Communications: your conversations with our AI assistant and WhatsApp bot, and the emails and contact-form messages you send us
Advertising and app identifiers: only with your consent, to show ads in the free version and to measure our own ad campaigns
Website and web-app visits: the pages you view and the campaign that brought you (utm_* parameters); Google Analytics cookies and Microsoft Clarity (heatmaps and masked session recordings) only if you accept them (see section 11)
Forms on leopol.ai: what you enter in the newsletter, contact, business, account-deletion, Mijn Boete and partner quote forms (see sections 5 and 11), with a one-way hash of the internet address and the browser type a form was sent from, against abuse and, for a sign-up, as proof of the consent
Searches: what you type into map search
Map requests: when the app loads the map, the server that delivers it receives your device’s IP address, the map area you are viewing and the type of device and app or browser; while you navigate, the app also loads the map along your route in advance (see sections 5 and 8). To protect our speed-camera data and user reports against bulk copying, we keep a security log of the map data each account requests: per day, how much was requested, the areas it covered and one-way hashes of the internet addresses it came from, linked to the account. We can also limit the alerts an account receives to the area around its last position, and mark each account’s copy of the alerts (section 8)
Diagnostics: crash and error reports
Documents and vehicles: only if you use the document wallet or add a vehicle — photos and details of your documents and the details of your vehicles, encrypted by the app before they are backed up to your account (the kind of document and its expiry date stay readable). From app version 2.7.80, the fuel type and Euro class you enter for your car (in Spain also where it is registered for road tax, if you enter it) are sent with your route requests, so that the route can take low-emission zones into account; they are used only to answer those requests, and are not kept or passed on to anyone else
The country of your account (section 13)

3Why do we collect this data?

To provide alerts, navigation and user reports
To manage your account and subscription
To apply the rules of your country to your subscription and to the app (section 13)
To improve our app and services
To communicate about your account and important updates, and to send our newsletter if you asked for it (section 4)
To comply with legal obligations
To prevent fraud and combat abuse

4Legal basis (GDPR Article 6)

We process personal data on the following grounds:

Consent for optional features such as push notifications (on an iPhone also product news and offers as a notification), analytics, advertising measurement and the newsletter, and for recording drives automatically, Help improve maps and alerts and usage statistics (section 12); consent can be withdrawn at any time
Performance of a contract to provide account access, subscriptions and alerts, and My drives, your own drive history (section 12), and the assistant’s answers in the app about your own data when you ask for them (section 5)
Our legitimate interest in telling our own users about Leopol (direct marketing, Article 6(1)(f) and Recital 47 GDPR): on Android, product news and offers as a notification, on until you switch it off under Settings → Notifications. You can object to it at any time, free of charge, with one tap in Settings (Article 21(2) and (3) GDPR)
Legitimate interests in fraud prevention, security, product improvement, cookieless website statistics, offering the app lawfully in each country (section 13) and protecting our infrastructure, and keeping user reports reliable, which includes holding back a report that does not come from the road until another driver confirms it (section 2)
Legal obligations relating to consumer law, tax records and lawful authority requests

More information

GDPR Article 6: https://gdpr-info.eu/art-6-gdpr/

5Sharing with third parties (sub-processors)

We do not sell your data. We share it only with the providers below, which help deliver our services. Where a provider uses the data for its own purposes as an independent controller, this list says so.

