Privacy Policy for App and Interactive Map

RADIACODE LTD (“we”, “us”, “our”) value your privacy and are committed to transparency in how we handle your personal data. This Privacy Policy lets you (“user”) know how and for what purposes we are processing your information. We pledge that we will take reasonable steps to ensure that your personal data will only be used in ways that comply with this Privacy Policy and applicable regulations.

This Privacy Policy governs the processing of personal data in your interactions with us, including when you: (1) use our Radiacode App (the “App”), (2) use RadiaVerse interactive radiation portal including the Interactive map (the “RadiaVerse”) (collectively the “Product(s)”), (3) communicate with us and as otherwise described in this Privacy Policy.

Before you share any personal data with us, please review this Privacy Policy and our End User License Agreement (the “EULA”) and Terms and Conditions (the “Terms”).

When you choose to use our website, please understand that this Privacy Policy describes how your personal information is collected and used.

1. Who we are?

RADIACODE LTD is duly incorporated in and registered under the laws of the Republic of Cyprus, with a registered office at 10 Spyrou Kyprianou, 4040 Limassol, Cyprus. We act as a “data controller”. It means we determine the purposes and means of the processing of personal data.

Since we are registered under the law of the Republic of Cyprus, the personal data authority overseeing us regarding the personal data processing is Commissioner for Personal Data Protection. You always have the right to make a data protection related complaint at any time to a supervisory authority. You may also contact your local data protection authority. A list of local data protection authorities is available here.

If you would like to exercise your data protection related rights you can submit your request to us via e-mail: security@radiacode.com.

2. How do we process personal data?

We process your personal data only where we have a valid legal basis under the GDPR and only to the extent necessary for the relevant purpose. We apply data minimisation, purpose limitation, storage limitation, integrity and confidentiality, and privacy by design and by default principles.

We apply technical and organisational measures and safeguards to protect your data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

These safeguards include, where applicable:

regular vulnerability assessments and security scans;
separate and active consent for publishing public tracks;
private-by-default settings for tracks and social features;
user-controlled public identity, including the use of a nickname instead of automatically displaying a Google or Apple account name;
home vicinity obfuscation, where enabled by the user;
delayed publication of public tracks to reduce the risk of real-time tracking;
sensitive-location protection;
anti-scraping, rate-limiting, and bot-detection controls;
restrictions on raw GPS coordinate export through public APIs;
moderation, reporting and abuse-prevention mechanisms;
account deletion and data export controls;
data protection impact assessments for high-risk processing operations.

Below we have provided you with a full description of the data processing purposes, what personal data we process, legal basis of data processing and information about the retention period.

For users of the Interactive Map (RadiaVerse Website)

Processing purpose

Details of processing

Processed personal data

Email
Name
Profile image/photo
Google account identifier

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Received via Google authentication API

Storage period

Until the user deletes the account, or until the account has been inactive for more than 36 months.

Processed personal data

Email
Name
Profile image/photo
Apple account identifier

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Received via Apple authentication API

Storage period

Until the user deletes the account, or until the account has been inactive for more than 36 months.

Processed personal data

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject

Storage period

Until the user deletes the account, or until the account has been inactive for more than 36 months.

Account management

Processed personal data

Email address
Name, where provided
Profile image/photo, where provided
Username
Tracks
Last upload information
Device model
Device serial number. When you upload a track, the device serial number may be transmitted together with the track data. The device serial number is used only for internal purposes such as diagnostics, fraud prevention, technical support and customer support. The uploaded serial number is not displayed publicly.
Account settings
Privacy settings
Home vicinity setting, where enabled by you
Public comments, replies and other content submitted by you;
consent records for public track publication and social features.

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject

Storage period

Until the user deletes the account, or until the account has been inactive for more than 36 months. We may then keep the data for a limited additional period where necessary to protect the organization’s legitimate interests, including for the establishment, exercise or defence of legal claims, taking into account applicable Cypriot limitation periods (up to 6 years).

