RevDuePrivacy
Nederlands: privacyverklaring
Draft. This is the privacy statement for the online version of RevDue, which is still in development and not in use yet. It is reviewed before going live. The Windows program has its own privacy statement.
RevDue is an online service to keep track of the maintenance of your vehicles, keep your invoices and, when selling, make a PDF with the complete history. Your data is on RevDue's server in the EU, most of it encrypted with a key that belongs to your account only.
Who is responsible
RevDue is made and offered by Daniel Goedknegt. Contact about your data: [contact address, to be filled in before going live].
RevDue is meant for private use: your own car, motorcycle or trailer. It is not meant for business use, for example by a garage company.
What RevDue stores, and why
| Data | What for | Legal basis | How it is stored |
|---|---|---|---|
| E-mail address, password (as a hash only), sessions, two-step verification, passkeys, the browsers you sign in on (a cookie, stored only as a hash) | Signing in and protecting your account | contract | database; password as an Argon2id hash, sessions and recovery codes as a hash, the secret of your authenticator app encrypted, of a passkey only the public key |
| License plate, nickname, vehicle data, RDW data | Keeping track of your vehicles, planning maintenance | contract | database; license plate and nickname encrypted |
| Services, odometer readings, costs, fill-ups, storage, parts, specs | History, planning, cost overview, sale PDF | contract | database; notes and "performed by" encrypted |
| Invoices (original and redacted), documents, vehicle photo | Proof of maintenance, reference, sale PDF | contract | encrypted files, each with its own key |
| Your own redaction terms (name, address) | Finding and redacting personal data on invoices | contract | database, encrypted |
| Data of others on invoices and documents (e.g. the mechanic, a previous owner) | It is simply on them; RevDue helps to redact it before you share anything | legitimate interest | like the invoices: encrypted |
| The history you take over from a previous owner: the services from their sale PDF, and that PDF itself | A continuous maintenance history; the PDF as evidence. It only holds what the seller shared (redacted invoices) | legitimate interest | database; the PDF encrypted, like your other files |
| Log of security events: signing in, signing out, failed attempts, with a rough device description (e.g. "Chrome op Windows") | Detecting abuse and protecting your account | legitimate interest | database, 12 months |
| Technical logs (without the content of your data) | Finding faults and abuse | legitimate interest | 30 days |
Encrypted means: someone who only gets hold of the database or the storage, for example a stolen backup, cannot read that data. The server itself can read it while you use the app: that is needed to redact your invoices, recognize text and make the sale PDF.
Do not upload identity documents or other special categories of data; RevDue does not need them.
RevDue also keeps a complete overview, with the location and retention per item (the data register). You can ask for it at the contact address above.
Who else processes your data
| Party | What | Why | Where |
|---|---|---|---|
| Scaleway (processor) | Everything above, most of it encrypted | Hosting: server, database, storage, key management, e-mail | EU (Amsterdam and Paris) |
| RDW Open Data | The license plate | Looking up a vehicle and refreshing RDW data | the Netherlands |
| Sketchfab and Wikimedia Commons | Make and model, or your search term, and your IP address (your browser loads the preview images) | Finding an image of your vehicle | USA |
| Sketchfab | Your IP address | Viewing a 3D model; by default only after a click (Instellingen > Privacy) | USA |
| Have I Been Pwned | The first 5 characters of a hash of a new password; not the password, not your email address and not your IP address (the server asks) | Checking whether the password appears in a known data breach | outside the EU |
Reminders come by email (on by default, switched off under Instellingen > Herinneringen). An email travels unencrypted, so a reminder only names make and model and what is due: never your licence plate, nickname or the name of a document. RevDue keeps only the day of the last reminder and its points as a code, so you do not get the same one every day.
If you install RevDue as an app on your phone, it keeps only the app itself (layout and scripts) and an offline page, never your data: that always comes from the server.
Text recognition (OCR) happens on RevDue's own server, not at another party. There are no ads, no tracking and no analytics services. If anything like that is ever added, it is described here first, and the app asks for consent beforehand where that is required.
Sharing with a buyer
You make the sale PDF yourself and give it to whoever you want. It only contains invoices you have reviewed and redacted; an invoice that has not been reviewed never goes in, and neither does its file name. Documents (registration certificate, policy) never go in. If you choose "do not show costs", the amounts are redacted on the invoices as well. Notes on services go in, unless you switch "show notes" off: they may hold something personal. The PDF also holds the same history as data, signed by RevDue, so the buyer can take it over in their own RevDue; it holds nothing that is not on the pages as well.
Keeping and deleting
- Deleting something in the app (a vehicle, a service, an invoice, a document) moves it to the trash, where you can put it back. After 30 days it is erased for good (you can choose 7, 30 or 90 days under Instellingen > Bewaren), and you can empty the trash yourself at any time. Then a file's key is gone immediately, so it is unreadable; the file itself is removed afterwards. Expired documents (an old policy) can go to the trash by themselves after 6, 12 or 24 months, if you choose that; by default they stay.
- Deleting your account removes all your data at once, in every table. It is still in the server's backups until they expire: after 30 days at the latest it is gone everywhere. If a backup is restored in that time, deleted accounts are deleted again.
- Inactive accounts: after 24 months without use you get an e-mail; after 27 months the account is deleted, but never sooner than 30 days after that e-mail. If you sign in, the period starts again.
- An account that was never confirmed (the link in the first e-mail was not used) is deleted after 7 days, without an e-mail: the address may not even be yours.
- Logs are deleted after 30 days.
Your rights
You can view, correct and delete your data in the app itself. Under Account > Je gegevens you download everything RevDue keeps about you in one file (access and portability): your data as readable JSON and as CSV tables for Excel, your invoices, documents and photos, and your account details with the log of security events. For your protection it first asks for your password (and code) or passkey, and you get a mail afterwards. For any other question, or if you object to a processing: get in touch through the address above. If you are not satisfied with how RevDue handles your data, you can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.
Security and data breaches
RevDue protects your data with, among other things: separation per user in the database itself (Row Level Security), encryption with a key per user, keys in a separate key management service, two-step verification before you upload documents, and three checks before going live (own review, an independent review and an external penetration test). If something goes wrong anyway, RevDue reports it to the Autoriteit Persoonsgegevens within 72 hours and, if the risk to you is high, to you as well.