Supabase — our database, sign-in, file storage and server functions; the database is hosted in the EU, in Stockholm (Sweden)
Hetzner Online (Germany) — our own servers. In Falkenstein (Germany): the map, routing and search for app versions before 2.7.80. In Helsinki (Finland): routing, search, speed limits and live road events for app version 2.7.80 and later, and already today for live police information, the AI assistant, the WhatsApp bot, reports and nearby alerts in every app version; it also keeps the drives you share for Help improve maps and alerts (section 12). They receive the positions, routes and search terms needed to answer a request, with your account ID or a hashed key of it instead of your name. When an app version before 2.7.80 loads the map, your device fetches it directly from our map server in Falkenstein. That server receives your device’s IP address, the map area you are viewing (often the area around you) and the type of device and app or browser you use. We use this only to serve the map and to protect it against abuse (a limit on the number of requests), keep it in the server logs for at most 15 days and do not combine it with your account. To fetch live police information, the Helsinki server asks an outside traffic-information service only about the squares of a fixed grid, of about 5 km (smaller where there is a lot to report), never about your position, and sends nothing that identifies you. The Helsinki server’s logs contain no IP address of yours and are deleted after 14 days
Bunny.net (BunnyWay d.o.o., Slovenia) — delivers the map for app version 2.7.80 and later, from the server of its network closest to you, which can be outside the EU. It receives your device’s IP address and the map area you are viewing (while you navigate, also the map along your route, loaded in advance), never your account. We have switched off its request logs
Stripe — web payments and subscriptions
RevenueCat — iOS and Android subscription management; receives your account ID and, to link purchases to your account, your email address, name and phone number
Apple — App Store payments, Sign in with Apple, push delivery via APNs, speech recognition when you dictate a message (Apple processes the audio), and, only with your consent to advertising measurement, Apple Ads attribution (AdServices): whether an iOS install came from an Apple Ads campaign. If you sign in with Apple, we keep an encrypted token from Apple only so that we can disconnect Leopol from your Apple Account when you delete your account; it is deleted once that is done
Google — Google Play payments, Google Sign-In, Firebase Cloud Messaging for push notifications, the Play Install Referrer (which campaign led to an install), app updates through Google Play, on-device text recognition and the document scanner for document scans (ML Kit, with the model and the scanner delivered by Google Play services), and speech recognition on Android when you dictate
Google Analytics (Google Ireland Limited) — our own Google Analytics 4 properties: one, linked to our own Google Ads account, measures use of the web app at app.trapspotter.com and visits to our other website; a separate property measures visits to leopol.ai. Without consent neither the websites nor the web app send them anything; with consent (each website’s cookie banner, or the web app’s own consent settings) they use their cookies and, on the websites, Google’s ad-measurement cookies. With that consent (on the websites, Accept; in the web app, advertising measurement), Google may also use the visit to personalise ads (ad personalisation), for example to show our ads to people who visited the websites. Email addresses and sign-in, unsubscribe and confirmation tokens in page addresses are removed before they reach Google. See section 11
Microsoft Clarity (Microsoft Ireland Operations Limited) — heatmaps and session recordings of visits to leopol.ai and to our other website, each site in its own project, only after you accept in that website’s cookie banner, so that we can see how the sites are used and improve them. It receives the pages you view, clicks, scrolling and mouse movement, how the page looked, your device and browser type and a pseudonymous id; what you type, numbers and email addresses are masked in your browser, and the forms are masked completely, so their content is never sent. Microsoft acts as an independent controller for this data and may also use it for its own purposes under the Microsoft Privacy Statement. We do not use Clarity for advertising. The web app and the iOS and Android apps do not use Clarity. See section 11
Google Analytics for Firebase — in the iOS and Android app, measures which of our own Google Ads campaigns led to an install, a sign-up or a subscription. Only after you consent to product analytics does it use an app identifier, app events and, reported by our server only with a yes given on the current consent screen (a no recorded with your account always wins), the start of your trial and subscription and its renewals, with the price; advertising use also needs your consent to advertising measurement. On iOS, with that consent, Google can match your email address or phone number, hashed on your device, against an ad you saw — on the device itself; it does not leave your device. Without consent the app sends it nothing (versions before 2.7.80: only cookieless pings without any identifier, Google Consent Mode); see section 11
Google AdMob — advertising in the free version. The app starts AdMob only after you allow advertising measurement; Google then asks for its own consent before it shows ads, and what AdMob may do follows your answer there. AdMob may use your advertising ID, IP address and coarse location to select and measure ads. Leopol Pro subscribers see no ads and their data is not sent to AdMob
Meta — advertising measurement in the iOS and Android apps, with your consent to advertising measurement; see section 11. The website and the web app run no Meta tracking. Messages to our WhatsApp bot pass through Meta’s WhatsApp Business Platform. We also republish police checks reported in the app automatically on our own Facebook page: the kind of check, its place (the address, or the map position if there is none) and its time — never who reported it
Mapbox — only for app versions before 2.7.80: route calculation with live traffic, address search (with our own server as a fallback) and, as a fallback to our own server, turning coordinates into an address; receives route points, search terms and coordinates through our servers, not your identity
TomTom (TomTom International B.V., Netherlands) — from app version 2.7.80, where we use it (today in Belgium): route calculation, address and place search, and turning coordinates into an address. Through our own server it receives the route points, search terms and coordinates needed to answer a request, never your identity or your device’s IP address
OpenAI, through the Vercel AI Gateway — the AI assistant in the app and on WhatsApp, and the processing of reports you write. To answer, it receives your messages and, as context, your position rounded to about 1 km and the street and town you are in, without the house number (on WhatsApp: of the location you share), your direction of travel and whether you are driving, your current route (destination, distance and duration), your saved places (home, work and up to three favourites: their names and their position rounded to about 100 m, without the address), your language, country and plan, and from app version 2.7.80 your car’s fuel type and Euro class. Only when you ask the assistant in the app about them, it also receives: your points and your own recent reports; when your Leopol Pro renews or ends and whether a payment needs attention; the kinds and expiry dates of the documents in your document wallet and which of your cars they belong to (never their number, plate, VIN or scans); and the name and town of places you recently planned a route to (never the house number, postcode or position). Your drives never reach it: when you ask about them, for example “show my last drive”, our own server adds the figures and places to the answer after the AI has written it, and the conversation we keep holds a placeholder instead (section 12). Where you parked never reaches it either: the app answers that on your phone (section 2). The WhatsApp bot receives none of this. It never receives your name, email address, phone number or account ID. Our staff also use it to help write replies to emails you send us; it then receives only your name and the text of your email, with earlier quoted messages and signatures cut and email addresses, phone numbers and IBANs masked. AI providers may not train on the data and keep nothing (zero data retention, through Vercel’s AI Gateway)
TypeSafe AI, Inc. (United States), through the Vercel AI Gateway — a decision model that answers two yes/no questions so that the assistant answers sooner: whether your latest message in the chat is a report (or a yes or no to the report you are confirming), and, when you share a location on WhatsApp, whether our last message asked for it. It receives only the texts needed for that: the last messages of the conversation (at most eight, yours and the assistant’s, with the place of a report you are making), or our last WhatsApp message. It never receives your name, email address, phone number or account ID. It may not train on the data and keeps nothing (zero data retention, through Vercel’s AI Gateway). TypeSafe AI is not certified under the EU–US Data Privacy Framework: the data reaches it through Vercel, under Vercel’s data processing agreement and the EU Standard Contractual Clauses in it
Twilio — the WhatsApp bot: your phone number, your messages and any location you share
CM.com — SMS one-time login codes
Resend — transactional email and the newsletter; without tracking opens or clicks (section 11)
Sentry (EU) — crash and error diagnostics (error type, app version, device model, and your user ID so we can match a crash to a support request)
Cloudflare — bot protection (Turnstile) in the app when you sign in, sign up, reset your password or ask for an SMS code, and on this website’s forms (newsletter, contact, business, account deletion, Mijn Boete and the partner quote request); on the website only once you use a form
Vercel — hosting of leopol.ai, our other website and the web app, and the AI Gateway
Mijn Boete (an initiative of Bannister Advocaten, Belgium) — only if you ask for advice through the form at leopol.ai/mijnboete or on our other website and agree to it: we pass your name, email address and answers, including about the offence, to Mijn Boete once you have confirmed your email address. Mijn Boete then handles your request as an independent controller

Legal requests

We share data with public authorities when required by law.