Filling the interactive map, publishing radiation level data

Processed personal data

Username
Date and time of sending radiation level data
Date and time of the radiation track / measurement
Last update date of the track
Radiation track location data / map points
Radiation measurement values
Filtered / non-filtered point information
Track duration
Track period / month
Data quality / validity indicator
Measurement device model, for example Radiacode-110

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from you, from your device, and from your manual inputs when you upload tracks. Certain technical and security data is collected automatically from your device or browser.

Storage period

Until the user deletes the account, or until the account has been inactive for more than 36 months.

Displaying public radiation tracks on RadiaVerse

Processed personal data

Username
Date and time of sending radiation level data
Date and time of the radiation track / measurement
Last update date of the track
Radiation track location data / map points
Radiation measurement values
Filtered / non-filtered point information
Track duration
Track period / month
Data quality / validity indicator
Measurement device model, for example Radiacode-110
Track publication status, for example public / private

Legal basis for the processing

Art. 6(1)(a) GDPR – Consent, where you choose to make a track public and make the related track data visible to other users and visitors.

Data source

Collected directly from you, from your device, and from your manual inputs when you upload tracks, choose publication settings, add comments, upload photos, or use social features. Certain technical and security data is collected automatically from your device or browser.

Storage period

Until you delete the relevant track, change its visibility setting, withdraw consent where applicable, or delete your account, unless longer retention is necessary to comply with legal obligations, establish, exercise or defend legal claims, investigate abuse, fraud or security incidents, or protect the safety and integrity of the Product.

Enabling users to add comments, photos and explanations to public tracks

Processed personal data

Username
Comments, replies and explanations submitted by you;
Photos, captions and descriptions uploaded by you;
Timestamps of posting, editing or deleting comments, replies, photos or explanations;
Track identifier linked to the comment, photo or explanation;
Moderation status, reports and moderation decisions.

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from you when you submit comments, replies, photos, captions, descriptions or explanations

Storage period

Until you delete the relevant comment, photo, caption, description or explanation, or delete your account, unless longer retention is necessary for moderation, legal claims, abuse prevention, security investigations or legal compliance.

Enabling users to interact with publicly available content

Processed personal data

Username
Comments, replies and explanations submitted by you;
Photos, captions and descriptions uploaded by you;
Timestamps of posting, editing or deleting comments, replies, photos or explanations;
Track identifier linked to the comment, photo or explanation;
Moderation status, reports and moderation decisions.

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from you when you interact with public content, manage notification settings or use social features.

Storage period

Until you delete the relevant interaction, change the relevant setting, or delete your account, unless longer retention is necessary for moderation, legal claims, abuse prevention, security investigations or legal compliance.

Moderating public content

Processed personal data

Username
Public profile identifier
Public profile information, where relevant
Public track identifiers
Public radiation track location data / map points
Obfuscated or blurred coordinates, where privacy measures apply
Radiation measurement values and related track metadata
Comments, replies, photos, captions, descriptions and other public content submitted by users
Reports submitted by users, including report reason, reported content, reporter identifier and reported user identifier
Moderation status, moderation notes, moderation decisions and appeal records, where applicable
Account restrictions, blocking records, warning records and enforcement history
Consent records and publication timestamps, where relevant to verify publication settings
Technical and security information, including IP address, device/browser information, access times, user agent, request logs, rate-limit events, CAPTCHA events, bot-detection signals and other anti-abuse logs

Legal basis for the processing

Art. 6(1)(f) GDPR – Legitimate interests. Our legitimate interests are protecting users and visitors, reducing risks of physical tracking and harassment, protecting the integrity and security of RadiaVerse, enforcing our Terms, EULA, and maintaining a safe, reliable and trustworthy radiation safety community.

Data source

Collected directly from you when you publish tracks, submit comments, upload photos, interact with public content, report content or communicate with us. Moderation information may also be generated by Radiacode personnel or by automated technical controls used to detect abuse, scraping, spam, suspicious activity or security incidents.

