Privacy Policy
This privacy notice explains how Drivia Ltd (“we”, “us”, “our”) collects and uses your personal information when you use Kerb – Driving Test Routes UK, our iPhone app, or our website, kerbroutes.co.uk.
Kerb is an iPhone app for UK learner drivers. It provides practice routes around your chosen driving test centre with turn-by-turn navigation, and keeps a record of the routes you have driven and any notes you write about them. Because Kerb guides you around real roads, it needs your precise location while you are on a practice drive.
Drivia Ltd is the data controller for your personal information. If you have any questions, email privacy@kerbroutes.co.uk.
Summary of key points
- What we collect. Your name and email address (from Apple or Google when you sign in), your test centre and test date, the routes you save, your notes, a record of each practice drive, and your app settings.
- Your location. Used only during a practice drive, to guide you. The trace of where you drove stays on your phone and is never sent to us. Our maps provider, Mapbox, receives your location during a drive (section 1).
- Sensitive information. We do not collect any.
- From third parties. We receive your name and email from Apple or Google when you sign in with them, and a record of your purchase from Apple.
- No advertising. We do not sell your information, share it with advertisers, or use any advertising or analytics tools.
- Where it is stored. Your account data is stored in London, UK (section 6).
- How long we keep it. Until you delete it or your account. Accounts unused for 24 months are deleted automatically (section 7).
- Your rights. You can see, correct or delete your information. You can delete your account in the app at any time. To make a request, visit kerbroutes.co.uk/privacy-request (section 10).
Contents
- What information do we collect?
- How do we use your information?
- What legal bases do we rely on?
- Who do we share your information with?
- How do we handle sign-in with Apple and Google?
- Is your information transferred internationally?
- How long do we keep your information?
- How do we keep your information safe?
- Children and young drivers
- What are your privacy rights?
- Do-not-track
- Do we update this notice?
- How can you contact us?
- How can you review, update or delete your data?
1. What information do we collect?
Information you give us
- your name and email address (from Apple or Google, see “Sign-in data” below)
- your chosen driving test centre and, if you add one, your test date
- routes you save
- notes you write about routes
- your app settings, such as whether voice guidance is on
Sign-in data. You sign in to Kerb with Sign in with Apple or Google Sign-In. When you do, we receive your name and email address from Apple or Google. If you use Sign in with Apple and choose “Hide My Email”, we receive an Apple relay address instead of your real one, and Apple only shares your name the first time you sign in. We do not receive or store your password, and we do not store your profile picture.
Payment data. All purchases are made through Apple’s App Store using your Apple ID. Apple processes the payment; we never receive or store your card details. We receive a transaction record from Apple, which we verify with Apple, and we store whether your subscription is active and when it ends. Apple’s privacy notice: apple.com/uk/legal/privacy.
Sensitive information. We do not collect any sensitive (“special category”) information.
Your location
Kerb asks for your precise location so it can guide you around a practice route. It uses your location only during a practice drive, including while your screen is locked so that spoken directions continue. It does not track your location at any other time. You can change this permission at any time in your iPhone’s Settings, but Kerb cannot navigate without it.
Information collected automatically
- Server logs. When the app talks to our servers, our hosting provider records technical information such as your IP address, the time of the request and your device’s operating system. We use this to keep the service running and secure.
- Crash reports. If you have chosen to share analytics with app developers in your iPhone’s settings, Apple sends us anonymous crash reports.
- Practice drive records. When you finish a drive, or stop early and choose to save it, we record which route you drove, when, how long it took, and how much of the route you completed.
- Route trace. During a drive, Kerb records a simplified trace of where you drove. This is kept on your device only and is never sent to our servers.
- Navigation data sent to Mapbox. Kerb’s maps and turn-by-turn directions are provided by Mapbox. While you are on a practice drive, the Mapbox software built into Kerb sends your device’s location, speed and direction of travel, together with technical information about your device, to Mapbox. Mapbox uses this to provide navigation and, under its own privacy policy, to improve its maps and traffic information: mapbox.com/legal/privacy.
We do not use any advertising or analytics tools in the app or on the website.
When you use our website
If you send us a message or a privacy request through kerbroutes.co.uk, we receive what you enter: your name, email address and message, and, if you give them, your test centre or the email address on your Kerb account. To stop the forms being abused, we keep a scrambled (one-way hashed) version of your IP address for two days; we never store the address itself. Our website host records standard server logs, such as IP addresses and pages requested. The website uses no cookies.
Google APIs. Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. How do we use your information?
- To create and run your account and sign you in.
- To provide turn-by-turn navigation. We use your precise location during a practice drive to guide you along the route with spoken and on-screen directions. (Retention: not stored on our servers. Mapbox receives location during a drive, as described above. A simplified route trace is kept on your device until you delete the drive record, delete your account, or delete the app.)
- To keep your practice history and notes. We store the routes you have driven (including drives you stopped early and chose to save), when you drove them, your notes, saved routes, chosen test centre and test date, so they are available whenever you sign in. (Retention: for as long as your account exists, or until you delete them. See section 7 for inactive accounts.)
- To verify purchases and give you access to the routes you have paid for.
- To answer your messages and privacy requests, and to help with any problems.
- To keep Kerb secure, including preventing fraud and abuse.
- To improve our routes and the app. We look at practice drive records across all users (which routes are driven, how long they take, and how often) in aggregated form. We do not use your notes or your location for this. (Retention: aggregated data does not identify you and may be kept indefinitely. The underlying drive records are kept for as long as your account exists.)
- To protect someone’s vital interests, such as preventing harm, where that is ever necessary.