6Your rights

Under the GDPR, you have the right to:

Access the data we hold
Correct inaccurate data
Request deletion (the right to be forgotten)
Restrict processing
Receive portable data in a structured format
Object to certain processing
Withdraw consent
Lodge a complaint with the Belgian Data Protection Authority

Submit a request

Email privacy@trapspotter.com. We respond within 30 days in accordance with the GDPR.

7Security

We use appropriate technical and organisational measures, including encrypted connections (TLS 1.2 or 1.3), AES-256 encryption of our database at rest, row-level security in the database, rate limits on sensitive endpoints, two-step sign-in for our staff, idempotent payment webhooks and audit logs for subscription changes. When you set a new password (in the web app now, and in the iOS and Android app from version 2.7.80), the app signs your account out on all your other devices; a device that was signed in can keep access for up to an hour.

8Retention

We keep data only as long as necessary:

Account and profile data: as long as your account exists. When you delete your account, it is deleted at once (if a step fails, we retry every hour); copies in our database backups disappear within 8 days, including the encrypted weekly copy of our database that we keep at Hetzner in Germany: after a week it can no longer be read. The files you store with us (documents and images) also get an encrypted copy once a month, kept until the next one: a deleted file is gone from it within 35 days at most. What we keep after that is listed below
Your last position: only the latest one, for at most 24 hours (every 15 minutes we delete positions older than a day); each new one replaces it, and it is deleted with your account
Your planned route: deleted when you stop navigating; if the app cannot tell us, it expires 12 hours after the app last updated it and is deleted within two days at the latest
Your drives and the usage statistics: see section 12. The country of your account: see section 13
Reports you post: kept, so that the history of the map stays complete, except police reports: they are deleted 12 months after they were sent (24 months if our moderation removed them), and only counts per day, country and kind, without any account, remain. The exact position your phone sent with a report is cleared after 30 days; the report keeps its place on the road. A report keeps a salted one-way hash of the internet address it was sent from, against abuse, for 24 months. After 12 months your reports, votes and camera proposals are no longer linked to your account (after 24 months if our moderation removed them); the report itself stays, without your account. When you delete your account, they are unlinked at once; the reports keep their kind, place and time, and the address hash, the exact position as sent, the sender name and any text are cleared
Moderation records about reports and accounts: 24 months
Conversations with the AI assistant in the app: 12 months, or until you delete your account if that is sooner (clearing the chat in the app only clears your phone). Conversations with the WhatsApp bot: 12 months; a location you share on WhatsApp: 30 days
Use of the AI assistant (per question: the time, the feature, the model, the number of tokens and the cost): 12 months with your account, then without it; at once without it when you delete your account
Usage events stored with your account (a yes on the current consent screen): deleted after 3 to 4 months, a month at a time, within minutes if you later say no, and at once when you delete your account; anonymous daily counts: 90 days. Events stored before 17 October 2026 without such a yes: deleted if your account said no; otherwise turned into anonymous counts (per day for 90 days, then per month without an end date) and the events deleted
Statistics (section 14): totals only; those calculated from the records of the service are kept 25 months
Push tokens: switched off when you sign out or when the token stops working, and then deleted after 7 days; a token unused for 90 days is deleted too, and every token with your account. The log of sent notifications: 30 days
SMS and one-time password codes: valid for 10 minutes and deleted after 7 days; the log of sent codes and of PIN sign-in attempts: 30 days. Your sign-in sessions, with the IP address they were started from: until you sign out or delete your account; a session the app has not used for 6 months is ended (you then sign in again) and deleted. The sign-in security log: 90 days
Device check (from app version 2.7.80): the challenge the app signs, 5 minutes; the pass a checked app sends with its requests, 24 hours; the result of the check for your installation, 90 days after the last check, and at once when you delete your account; the last position the checked app sent, 24 hours
Counters we use to limit requests and fight abuse: from one day to 40 days. The security log of the map data each account requested (per day: counts, the areas covered and up to eight keyed one-way hashes of the internet addresses, linked to the account): 30 days, then deleted. It protects user reports and our camera data against bulk copying, on the basis of our legitimate interest in preventing fraud and abuse (Article 6(1)(f) GDPR). To the same end we can limit the alerts an account receives to an area of up to 300 km around the last position its app sent (kept at most 24 hours; without one, to the country of the account), and mark each account’s copy of the alerts by moving every alert by a few metres, differently for every account, so that a leaked copy shows which accounts it came from — never your own reports. An account that looks like bulk copying can receive less map data; that assessment is kept until 24 hours after its last sign
Newsletter: until you unsubscribe. After that we keep your email address marked as unsubscribed, so that we never mail you again (after you delete your account, without your name). Opens and clicks: not kept per person (only a count per newsletter)
Website forms: a Mijn Boete request is deleted after 6 months if you do not confirm your email address, and otherwise after 12 months. Emails to our support and contact-form messages: 3 years. Business prospects who do not become customers (such as a fleet demo request): deleted 24 months after the last activity; a request not to be contacted again is kept
Payment records: 7 years after the end of the financial year, as Belgian accounting law requires; the invoices themselves are held by Stripe, Apple or Google. Stripe and RevenueCat keep their own record of your purchases after you delete your account. Copies of the payment notifications they send us: 24 months
The record of the e-mails about your subscription and billing that we sent you (the address, the kind of e-mail and when): 24 months after sending, also after you delete your account
Changes to your subscription and the reasons you give when you cancel: 24 months
Anti-fraud data: when an account that used a free trial or Leopol Pro is deleted, we keep a one-way hash of its phone number for 24 months, so that the same number does not get a second free trial; and when a free trial starts on the website, a one-way hash of the fingerprint our payment provider Stripe gives the card or bank account, for 24 months, so that the same card or account does not get a second free trial (we never see or keep the card or account number)
Suppression list: when you delete your account, we keep a one-way hash of your phone number, with no end date, so that we cannot message you again. We do not keep the number itself
Documents and vehicles: until you delete them; the content of a deleted document is erased within minutes, the empty record after 30 days. Saved places: until you delete them
Records of your consents: as long as your account exists
The log of what our staff do in our systems, for security and accountability: 5 years
Server logs: our map server for app versions before 2.7.80 (your device’s IP address and the map area viewed): at most 15 days; our server in Helsinki: 14 days, without your IP address; Bunny.net: none; the request logs of Supabase, which runs our database and server functions (with your device’s IP address): 7 days
App version check: each time the app starts, it asks our server whether an update is needed and tells it its version. To count how many installs run each version, our server keeps for one day only a one-way code, made from the app’s install identifier (in older versions of the app, from your account identifier) with a secret key that is destroyed at the end of that day; after that only the number of installs per day, platform and version remains, kept for 13 months. We never store your install identifier, your account or your IP address for this. Legal basis: our legitimate interest in keeping the app secure and up to date (Article 6(1)(f) GDPR)
Website visit records from before 17 October 2026: turned into counts and deleted (section 11)
Google Analytics data (leopol.ai, our other website, the web app, and the iOS and Android apps): 14 months
Microsoft Clarity (leopol.ai and our other website): recordings 30 days — a random sample, and recordings we mark, up to 9 months; heatmap and click data 9 months (Microsoft’s retention)