Storage period

Moderation records, reports, enforcement history and abuse-prevention records are retained for as long as necessary to review the report, enforce our Terms, EULA, protect users and the Product, comply with legal obligations, or establish, exercise or defend legal claims.

Where public content is removed or restricted following moderation, we may retain a limited record of the removed or restricted content and the moderation decision where necessary for safety, accountability, appeals, repeated-abuse prevention or legal purposes.

Maintaining the correct operation, tracking problems

Processed personal data

Device information (device type, features used, access times, IP)
Usage information (manufacturer, model, OS, timezone, language, region)

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject’s device

Storage period

Within approximately 30 days, and no later than 90 days from the date on which the technical event or log was generated.

Processing of customer support inquiries for analysis, issue resolution, and routing to relevant internal departments to ensure high-quality service

Processed personal data

Email address, category of the issue, other data provided in issue and correspondence

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject

Storage period

Retained for the duration of the inquiry and up to 6 years thereafter to establish or defend potential legal claims within applicable Cypriot limitation periods.

When you make a radiation track public or use public social features, the relevant information may be visible to all visitors of RadiaVerse, including non-registered users. This may include:

your nickname / username;
your public profile information;
your profile image / photo, where displayed according to your settings;
public radiation track location data / map points;
obfuscated or blurred coordinates, where privacy measures apply;
radiation measurement values and related track metadata;
photos, captions and descriptions attached to public tracks;
comments, replies and related timestamps;

Public tracks may reveal places you visit, your approximate home or work area, your school, habitual routes, routines or other movement patterns. You should not publish tracks that reveal your home, school, workplace, sensitive locations or regular routine.

Public track publication is private by default and requires active confirmation. Before your first public publication, we may show a short notice or pop-up explaining what data becomes public and the risks of linking radiation measurement data to your public profile.

Although we apply safeguards to reduce the risk of real-time or physical tracking, public content may be viewed, copied, screenshotted, downloaded or further shared by third parties. We cannot control all further use of information once it has been made public by you.

Location privacy and safety measures for public tracks

To reduce the risks identified for public tracks, we apply the following measures:

Private by default. Tracks are private by default unless you actively choose to make them public.

Delayed publication. Public tracks may be held server-side for at least 24 hours before becoming visible to other users or visitors. This is intended to prevent real-time location tracking. Real-time viewing is available only to the track owner within their own session.

Home vicinity privacy setting. Where you enable the home vicinity privacy setting, we may apply an obfuscation radius around locations of your choice. Original coordinates may be retained server-side where necessary for integrity and scientific purposes, but they are not exposed through the public UI or public API when this privacy setting applies.

Sensitive-location protection. We may maintain a database of sensitive locations, such as nuclear facilities, military installations, government buildings and other restricted or sensitive areas. Where a track passes through or starts/ends within a protected radius of such a location, we may automatically blur or reduce the precision of coordinates within that area. Where appropriate, we may notify you that part of your track has been obfuscated.

No raw GPS export through public APIs. We do not provide unrestricted public API export of raw GPS coordinates for public tracks. We may limit integrations with external mapping services and apply rate limits to data requests.

Anti-scraping controls. We use controls such as bot detection, traffic monitoring, query throttling and blocking of known scraping user agents to reduce mass harvesting of public tracks, comments and profile data.

Search engine restrictions. We may use technical measures such as robots.txt to reduce indexing of public profiles, public tracks and public images by search engines where technically feasible.

RadiaVerse may allow you to use social features such as nicknames, profile photos, comments, replies, photos and captions.

You control the content you submit. You should not upload photos, comments or other content that reveal sensitive information about you or another person, such as health information, political opinions, religious beliefs, precise private addresses, or other third-party personal data unless you have a lawful basis and permission to do so.

We do not intentionally collect special categories of personal data through social features. If you include such information in your comments, photos or public content, you are responsible for deciding whether to share it publicly.

