Privacy Policy

1. Who we are

RoadLy ("we", "our", "us") is an Irish platform that helps Approved Driving Instructors (ADIs) run their bookings, diary, learners and payments. Our websites are roadly.ie and app.roadly.ie.

RoadLy, based in Cork, Ireland, is the data controller for the personal data described here. That means we decide how and why it is used and we answer for it. You can reach us about anything on this page at hello@roadly.ie. If you need to write to us by post, email us and we will give you an address for it.

2. What we hold

• Account details: name, email address, phone number, password (stored only as a one-way hash) and whether you are an instructor or a learner.
• Instructor details: ADI number, business name, base location, service area, prices, availability, vehicles and payout account status.
• Learner details: pickup address, transmission, and, when your instructor needs them for the RSA's Essential Driver Training (EDT) records, your date of birth, driver number and EDT logbook number.
• Lessons and teaching records: bookings, lesson write-ups and feedback, EDT session progress, notes your instructor keeps about your driving, and driving test dates and results.
• Messages between you and your instructor, and any files attached to them.
• Payments: what was paid, when and for what. Card details go straight to Stripe. We never see or store your card number.
• Test Ready: what you bought, and your progress through the study material.
• Usage data: pages visited, features used, device and browser, and (only if you agree) analytics and visit replays as described in section 8.

3. Why we use it, and on what basis

GDPR asks us to say which legal basis covers each use. Ours are:

• To run your account and the lessons you book (contract). Taking bookings, sending confirmations and reminders, taking payment, paying instructors, sharing lesson details between you and your instructor, and keeping your lesson record.
• To meet our legal duties (legal obligation). Keeping payment and invoice records for tax law, and answering lawful requests from the authorities.
• To keep RoadLy safe and working (legitimate interests). Preventing fraud and misuse, checking instructors are on the RSA register, fixing errors, and keeping security logs. We only do this where it does not override your rights.
• Analytics, visit replays and marketing emails (consent). Only if you say yes, and you can change your mind at any time.

4. Who we share it with

We do not sell personal data. Your instructor sees the details they need to teach you, and you see your instructor's contact and business details. Beyond that, these companies process data for us under contracts that limit them to what we ask:

• Stripe - card payments and instructor payouts. Stripe also has its own legal duties as a payment provider.
• SendGrid (Twilio) - sending our emails.
• Google Cloud - hosting the platform and its database, in the EU.
• PostHog - product analytics and visit replays, hosted in the EU, only with your consent.
• Sentry - error reports, so we can fix things that break.
• Google Maps - looking up addresses and Eircodes and working out travel between lessons.

Some of these companies are based in the United States. Where data leaves the EU, it is protected by the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

If your instructor uses our EDT uploader, the EDT session details they choose to send (your name, driver number, date of birth, logbook number and the session completed) go to the RSA's ADI portal, which the RSA controls.

5. Learners under 18

Many learners start lessons at 17, so some people using RoadLy are under 18. We collect the same small set of details for everyone, only what lessons need, and we never use a learner's data for advertising.

• A parent or guardian of a learner under 18 can ask us to see, correct or delete that learner's data by emailing hello@roadly.ie. We will check who is asking before we act.
• RoadLy is not for anyone under 16. If we find an account belonging to someone under 16 without a parent's agreement, we will close it.
• If you are under 18, you can use all the rights in section 7 yourself.

6. Keeping it safe

Connections are encrypted (HTTPS), passwords are stored as one-way hashes, admin accounts can use two-step login, files attached to messages are kept private, and payments run through Stripe. Data is stored on Google Cloud in the EU.

7. Your rights

Under GDPR you can:

• See the personal data we hold about you. You can download a copy any time from Settings, Data & Privacy, in the app.
• Have wrong details corrected.
• Have your data deleted. You can close your account yourself from Settings, Data & Privacy.
• Object to, or ask us to limit, how we use your data.
• Withdraw consent for analytics or marketing at any time.
• Take your data to another service (portability).
• Complain to the Data Protection Commission in Ireland (dataprotection.ie). We would like the chance to put things right first, so please tell us too.

We answer requests within one month.

8. Cookies, analytics and visit replays

RoadLy uses essential storage to keep you signed in. With your consent we also use Google Analytics 4 and PostHog to understand how the site is used, including replays of visits. In those replays everything you type and all text on screen is masked, so they show layout and clicks, not your details. Both are hosted in the EU. You can accept or reject this in the cookie banner and change your choice at any time by clearing your browser storage for this site. We do not use advertising cookies.

9. How long we keep it

• Your account details, for as long as your account is open.
• When you close your account, your name, contact details, addresses, identity numbers, notes, lesson write-up text and the messages you wrote are removed straight away.
• Lesson, payment and invoice records are kept for as long as tax law requires (currently six years), with your name removed.
• Security, email delivery and other logs are deleted automatically on a fixed schedule.

10. Driving instructors on the RSA register

We also hold the public listings of Approved Driving Instructors from the RSA register, so that we can tell instructors about RoadLy. We did not get those details from the instructors themselves, so there is a separate notice explaining what we hold, where it came from, how long we keep it and how to opt out: Your details and the RSA register.

11. Changes and contact

If we change this policy in a way that matters, we will tell you in the app or by email before it applies. Questions, or a request about your data: hello@roadly.ie.