9International data transfers

Our own infrastructure is in the EU: our database at Supabase in Stockholm (Sweden) and our own servers at Hetzner in Falkenstein (Germany) and Helsinki (Finland). Several providers are established or process data outside the EU, mainly in the United States: Google (including Google Analytics, which we use through Google Ireland Limited), Microsoft (Microsoft Clarity, which we use through Microsoft Ireland Operations Limited), Apple, Meta, OpenAI, TypeSafe AI, Stripe, RevenueCat, Twilio, Resend, Mapbox, Cloudflare and Vercel. Bunny.net is established in the EU, but delivers the map from the server closest to you, which can be outside the EU. Transfers rely on appropriate safeguards:

EU Standard Contractual Clauses (SCCs)
The EU–US Data Privacy Framework, for providers certified under it
European Commission adequacy decisions where applicable
Additional safeguards required following the Schrems II judgment

Use outside the EU

Leopol can also be used outside the EU. Wherever you use it, we keep your data in our database and on our servers in the EU and process it as this policy describes, under the GDPR. If the law of the country where you live gives you further rights, you can exercise them by writing to privacy@trapspotter.com.

More information

GDPR Article 44: https://gdpr-info.eu/art-44-gdpr/

10Children

Leopol is intended for drivers and is not designed for anyone under 16. We do not knowingly collect data from children below the GDPR age threshold. Parents or guardians can report a concern to privacy@trapspotter.com.

11Cookies and tracking

Website (leopol.ai). The website also counts visits without cookies. Our own statistics are counted on our server as the pages are requested: totals per page, day, language, referring website (its domain only), country, type of device and the campaign named in the link — no script, no cookie, no browser storage, no identifier, and no IP address is stored. Visit records we kept before 17 October 2026 (with a per-tab id and a daily code made from the internet address and the browser) are turned into counts and deleted. Only after you accept in the cookie banner does the website tell our servers at Supabase in the EU which buttons you tap (such as a store button), with the campaign of the visit and without an identifier, and do two sessionStorage keys, lp_utm and lp_campaign, carry the campaign of your visit (utm_* parameters) from page to page to the store links and the forms; they are deleted when you close the tab or reject. Without Accept the campaign in the link reaches only the page you arrived on. Alongside, Google Analytics 4 (our own property for leopol.ai) is loaded only after you accept in the cookie banner: until you choose, and if you reject, nothing is sent to Google. If you accept in the cookie banner, it sets _ga and _ga_1J1H9BZFSQ (13 months) and Google’s ad-measurement cookies such as _gcl_au (also 13 months), and records the pages you view, taps on the store buttons and completed forms — never what you typed. If you accept, Google may also use your visit to personalise ads (ad personalisation), for example to show our ads to people who visited the website. Email addresses and sign-in, unsubscribe and confirmation tokens in page addresses are removed before they reach Google. We keep Google Analytics data for 14 months; Google may process it in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Microsoft Clarity (our own project for leopol.ai) loads only if you accept in the same banner: before that, and if you reject, it is not on the page at all. It gives us heatmaps and session recordings of how the site is used, so that we can improve it; what you type, numbers and email addresses are masked in your browser, the forms are masked completely, and it is not loaded on the pages you open from a link in an email. It sets _clck (1 year) and _clsk (1 day) and the sessionStorage key _cltk; Microsoft may also set its own cookies on its own domains (such as MUID, CLID, ANONCHK, MR and SM). We tell Clarity that advertising use is not allowed. Rejecting after an earlier Accept stops Clarity and deletes _clck and _clsk. Microsoft keeps recordings for 30 days and heatmap data for 9 months, acts as an independent controller, and may process the data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. We keep your choice for 6 months in the leopol_cookie_consent cookie; you change or withdraw it with the Cookies link at the bottom of every page or the Cookie settings button at the top of our cookie policy. No Meta Pixel, no Tag Manager and no other advertising pixel. Vercel, which hosts the website, keeps technical server logs for security and operation (such as IP address, time and the page requested). What you enter in the forms goes to our servers at Supabase in the EU. When you tap an App Store or Google Play button, the link passes on the campaign of your visit (utm_* parameters and, if present, the ad click id), or otherwise that you came from leopol.ai, so an install can be attributed.