Managing your public visibility

You can use RadiaVerse without making your tracks or social content publicly visible. If you want to reduce the amount of information that can be linked to you, we recommend that you:

keep your tracks private unless you intentionally want to publish them;
use a nickname that does not identify you;
avoid using your real name or a recognizable profile photo;
avoid publishing tracks that start or end near your home, school, workplace or other places you regularly visit;
enable the home vicinity privacy setting;
review a track before making it public;
avoid adding comments, photos or captions that reveal your address, routine, private life or sensitive information;
avoid uploading photos that show faces, private homes, vehicle registration plates, documents or other identifiable details;
delete comments, photos or public content if you no longer want them to be visible;
change track visibility settings;
use quiet mode, if you do not want to receive social notifications;
contact us at security@radiacode.com if you need help removing or restricting public content linked to your account.

Even if you later delete public content or change its visibility, third parties may have already viewed, copied, screenshotted or shared it. For this reason, you should only publish tracks, comments and photos that you are comfortable making visible to other users and visitors.

Cookies

The RadiaVerse Website uses cookies to ensure the proper operation of the site and to provide a convenient and secure user experience. A cookie is a piece of data that can be stored on the browser of your computer or mobile device you use to access the Website. It enables the Website to “remember” your activity or preferences for a certain period of time or during a specific session. The information does not always identify you, but it can give you a more personalized web experience.

For information about the specific cookies and tracking technologies we use, their providers, retention periods, and how you can manage your preferences, see our Cookie Notice.

For users of the RadiaCode App

Processing purpose

Details of processing

Maintaining the correct operation, tracking problems

Processed personal data

Device information (device type, features used, access times, IP)
Usage information (manufacturer, model, OS, timezone, language, region)

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject's device

Storage period

Within approximately 30 days, and no later than 90 days from the date on which the technical event or log was generated.

Processing of customer support inquiries for analysis, issue resolution, and routing to relevant internal departments to ensure high-quality service

Processed personal data

Email address
category of the issue
other data provided in issue and correspondence

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject

Storage period

Retained for the duration of the inquiry and up to 6 years thereafter to establish or defend potential legal claims within applicable Cypriot limitation periods.

Use of the App, its functionality (sending information about radiation level in the area)

Processed personal data

Location data (including real-time geographic location of your computer or device)

Legal basis for the processing

Art. 6(1)(a) GDPR — Consent

Data source

Collected directly from the data subject's device

Storage period

Until consent is withdrawn or no longer necessary for the purpose.

Registration of an account for using our App and Interactive map

Processed personal data

Google ID, email address of the integrated Google account, or Apple ID, email address of the integrated Apple account
username
image / photo

Legal basis for the processing

Art. 6(1)(b) GDPR – Contract (EULA)

Data source

Collected directly from the data subject

Storage period

Until the user deletes the account and up to 6 years thereafter to protect the organization's legitimate interests within applicable Cypriot limitation periods.

Tracking and analyzing trends, usage, and actions related to the App in order to better understand the using of the App and improve it

Processed personal data

Device Information
Usage Information

Legal basis for the processing

Art. 6(1)(a) GDPR — Consent

Data source

Collected directly from the data subject's device

Storage period

Until consent is withdrawn or no longer necessary for the purpose.

Your privacy is of utmost importance to us, and we handle your personal data with the highest level of care and responsibility. While we endeavor to minimize the sharing of your personal data, there are certain circumstances where it becomes necessary to disclose it to third parties.

We share your personal data in such cases:

a. to comply with applicable law.

We are committed to complying with all applicable laws, regulations, and legal obligations. In certain situations, we may be required to disclose your personal data to comply with legal requirements, such as to respond to subpoenas, court orders, or other lawful government requests. We may also share your personal data if we believe in good faith that such disclosure is necessary to protect our rights, enforce our EULA, Terms, investigate fraud, or protect your safety.

b. to accomplish the purposes set forth above.

In an effort to provide an exceptional experience, we work closely with a select group of trusted partners and service providers. These partners play an important role in supporting various aspects of our business, thereby enhancing the quality of the Products. When selecting the partners with whom we share your personal data, we take a cautious approach, ensuring that we only work with companies that take strict measures to protect personal data from unauthorized access, disclosure, or misuse.

