Privacy Policy (GDPR / DSGVO)

1. Data Controller (Art. 4 No. 7, Art. 13(1)(a) GDPR)

FahrAura Sinsheimer Str. 56, 68239 Mannheim, Germany Email: support@fahraura.com Authorized Representative: FahrAura Operations Team

2. Categories of Data Processed & Purposes (Art. 13(1)(c) GDPR)

• GPS & Telemetry Data: Precise location coordinates, speed, acceleration, and bearing are recorded solely during active passenger car (Class B) driving sessions to detect faults, calculate exam readiness, and display route maps. • Account Data: User ID, email, and optional profile handle via Firebase Authentication. Anonymous guest mode is supported with no email or name required. • In-App Purchases & Minutes: Practice minute balances and purchase receipt tokens. Payments are handled exclusively by the Apple App Store and Google Play Store; FahrAura never collects or stores credit card numbers or banking data. • Community & Support: Forum posts, comments, likes, and glitch reports submitted voluntarily. AI-assisted automated filters may review content for safety and moderation. • Security & Technical Diagnostics: Device model, OS version, Firebase App Check attestation tokens, and error diagnostics to protect system integrity and prevent fraudulent use.

3. Legal Bases for Processing (Art. 6(1) GDPR)

• Art. 6(1)(b) GDPR (Contract Performance): Processing telemetry, account management, and practice minute delivery to provide core app features. • Art. 6(1)(a) GDPR (Consent): Foreground and background GPS telemetry collection is conducted exclusively upon your explicit permission granted in your device settings. Consent can be revoked at any time pursuant to Art. 7(3) GDPR. • Art. 6(1)(f) GDPR (Legitimate Interests): Platform security, abuse prevention, and fraud mitigation (Firebase App Check and community safety).

4. Subprocessors & Data Transfers (Art. 28, Art. 44 et seq. GDPR)

We partner with trusted service providers under GDPR Data Processing Agreements (Art. 28 GDPR): • Google Ireland Ltd. / Google LLC: Firebase Authentication, Cloud Firestore, Firebase App Check, Firebase Crashlytics (stability diagnostics and crash logs), and Vertex AI (Gemini for anonymized driving feedback and moderation). US transfers are secured via the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). • RevenueCat, Inc.: Management of in-app purchase validation and minute balance entitlements. • Map Tile & Routing Providers: Stadia Maps, HERE Technologies, and TomTom (routing queries and map tiles via pseudonymized, encrypted requests). • FahrAura contains no advertising SDKs, tracking pixels, or cross-app ad tracking.

5. Local Device Storage (§ 25(2) No. 2 TDDDG)

FahrAura stores offline map tiles, settings, and session caches locally on your device (SQLite / SharedPreferences / LocalStorage) strictly for technically necessary operations. No advertising cookies or persistent cross-service tracking IDs are used.

6. Data Retention & Account Deletion (Art. 13(2)(a), Art. 17 GDPR)

• Driving telemetry remains linked to your profile until you delete it. • Trashed practice drives are permanently erased after 7 days (168 hours). • You can permanently delete your entire account and all associated telemetry at any time within the app (Profile -> Delete Everything). Deletion is immediate and irreversible.

7. Your Rights as a Data Subject (Art. 15–21 GDPR)

As a data subject, you have the following statutory rights under the GDPR: • Right of Access (Art. 15 GDPR) • Right to Rectification (Art. 16 GDPR) • Right to Erasure (Art. 17 GDPR) • Right to Restriction of Processing (Art. 18 GDPR) • Notification Obligation regarding rectification, erasure, or restriction (Art. 19 GDPR) • Right to Data Portability (Art. 20 GDPR) • Right to Object (Art. 21 GDPR) • Right to Withdraw Consent at any time with future effect (Art. 7(3) GDPR) • Right to Lodge a Complaint with a Supervisory Authority (Art. 77 GDPR) The competent supervisory authority for FahrAura is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI BW) Lautenschlagerstraße 20, 70173 Stuttgart Website: https://www.baden-wuerttemberg.datenschutz.de

8. AI Advisory Notice & EU AI Act Disclosure (Art. 22 GDPR)

• Nature of the AI System: FahrAura's AI Coach, fault analysis, and exam readiness estimates are powered by machine learning and large language models (Google Gemini / Vertex AI). The AI retrospectively synthesizes telemetry captured during your drive into educational suggestions. • Scope Restricted to Passenger Cars (Class B) & No Substitute for Instruction: Calibrated strictly for passenger cars (Class B / PKW up to 3.5t). It does NOT apply to trucks (Class C/CE) or buses (Class D). The AI is a digital study aid, NOT a certified driving instructor, licensed driving school, or official examiner. • Probabilistic Outputs & Potential Inaccuracies: Generative AI outputs are probabilistic and may contain inaccuracies. Always consult a qualified human instructor. • Absolute Precedence of Road Traffic Regulations: Real-world road traffic rules (StVO), traffic lights, physical road signs, and police instructions ALWAYS take absolute precedence over any AI tip or score. • In-Vehicle Safety & Distraction Prohibition: AI feedback is designed strictly for review before or after a drive. Never interact with the app while operating a motor vehicle (§ 23 StVO). • No Guarantee of Examination Success: Scores are non-binding estimates. FahrAura provides no guarantee of passing the official practical driving test (TÜV/DEKRA). • Exclusion of Liability: To the extent permitted by law, FahrAura disclaims all liability for traffic infractions, fines, accidents, or exam failures arising from reliance on AI-generated advice.