Web app (app.trapspotter.com). The web app reports to the Google Analytics web stream of our other website — not to leopol.ai’s — also only after your consent. That website and the web app share one choice (a consent cookie on their shared domain): accepting or rejecting in that website’s banner also applies in the web app, and in the web app ‘Allow’ counts as accepting there, ‘Analytics only’ or ‘Don’t allow’ as rejecting; the most recent choice, on either side, is the one that counts. In the web app, that website’s Accept counts only as a yes on the earlier “Anonymous analytics” screen — anonymous daily counts, see below — never as consent to Google Analytics, Google Ads or Meta, and it leaves a yes you already gave in the web app as it is; that website’s Reject turns product analytics and advertising measurement off there. A no given in the web app before 4 November 2026 stays until you change it there. In the web app you refine it with its own consent prompt and Settings → Analytics & Tracking: product analytics allows the Google Analytics cookies, and advertising measurement allows Google’s ad measurement. With product-analytics consent, Google Analytics measures page views and product events (account created, onboarding finished, navigation started and finished, report submitted, paywall shown), and when a web subscription starts or renews, our server reports it as a conversion with its value and currency, linked to the Google Analytics browser identifier — only with a yes given on the current consent screen, and never when your account says no. Without that consent the web app does not load Google Analytics and sends Google nothing. It runs no Meta Pixel, no Tag Manager and no Clarity. That website and the web app share one domain and therefore the Google Analytics cookie: with consent on both, a visit to that website that ends in a sign-up is counted as one visitor. Your choice on leopol.ai is separate: another domain, another cookie.

The app, on every platform, uses localStorage — the same kind of technology as a cookie — to remember your preferences and your consent choices. That is necessary and sits outside consent. It also keeps a random app identifier and a session number there for our own usage statistics. The app sends us events about how you use it — for example the screens and features you use, navigation started and finished (with distance and duration), alerts shown and opened, searches (as a short hash) and, when a speed limit is shown, the road segment and a rough speed band — and our server keeps them according to your answer about product analytics. With a yes given on the current consent screen (the one that names Google and Meta), we store the events with your account and those numbers. With a yes given on the earlier “Anonymous analytics” screen, we keep only anonymous daily counts — the day, the event, the platform and a number, nothing that can be linked to you or your device — and delete them after 90 days. Without a yes, we keep nothing, and if you later say no, the events stored with your account are deleted within minutes. The answer recorded with your account always wins; when you are signed out, or your account has no answer, the answer on your device decides. If you answered on a device while signed out, that answer and the version of the screen are saved with your account when you sign in, if your account had no answer yet. Events stored before 17 October 2026 without a yes on the current screen: those of accounts that said no are deleted; the rest are turned into anonymous counts (per day for 90 days, then per month without an end date; nothing per person or device) and the events themselves are deleted. Events our server records itself, such as a subscription started or points earned, follow the same rule. The iOS and Android apps use no browser cookies.

iOS and Android apps. If you consent to product analytics, the app runs Google Analytics for Firebase, which measures which of our own Google Ads campaigns lead to installs, sign-ups and subscriptions. Advertising use also needs your consent to advertising measurement. Until you choose, it sends nothing (versions before 2.7.80: only cookieless pings without any identifier). If you withdraw product-analytics consent, its identifier on your device is erased, our server stops reporting anything, and the usage events stored with your account are deleted within minutes.

If you consent to advertising measurement, the Meta Pixel runs inside the iOS and Android apps and the Meta SDK forwards its events to Meta as native App Events. This measures advertising conversions such as sign-ups and subscriptions. The Meta SDK itself starts when the app opens, and the app loads the Pixel’s script from Meta at every start, so Meta then receives your device’s IP address and technical details of the app and device; events are sent to Meta only with your consent. It is the only Meta tracking we use anywhere — there is none on the website or in the web app.

On Android, the app reads the Google Play Install Referrer on first launch: the campaign the install came from. We keep that campaign only if you said yes to product analytics, and the ad click id in it only with your consent to advertising measurement. On iPhone, with your consent to advertising measurement, the app asks Apple (AdServices) whether the install came from an Apple Ads campaign; Apple answers with campaign, ad group and keyword ids, without any device identifier, and we store the answer with your account. On every platform, if a campaign link (utm_* parameters) brought you to the app, we store that campaign (and the website that sent you) with your account as sign-up attribution, only if you said yes to product analytics; ad click ids (such as gclid or fbclid) only with your consent to advertising measurement.

The free version can show ads from Google AdMob, which asks for its own consent in Google’s consent form; see section 5.

Consent is split: product analytics, advertising measurement and our newsletter are three separate switches under Settings → Analytics & Tracking. You can turn them on and off independently, and all three start off. After you create an account with an email address, the app asks you once, on a separate screen, whether you want the newsletter; you do not need it to use the app. If you sign up in the app, you are subscribed straight away, without a confirmation email. If you sign up on leopol.ai or on our other website (also with the box on the Mijn Boete form), we send you a confirmation email: its link opens our confirmation page, and only the button on that page confirms. Cloudflare Turnstile protects the website’s forms (section 5). We do not measure whether you open our newsletter or what you click: we only count, per newsletter, how many visits arrive on our website or web app through one of its links, without knowing whose. You can unsubscribe at any time with the switch or the link at the foot of every email.