For that we may use the following categories of providers:

1. Hosting providers

We take responsibility for the storage of your personal data and store it only with trusted hosting providers.

2. Third parties that provide support services for us to communicate with you

We may share and disclose your personal data to the following categories of data processors:

Customer support platform providers
Communication and email service providers
Internal communication and collaboration tools

3. Authentication providers

To ensure secure access to your account, we use trusted authentication services. These providers allow you to log in without creating a separate password and help us protect your account against unauthorized access.

4. Content Moderation and Safety Services

To maintain a safe, reliable, and trustworthy community, we use a combination of automated technology and human oversight to monitor public content, such as comments and profile information.

AI-Assisted Screening: We may use automated systems (including third-party AI-based moderation tools) to scan public comments and content for potential violations of our Terms, EULA, or applicable law (e.g., spam, harassment, or illegal content). This allows us to protect our users from harmful interactions in real-time.
Human-in-the-Loop Review: Our automated systems are designed to assist, not replace, human judgment. Content flagged by AI is typically subject to manual review by our moderation team before any permanent restrictive action is taken.
Moderation Actions: Based on this dual review process, we reserve the right to restrict, hide, or remove content. We may also issue warnings or restrict accounts in cases of repeated or severe violations.
Accountability and Appeals: We retain limited moderation records (such as the reason for a decision and related timestamps) to ensure accountability and to allow you to appeal moderation decisions. You can always contact us at support@radiacode.com if you believe a moderation action was taken in error.

c. Public disclosure through RadiaVerse

If you make a track public or submit public social content, the relevant personal data may be disclosed publicly through RadiaVerse. This means that the information may be accessible to all visitors, including non-registered users and visitors located outside the European Economic Area.

Publicly visible data may include your nickname / username, public profile information, profile image / photo where displayed according to your settings, public track location data / map points, radiation measurement values, track metadata, photos, captions, comments, replies and other public content submitted by you.

This public disclosure is part of the Product functionality and is separate from disclosures to our processors and service providers. You can reduce or stop public disclosure by changing visibility settings, deleting public content, making a track private where available, withdrawing consent where applicable, or contacting us at security@radiacode.com.

We cannot control copies, screenshots, downloads or further sharing made by third parties before the content is removed from RadiaVerse.

We do not sell your public track data, GPS data, radiation measurement data, comments, profile data or photos to advertisers, insurance companies or data brokers. We do not use precise public track data for intrusive targeted advertising.

International transfers

If we transfer your personal data outside the EEA, we ensure appropriate safeguards in accordance with Chapter V GDPR, such as:

Adequacy decision (e.g. EU–US Data Privacy Framework)
Standard Contractual Clauses approved by the European Commission
Additional technical & organizational measures

As a data subject, you have certain rights regarding your personal information. We are committed to upholding these rights and ensuring that you can exercise them effectively. Please note that these rights are subject to certain limitations and exceptions as provided by law. To exercise any of these rights or for further inquiries, please contact us at at security@radiacode.com.

We will review your request as soon as possible, but not longer than one (1) month following your request. Please keep in mind that this period may be extended for an additional two (2) months, if necessary, based on the complexity and number of requests we have received. If we need to extend the response timeframe, we will tell you about the response extension within one (1) month of receipt of your request and explain the reasons for the delay.

Below, you can find the information regarding your rights as a data subject under EU legislation:

Right of access

This right allows you to request access to the personal data we hold about you.

To exercise this right, please contact us at the following e-mail address: security@radiacode.com. Upon receiving your request, we will provide you with a copy of the personal data we process in the form in which you have requested the provision of this information. Please note that in some cases we may charge you a reasonable fee for providing this information. If we are unable to fulfill your request for any reason, we will provide you with an explanation and inform you of your rights to appeal the decision.

Right to rectification

This right enables you to request the correction or updating of any inaccurate or incomplete personal data we hold about you.

You can exercise this right by contacting us by e-mail at security@radiacode.com.

