Your GDPR Rights

3. Personal data we process

We collect only what we need to run the website, deliver the exam-prep apps, take payment, keep the services secure, and answer support requests. We do not sell personal data and we do not use it for advertising.

ATV Companion

ATV Companion is usable without an account. Used that way your rides stay on the device and nothing about them reaches Lumagate. Map, trail, and weather requests still go to the providers named in section 5. If you do sign in, you use Google, Apple, or Microsoft, and we never receive your password.

The App processes precise location, which deserves particular care. Location is collected only while a ride or navigation session you started is running, and it is used to record your track, show your position, share your live position with a group ride you joined, and place waypoints or reports you create. In Google Firebase we store your profile, rides and their GPS tracks, routes, waypoints, and any social content you create. Some of that is deliberately visible to others — your rider profile, trail condition reports, emergency beacons, trip share links, and activities you mark public or unlisted — which the ATV Companion Privacy Policy sets out in full.

ATV Companion contains no advertising, no analytics SDK, and no third-party crash reporting. Map, trail, and weather requests reveal the area you are viewing to the provider serving it (Apple MapKit, Google Maps, the OpenStreetMap Overpass API, and Open-Meteo); we do not send your account identity with them.

Storage location: signed-in ATV Companion data is stored in Google Cloud’s United States multi-region. If you are in the EEA, the UK, or Switzerland and would prefer your ride data not to be transferred to the United States, use the App signed out — recording, offline maps, and navigation all work without an account, though sync, group rides, and social features necessarily do not.

Flashcards

You sign in with Google, Apple, or Microsoft. We never receive your password. From your chosen sign-in provider we receive your email address (or Apple’s private relay address), display name, profile photo URL, and a stable user identifier. In Google Firebase (Cloud Firestore) we store:

• Your profile (display name, email, and photo URL)
• Flashcard learning progress and study activity, including last-viewed cards per set
• Cards you have flagged or bookmarked
• Subscription status and the customer or subscription identifiers issued by Stripe, Apple, or Google Play — never your full card or bank details
• A record of which in-app service notifications you have seen

Search queries are sent to Algolia so we can return matching flashcards. On iOS and Android, Firebase Crashlytics records crash diagnostics (device model, OS version, stack traces). Firebase App Check confirms that requests come from a genuine copy of the app. Web sign-in stores authentication tokens in the browser so you stay signed in; those tokens are cleared when you sign out. We do not use advertising cookies, tracking pixels, or a third-party analytics SDK in Flashcards.

Quiz App

You sign in with Google, Apple, or Microsoft, or you may use the app anonymously. We never receive your password. For a signed-in account we receive your email address, display name, and a stable user identifier. In Firebase we store:

• Your profile (email, display name, theme preference, preferred exam)
• Study activity such as streaks, last study date, and questions answered
• Per-exam progress: scores, accuracy, readiness, flagged or missed questions, and any exam date you choose to save
• Question attempts (selected answer, correctness, time spent, confidence) and study-session summaries
• Question of the day attempts
• Subscription status and the identifiers issued by Stripe, Apple, or Google Play — never your full card or bank details
• In-app notification read status

Quiz App also uses Firebase Analytics for product usage (including a device identifier and coarse location derived from IP) and Firebase Crashlytics for crash diagnostics, both linked to your account so we can diagnose problems and improve the product. Anonymous use still creates a Firebase user identifier so progress can be saved on that device; it is not tied to your name or email until you sign in with a provider.

Website, contact form, and support

• Contact form submissions: first name, last name, work email, and any job title, phone number, product interest, or message you provide
• Marketing email records, if you choose to subscribe
• Support tickets at support.lumagate.us: the account or contact details you use and the content of your request
• Standard server logs (IP address, browser type, timestamps, referring pages) on lumagate.us and our hosting providers

7. How long we keep it

• ATV Companion account data — rides, GPS tracks, routes, and waypoints — is kept for as long as the account exists. Trail condition reports and emergency beacons stay published until you delete them or delete your account, because a hazard remains useful to other riders until it is reported cleared. Deleting the account removes them along with your profile and social content
• Flashcards and Quiz App account data, including study progress, is kept for as long as the account exists. Deleting the account from in-app Settings removes the Firebase Authentication record and the Firestore data described above.
• Payment processors may retain transaction records independently for tax, accounting, and dispute-resolution periods.
• Contact-form submissions and marketing records are kept for as long as needed to respond, or until you unsubscribe or ask us to delete them.
• Support tickets are kept as long as needed to resolve the request and for a reasonable period afterward for service quality and security.
• Server logs are kept for a limited period for security and troubleshooting, then deleted or anonymized.
• Crash reports, App Check signals, and (Quiz App) analytics events follow each processor’s retention schedule.

8. Your rights

If the GDPR or UK GDPR applies to you, you have the right to:

• Access — obtain a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — ask us to delete your data, including by deleting your in-app account
• Restriction — ask us to limit how we use your data in certain circumstances
• Portability — receive data you provided to us in a structured, commonly used format
• Objection — object to processing based on legitimate interests, including profiling of that kind
• Withdraw consent — where processing is based on consent, withdraw it at any time
• Lodge a complaint — contact your local data protection authority (see section 11)

These rights are not absolute. We may need to refuse or limit a request where another lawful ground still applies — for example, retaining a payment record we are legally required to keep.

9. How to exercise your rights

Submit a request through our support portal. That is the channel we use to log, verify, and fulfill GDPR requests:

https://support.lumagate.us

You can also email privacy@lumagate.us. Please say which product the request is about (Flashcards, Quiz App, lumagate.us, or support) and which right you want to exercise. We will ask for enough information to confirm you are the person the data relates to before we act on the request.

You can delete a Flashcards or Quiz App account yourself at any time from Settings in the app. That is the fastest way to exercise erasure for app data.

We will respond without undue delay and within one month of receiving a verified request. If the request is complex or you have made several requests, we may extend that by up to two further months and we will tell you why.