12Your drives

In the app from version 2.7.80, under Settings → Your drives (also offered once after the update and when you first set up the app), you decide what Leopol may do with your drives. There are three switches. My drives is part of the service and on from the start (it relies on our contract with you); you can switch it off at any time, which deletes your saved drives. The other two — Record automatically and Help improve maps and alerts — are off until you switch them on, and you can switch each one off at any time. Record automatically needs My drives: switching off My drives also switches off Record automatically. None of them affects Leopol Pro or points. The switches are offered where the drive features are available in the country of your account (section 13).

With My drives or Help improve maps and alerts on, the app records a drive while you navigate or use drive mode; with Record automatically on, also when the app is closed. Nothing is recorded for Leopol during a workday for an employer that uses Leopol Fleet: a drive that overlaps a workday is discarded.

My drives — a history of your drives that only you can see: the route as it was recorded (points at least 25 metres and 5 seconds apart), the start and end time, the distance, and where the drive started and ended: the name of a place you saved (Home, Work or a favourite) or the address (street and number; the app asks our own server for the address at those two points), and, if you switched on My drives with the wording that names your speed, your speed along the way (in whole km/h, at each point of the route), which only you see. The time at each point of the route is not stored. You can view, export (GPX or JSON) and delete one drive or all of them. Our support team can see a drive only if you make a code for it in the app: the code works for 7 days, you can stop it earlier, and the app shows how often it was opened. Support then sees that drive’s route, times, distance and start and end places, together with your account, never your speed, and every opening is logged. If you ask the assistant in the app about your drives, our server reads them from My drives (when, how far, where they started and ended; never the route or your speed) and adds them to its answer itself: they are not sent to OpenAI or any other AI provider, and the conversation we keep (section 8) holds a placeholder, not the figures.
Record automatically — the app also records a drive when it is closed. For this it uses your location all the time (“Always” on iPhone, “Allow all the time” on Android), including whether you have left the area where you parked, and, if you allow it, Motion & Fitness on iPhone or Physical activity on Android, or the connection to the car’s screen, to notice when a drive starts and ends. Motion data stays on your phone. While a drive is recorded with the app closed, Android shows a notification and iPhone the location symbol at the top of the screen. Before that, a check of up to 5 minutes decides whether a drive has started: Android then shows “Checking for a drive”, iPhone nothing.
Help improve maps and alerts — we use your drives, without your name, to map traffic and the speeds driven on each road. Before a drive leaves your phone, the app removes the part within a private zone of 300 to 500 metres around its start and its end (the centre of each zone is shifted at random; the same is done around a home and work address you saved), leaves out drives shorter than 2 km, and waits 5 to 60 minutes. It then sends the points of the drive with their time, speed, direction and accuracy. The app sends them signed in to our function at Supabase, which checks your choice and that the drive does not overlap a Fleet workday, and passes the drive on to our own server in Helsinki (Finland, EU) without your account: with a new random number for each drive and a code calculated from your account with a key that changes every month, so that we can count how many different people drove somewhere. Each monthly key is destroyed about six weeks after its month ends; after that the code can no longer be linked to anyone. Drives from accounts younger than 48 hours are not used. On the Helsinki server the drives are stored encrypted, are not included in backups and are deleted at the latest 30 days after the drive. From them we calculate weekly statistics: per area (cells of about 0.1 km², and of about 0.7 km² by hour and weekday), per country, and per road segment and direction: the typical speed, the speeds that 85% and 95% of the passages stay below, the share of passages above the speed limit and more than 10 km/h above it, and the typical speed at rush hour (weekdays 7–9 am and 4–7 pm) and outside it. From the same drives we also calculate, each week from the drives of the last four weeks, the typical speed on each road segment and direction for every hour of the week (for example Monday 8–9 am), so that our route planning gives travel times that fit the time of day; these hourly speeds stay on our server in Helsinki. A statistic is kept only if it combines at least 20 different people and 50 drives (for an hourly speed: on that road segment, in that hour). Our staff see only these statistics, never a single drive.

Your speed

A speed at a given place could show that someone drove faster than allowed. Our server works out the average speed of a drive on each road segment only to calculate the road statistics and to reject drives that cannot be real; that result stays on the server with the drive and is deleted with it within 30 days. No speed per drive or per person leaves the server, and your drives are not given to anyone.

My drives keeps your own speed along the way only if you switched My drives on with the wording that names it, and only for drives that started after that. Only you see it, in the app and in your export; support never sees it, not even with a code. It is deleted with the drive.

Usage statistics

With Help improve maps and alerts on, we also count once an hour how many people had the app open, or had a route open, in an area of several kilometres. This shows us where Leopol is used and where routes are planned, so that we know where to improve maps, cameras and alerts.

You count once per hour, at the last position your app sent us in that hour, and in each area your planned route passes through. We keep only the number of people per area and hour, and only for areas where at least 10 different people were; a smaller group is counted in a larger area around it (up to about 100 km across) or not at all — never who was counted, where exactly, or which route. The numbers are deleted after 90 days. The positions and routes they are counted from are not copied for this; they keep their own retention (section 8).

Legal basis: your consent, given with Help improve maps and alerts where the switch’s text names this counting (Article 6(1)(a) GDPR). If you switch it off, you are no longer counted, from the hour in which you switch it off. Numbers already made remain, because they contain no one.

On your phone

Drives wait on your phone, encrypted, until they are sent; a drive not sent within 7 days is deleted. When you sign out, all drives are deleted from your phone.

