Privacy policy

1. Data controller

The data controller is BigRock srl, Via Giovanni Severano 15, 00161 Roma (RM), Italy, VAT/P.IVA 18101491001. Contact for any privacy matter: privacy@find-me.cloud.

2. Data we process

We do not collect contacts, advertising identifiers, or location when you are not sharing. We do not use your data for advertising or profiling and we do not sell it.

3. Purposes and legal bases

• Providing the service (account, groups, live location sharing, chat, notifications): performance of the contract with you, Art. 6(1)(b) GDPR. Location is collected only after you grant permission and press START, and stops when you press STOP SHARING, leave the group or delete your account.
• Email verification and security (confirmation codes, rate limiting, abuse prevention, banning accounts that break the Terms): legitimate interest in keeping the service secure, Art. 6(1)(f).
• Service statistics (aggregate counts such as number of users, groups and location updates per day): legitimate interest; the statistics are aggregated and do not identify you.
• Legal obligations (tax, accounting, requests from authorities): Art. 6(1)(c).

4. Who can see your data

• Group admins see the position, its age and accuracy, battery level and sharing status of every member of their group, and the chat according to the group's settings.
• Other members see your position only if the admin has enabled "Members can see each other". In "admin only" chat mode, your messages are visible only to the admins.
• Connected systems. A group admin may allow external software of their choice (for example a control-room or dispatch system) to read the group's positions, using the group ID and PIN. The admin can see and revoke these connections at any time. The organisation operating that software is responsible for its own processing.
• FindMe Super Admin (our staff) may access group data only for moderation, security and support.

5. Processors and transfers

We use the following providers, bound by data processing agreements:

• Cloudflare, Inc.: hosting, database, file storage and sending of verification emails.
• Expo (650 Industries, Inc.), Apple and Google: delivery of push notifications.
• Google Ireland Ltd. (Google Workspace): our support and privacy mailboxes.

Some providers may process data outside the European Economic Area. In that case transfers are covered by the EU–U.S. Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

6. Retention

• Location history (trail): deleted automatically after 24 hours. Your most recent position remains visible to your group until you leave it, it is deleted or you delete your account.
• Chat messages and media: until a group admin wipes the chat, the group is deleted, or (for media) the retention period of the group's plan expires, whichever comes first.
• Account: until you delete it (Settings → Delete account). Accounts whose email is never confirmed are deleted after 7 days.
• Sessions and verification codes: sessions expire after 90 days of inactivity; codes after 30 minutes.
• Technical logs: kept for a short period for security and troubleshooting, normally no more than 30 days.
• Data we must keep for legal reasons (e.g. invoices) is kept for the period required by law.

7. Your rights

You have the right to access, rectify and erase your data, to restrict or object to processing, and to data portability (Articles 15–22 GDPR). You can change your name and delete your account directly in the app. For any other request write to privacy@find-me.cloud; we reply within one month.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the authority of your country of residence.

8. Use by organisations and employers

FindMe is a coordination tool, not a tool for monitoring workers. When an organisation (an association, a company, a public body) uses FindMe to coordinate its volunteers, staff or contractors, that organisation decides why and how their positions are used and acts as an independent data controller for that purpose. It must inform the people concerned and comply with applicable law, including, in Italy, Article 4 of Law 300/1970 (Statuto dei Lavoratori). Members always start and stop sharing themselves.

9. Minimum age

FindMe is not intended for children. You must be at least 14 years old, or the higher age of digital consent in your country, to create an account. FindMe must not be used to locate minors.

10. Security

Data is encrypted in transit (HTTPS/TLS). Passwords and PINs are stored only as salted hashes. Access to live positions requires an authenticated session and group membership; media files are served through time-limited signed links.

11. Changes to this policy

We may update this policy. We will notify significant changes in the app or by email before they take effect. The date at the top shows the latest version.