3. What legal bases do we rely on?
UK data protection law (the UK GDPR) requires us to explain the legal basis for each thing we do with your information.
| What we do | Legal basis |
|---|---|
| Creating and running your account, signing you in | Performance of a contract |
| Turn-by-turn navigation using your location | Performance of a contract |
| Keeping your practice history, notes, saved routes and test date | Performance of a contract |
| Verifying purchases and giving you access to routes | Performance of a contract |
| Answering your messages and privacy requests | Legitimate interests (helping you); legal obligation for privacy requests |
| Server logs, security and preventing fraud | Legitimate interests (keeping Kerb secure) |
| Looking at drive records in aggregate to improve routes | Legitimate interests (keeping routes accurate and improving the service for learners) |
| Keeping records the law requires, or cooperating with authorities | Legal obligation |
| Protecting someone from harm | Vital interests |
We do not rely on consent for any of the above. Your iPhone’s location permission is how you control whether Kerb can use your location; it is not the legal basis for using it. Where we rely on legitimate interests, you have the right to object (section 10).
4. Who do we share your information with?
We share your information only with the providers who run parts of Kerb for us, and only so they can do that work:
- Supabase (cloud hosting, database and sign-in), which stores your account data in London, UK.
- Mapbox (maps and turn-by-turn navigation), based in the United States. Receives your location during a practice drive, as described in section 1.
- Apple (App Store purchases, receipt verification, and Sign in with Apple).
- Google (Google Sign-In, if you choose it).
- Resend (delivers messages from our website’s forms to our inbox), based in the United States.
- Netlify (hosts our website), based in the United States.
Our providers act under contracts (data processing agreements) that only allow them to use your information on our instructions and require them to protect it.
We do not sell your personal information, and we do not share it with advertisers.
We may also share information if we sell or merge our business, or if the law requires us to.
5. How do we handle sign-in with Apple and Google?
When you sign in with Apple or Google, we receive your name and email address, as described in section 1. We use them only for the purposes in this notice. We do not control how Apple or Google use your information; their own privacy notices explain that.
6. Is your information transferred internationally?
Your account data is stored in the UK. Some of our providers process data in the United States.
Our database and sign-in service (Supabase) store your account data on servers in London, United Kingdom. Mapbox, Apple, Google, Resend and Netlify may process your information in the United States and other countries. Where personal information leaves the UK, we rely on the UK government’s adequacy regulations (including the UK–US “Data Bridge” for certified US companies) or on the ICO’s International Data Transfer Addendum built into our providers’ data processing terms. You can ask us for details of these safeguards at privacy@kerbroutes.co.uk.
7. How long do we keep your information?
We keep your information only for as long as we need it for the purposes in this notice, unless the law requires us to keep it longer (for example for tax or accounting).
Inactive accounts. If you do not use Kerb for 24 months, and you do not have an active subscription, we treat your account as inactive and permanently delete it and all of its data from our servers. “Using Kerb” means signing in or opening the app while connected to the internet.
Deleting your account. When you delete your account, your account and everything associated with it is removed from our servers and from your device straight away. Copies in our hosting provider’s backups are overwritten automatically and are not used in the meantime. If you delete the app instead, Kerb’s data on your phone is removed, and if you reinstall it you will need to sign in again.
Messages to us. Messages and privacy requests sent through our website are kept for as long as we need them to deal with your message and any follow-up.
8. How do we keep your information safe?
We use technical and organisational measures to protect your information. For example, each person’s data on our servers can only be read by their own account, and the trace of where you drove never leaves your phone. However, no system connected to the internet can be guaranteed to be 100% secure, so we cannot promise that your information will never be accessed by someone who should not have it.
9. Children and young drivers
Kerb is for learner drivers aged 17 and over.
Most people learning to drive in the UK are 17 or just over, and Kerb is designed with them in mind. You must be at least 17 to create an account. We do not knowingly collect information from anyone under 17. If you believe someone under 17 has created an account, contact privacy@kerbroutes.co.uk and we will delete it.
Because many of our users are under 18, we keep data collection to what the app needs to work: location is used only during a drive, the route trace stays on your device, and we use no advertising, profiling or analytics tools.
Purchases are made through Apple. If you are under 18, Apple’s own controls (such as Ask to Buy in Family Sharing) may apply.
10. What are your privacy rights?
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is wrong
- ask us to delete your information
- ask us to restrict how we use your information
- object to us using your information where we rely on legitimate interests
- receive your information in a format you can take elsewhere (data portability)
- not be subject to decisions made purely by automated means (Kerb makes none)
To make a request, visit kerbroutes.co.uk/privacy-request or email privacy@kerbroutes.co.uk. We will respond within one month, as the law requires.
Deleting your account. Open Kerb, go to Profile and choose Delete account. This permanently removes your account and all associated data from our servers and from your device. You can also ask us to do it for you.
Complaints. If you are unhappy with how we have handled your information, please tell us first:
- Online: kerbroutes.co.uk/contact
- Email: privacy@kerbroutes.co.uk
- Post: see section 13
We will acknowledge your complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome.
If you are not happy with our response, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. Do-not-track
Some browsers and devices offer a “do not track” setting. There is no agreed standard for responding to it. Kerb does not track you across other companies’ apps or websites, whatever that setting says.
12. Do we update this notice?
We will update this notice when what we do changes, or when the law requires it. The date at the top shows when it was last changed. If we make a significant change, we will tell you in the app or on this website.
13. How can you contact us?
If you have questions or comments about this notice, email us at privacy@kerbroutes.co.uk or write to us at:
Drivia Ltd
5 Chilcomb, Burgess Hill, West Sussex RH15 0DJ, England
Company number 17385348
14. How can you review, update or delete your data?
You can delete your account in the app at any time (section 10). To see, correct or delete any of your information, visit kerbroutes.co.uk/privacy-request.
Need a copy of your data, a correction, or something else about privacy? Make a privacy request.