Legal basis and recipients

My drives: the performance of our contract with you (Article 6(1)(b) GDPR); your speed along the way only with your explicit consent (below). The other switches: your consent, separately for each switch (Article 6(1)(a) GDPR and, for the location read from your device, the ePrivacy rules — in Belgium article 10/2 of the Law of 30 July 2018). Because a speed at a place can relate to a traffic offence, Help improve maps and alerts, and My drives where it keeps your speed, also rely on your explicit consent under Article 10 GDPR and article 10, § 1, 5° of that Belgian law. Your drives are processed only by our processors Supabase (database in Stockholm, Sweden) and Hetzner (our server in Helsinki, Finland), and are not given to anyone else.

Changing your mind

Switch a choice off under Settings → Your drives. Switching off My drives deletes your saved drives and support codes at once. Switching off Help improve maps and alerts deletes the drives still waiting on your phone at once and your drives on our server at the next daily run; statistics for weeks that are still open are recalculated without you, and statistics for weeks already closed remain, because they contain no one. If you delete your account, My drives and your support codes are deleted at once and your drives on our server at the next daily run. Switching off Record automatically stops recording while the app is closed; you can also withdraw the location or motion permission in your phone’s settings.

How long

On your phone: until sent, at most 7 days. My drives: until you delete them, and automatically once you have recorded no drive for 12 months. Support codes: deleted 30 days after they end. Drives for Help improve maps and alerts on our server: at most 30 days. The monthly key: about six weeks after its month. The record of a request to delete: 35 days. The statistics contain no personal data and are deleted after 36 months. Usage statistics: 90 days.

13The country of your account

We keep one country with your account, because some things depend on where you live: the consumer-law rules for a subscription you pay for on our website (such as a reminder before a renewal, the confirmation of a cancellation, or how you cancel or withdraw), the billing emails you receive, and which features of the app are offered in your country (such as the drive features, section 12). We also count accounts per country for our own statistics.

How we set it: the first of these that gives a country — a country our team set for your account (for example after you told us it was wrong), which is never changed automatically; the country code of your phone number; the country of your App Store or Google Play account, which we receive from Apple or Google through RevenueCat when you subscribe there; the country of the internet address you signed in from, looked up on our own server in a list it keeps itself, so that the address is not sent to anyone and not kept for this.
A trip abroad does not change it: a new phone number or another store country can change it, but the internet address only gives a country to an account that has none from a stronger source, and does not move an account it placed before. If you pay for a subscription on our website, the country of your account changes automatically only from your phone number.
We do not use your saved home address, your positions or your reports for this. For some older accounts without a phone number, the country was set once, in July 2026, from the last position the app had sent us; it stays until your phone number or your App Store or Google Play account gives another country.
If your account has no country, the billing emails and a cancellation use the country of the billing address you gave Stripe, and our statistics count the account in the country of its latest report.
What is kept: the country, as a two-letter code with your account, how it was set, and for each source only the latest country it gave and when — never the internet address, a position or a purchase.
How long: until you delete your account.

Legal basis and your rights

Applying the consumer-law rules of your country to your subscription: our legal obligations and our contract with you (Article 6(1)(c) and (b) GDPR). Offering the app’s features per country and counting accounts per country: our legitimate interest in offering the service lawfully in each country and knowing where it is used (Article 6(1)(f) GDPR). If the country of your account is wrong, or if you object, write to privacy@trapspotter.com.

14Statistics

We count how Leopol is used, so that we can run and improve it. These statistics are totals: we never use them to decide anything about you.

From the records we keep to provide the service — when your account was created, how you sign in, your platform and app version, the country of your account, your settings and consent choices, the notifications we sent you, the reports you posted and the places you saved, and your subscription — we calculate totals on sign-ups, setting up the app, the use of features, subscriptions and how many people stay. Only the totals are kept, for 25 months.
Daily use and returns are counted from the sign-in records, and the routes planned per day without the places; only the daily totals are kept.
How often the app’s features are used is counted on our servers from the requests the app already sends for them — routes planned, navigations lasting over 2 minutes, search requests and how many accounts searched, reports, votes, assistant chats and documents saved to the document wallet — as daily totals per platform and country of the account, with no new identifier and nothing read from your device; to count a navigation or an account that searched only once, a coded key is kept until the end of that day, groups under 5 are not shown, and the switch ‘Count me in the statistics’ under Settings → Analytics & Tracking leaves your account out.
Sometimes different accounts see different versions of a screen; we compare the versions on these same totals. This uses no extra data.
Visits to leopol.ai are counted on our server as the pages are requested, without cookies, browser storage or identifiers (section 11).
Which campaign or website brought you to the app is used only if you said yes to product analytics (section 11).

Legal basis and your rights

The totals from the records of the service, and the counting of website visits: our legitimate interest in running and improving Leopol (Article 6(1)(f) GDPR). You can object by writing to privacy@trapspotter.com: our staff record your objection, and your account is then left out of these totals. Which campaign brought you: your consent (Article 6(1)(a) GDPR).

15Changes

We may update this privacy policy. The date at the top indicates the latest revision. Material changes will be announced in the app or by email.

Business seats: Leopol Fleet

Your employer or the business that engages you (the company) can give you a seat. You then get Leopol Pro for as long as the seat is active, with your own Leopol account.

Who is responsible. For your account and your use of the app (alerts, navigation, reports, Leopol Pro), Leopol remains the controller, as set out in this privacy policy. For the data in the company's console, the company is the controller and Leopol processes that data on its behalf, under a data processing agreement (Article 28 GDPR). The company must inform you in advance about what it does with that data.

What the company sees. The details it entered about you itself (name, email address and, if it entered them, phone number, job title and employee number), whether you accepted the invitation, your seat and its invoices. In addition:

the vehicle it assigns to you, with its papers and their scans, which you also see in the app;
the receipts you submit, with a photo;
a traffic fine it registers with you, and your answer to the question whether you were driving (see below).

The company's clients appear when you search in the app; the company does not see whether you look them up.