Upon receiving your request for rectification, we will review the accuracy and completeness of your personal data and make any necessary corrections or updates.

Right to erasure

This right allows you to request the deletion or destruction of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or processed (or, as we all know, the “right to be forgotten”).

You can exercise this right by contacting us at security@radiacode.com.

Upon receiving your request for erasure, we will assess whether the conditions for erasure are met and, if so, promptly delete or anonymize your personal data from our systems and notify any third parties to whom the data have been disclosed.

Also, we may delete, block or anonymize the personal data that is linked to your account in the Products in accordance with section 11 of the Terms and Conditions and 3.7 of the End User License Agreement.

Right to restrict processing

This right allows you to request the restriction of processing of your personal data in certain circumstances, such as when the processing is unlawful, when we no longer need the personal data, or when you have objected to the processing.

To exercise this right, please contact us at security@radiacode.com. Upon receiving your request to restrict processing, will not process your personal data (except for storage) unless it is based on consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

Right to data portability

This right allows you to receive a copy of your personal data in a structured, commonly used, and machine-readable format if it is technically possible to do so and to transmit those data to another controller.

To exercise this right, please contact us at security@radiacode.com. Upon receiving your request for data portability, we will provide you with a copy of your personal data in the requested format, where technically feasible.

Right to object

This right enables you to object to the processing of your personal data in certain circumstances, such as where the processing is based on legitimate interests or for direct marketing purposes.

To exercise this right, please contact us at security@radiacode.com. Upon receiving your objection to processing, we will assess the validity of your objection and, if valid, cease processing your personal data for the purposes to which you have objected.

You have the right to withdraw your consent to the processing of your personal data at any time. This means that if we are processing your personal data based on your consent, you have the right to revoke that consent.

To exercise this right, please contact us at security@radiacode.com. Upon receiving your request to withdraw consent if we do not have any other legal basis for processing your personal data, we will stop processing it.

Right to lodge a complaint

If you believe that our processing of your personal data violates applicable legislation, you have the right to lodge a complaint with a supervisory authority.

You can contact the Office of the Commissioner for Personal Data Protection (https://www.dataprotection.gov.cy), or
the authority in your country of residence, place of work, or where the alleged breach took place. A list of EU supervisory authorities and their contact details is available here.

In addition to the rights described above, you may use Product settings, where available, to:

edit or delete your nickname, profile image / photo and public profile information;
delete photos, comments and other social content submitted by you;
manage social notifications;
change the visibility of tracks;
enable or disable the home vicinity privacy setting;
report inappropriate content or request moderation review;
withdraw consent for public track publication.

Where we process your public social content based on consent, withdrawal of consent will not affect the lawfulness of processing before the withdrawal. Once we receive and verify your request, we will remove, restrict or anonymize the relevant content from the Product where required by law and technically feasible.

5. Children’s privacy

We do not knowingly collect or solicit your personal data to anyone under the age of 13 (in USA) or 16 (in European Economic Area) or knowingly allow such persons to use our Products. If you are under the age of 13 (or 16, where applicable), please do not provide any personal data to us. If we learn that we have collected personal data about a child under the age of 13 (or 16, where applicable), we will delete that personal data as soon as possible. If you believe that we might have any personal data from or about a child under the age of 13 (or 16, where applicable), please contact us at security@radiacode.com.

6. Changes to the privacy policy

This Privacy Policy may be changed from time to time due to the implementation of new technologies, changes in applicable laws or for other purposes.

When we make changes, we will update the date at the top of this Privacy Policy. Use the date below the title to view earlier versions of this Policy. For material changes that significantly affect your rights or the way we process your personal data, we will take additional steps to inform you, such as:

displaying a prominent notice on the Website; and/or
sending you an email notification if we have your email address and the changes are relevant to your relationship with us.

By continuing to use the Website, you acknowledge that you have been notified of the changes to this Privacy Policy. If we make any changes that require your explicit consent for further processing of your personal data, we will request your consent or renewed consent (in case it was obtained previously) for such processing before it will begin.