During a workday. In addition, only between "Start workday" and "Stop workday" and, if the company sets work hours, only within those hours:

your workdays (start and end) and the vehicle or your own car;
your trips: departure, arrival, the route taken, the distance and the client;
for a trip you make private, only the time and the distance: the places, the route and the client are permanently erased from what the company sees. You alone still see the places and the route in the app; Leopol keeps them for you (as the controller, see above) and erases them 60 days after the trip, when you leave the company or are removed from it, and when you delete them or your account;
your live position, only if the company switches that feature on: at most once a minute, only during a workday, and erased after 30 minutes. You can see in the app whether it is on. In the United Kingdom, Norway, Iceland, the United States, Australia and New Zealand, where the law allows it, the company also sees your speed at that moment; it must tell you beforehand;
for a fine, the trip that shows who was driving the vehicle at that moment;
the mileage statement and the hours calculated from this data.

Outside a workday, the app records nothing for the company. You can stop your workday at any time, for example for a break, and start a new one afterwards; in between, nothing is recorded. A workday that you forget to stop ends automatically after the number of hours the company chose, and at the end of the work hours. The company never sees your saved places, your own documents in the app, your messages to the assistant, the alerts and reports in the app, or your own payments.

With the time clock. If the company uses the time clock (for example in construction or cleaning), you clock in and out in the app: that is the start and the stop of your workday. In addition, the service records for the company:

the tasks you tap in: the start and the end, the site or address, the activity, the equipment you use, your note, and the place at the start of a task, rounded to about 100 metres and erased after 60 days;
your breaks, as time only: during a break the app records no position;
your departures to another site, with the trip as above;
for equipment you use, its last place, with the time and your name. While you use it, that place follows your phone's position, also when live positions are off; each new place overwrites the previous one, and your name is erased after 60 days;
the hours calculated from this, and the exports of them.

If a manager corrects a record or adds one, the service keeps the reason and your original record, and you see the correction in the app.

Without tracking. If the company uses Fleet without tracking (for example in real estate), the app never records a workday, trip or position for the company.

Police checks. On a business seat, police checks are shown by default. The company can switch them off; they are then hidden during a workday.

Anonymous traffic statistics. From your live position with a speed, Leopol may, on the company's instruction, keep a sample: the week and the hour, the place to about 11 metres, the speed and the heading, and a code for you that changes every week; no company, name, vehicle or trip. At most about 16 days later, the sample and the key of that code are erased, and only statistics per road segment and per week remain, resting on at least 20 people and 50 trips (Fleet's samples at most half). Nobody can recognise you in them; Leopol uses them for its own traffic statistics.

Legal basis. We use your seat to give you Leopol Pro, as performance of the contract with you (Article 6(1)(b) GDPR). For the data in the console, the company determines the legal basis.

When the seat stops. If you leave the company or the company removes you, your seat and its Leopol Pro stop. Your Leopol account continues to exist. The work data the company already had stays with the company for as long as it needs it, and at the latest until the end of its subscription plus the period in the data processing agreement. If you delete your Leopol account, your membership ends; the work data is no longer linked to your account, but the company may keep it as an employer.

Your rights. For the data in the console, contact the company. If you send your request to privacy@trapspotter.com, we will pass it on to the company and help it to respond.

Confirming a fine

If the company receives a traffic fine for a vehicle, it can register the fine with you and ask you in the app whether you were driving that vehicle at that time: because your trip at that moment shows it, or because the vehicle was assigned to you at that moment (or, where that is not known, is assigned to you now), which is not proof that you were driving. You then receive a notification and see the question on the Work page.

Data: the number plate, the date, time and place of the offence, the reference, the trip (if there is one), and your answer (yes or no).
Who decides: the company is the controller. It decides whether to designate you to the authorities as the driver. Where the law requires the company to designate the driver (in Belgium within 15 days, in Luxembourg and France within 45 days), that is the legal basis.
Sensitive data: data about traffic offences is data relating to criminal offences (Article 10 GDPR). Only the company's owner and managers see it.
Retention: automatically erased after the period of the company's country: in Belgium, 24 months after the offence; in France and Luxembourg, 45 days after the date of the letter (without that date, 90 days after the offence); in the Netherlands, Germany and every other country, 30 days after the company closes the fine, and otherwise at the latest 24 months after the offence. The company can erase it earlier.

Partner codes

If you redeem a code from a partner (at leopol.ai/code), we store with your account which partner and which batch the code comes from, when you redeemed it and until when your Leopol Pro runs. We use this to give you Leopol Pro, to show "Leopol Pro via [partner] until [date]" and to compile counts.

Legal basis: performance of the contract with you (Article 6(1)(b) GDPR).
What the partner sees: only counts (issued, redeemed, active). Never your name, your email address or the fact that you redeemed a code.
Retention: for as long as your account exists. If you delete your account, only an anonymous count remains.

Leopol Pro yearly

In addition to Leopol Pro monthly, there is Leopol Pro yearly (€49.95 per year), through the App Store, Google Play or our website (Stripe). We process no data beyond what we process for a monthly subscription: payment is handled by Apple, Google or Stripe, and we do not receive any card details. We store with your account whether your Leopol Pro is monthly or yearly and through which product, to show your subscription and for our revenue figures. A yearly subscription renews automatically unless you cancel it in accordance with the rules of the store where you bought it; you can withdraw from a subscription taken out on our website within 14 days, as set out in the terms and conditions.

16Contact and complaints

Privacy email: privacy@trapspotter.com

Address: Trekschurenstraat 245, 3500 Hasselt, Belgium

You may lodge a complaint with the Belgian Data Protection Authority at https://www.dataprotectionauthority.be/ if you believe we are processing your data incorrectly.