Privacy Policy

The controller responsible for processing personal data is:

Sudo Software

Legal form: SAS (French simplified joint-stock company)

Share capital: EUR 1,000

Registered office: 15 RUE DES HALLES, 75001 PARIS, FRANCE

Registration: RCS Paris, SIREN 902 520 188

Intra-EU VAT number: FR61902520188

Contact email: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @)

The data controller determines the purposes and means of the processing carried out as part of the DriveCost Monster service.

For any question relating to the protection of personal data, the user may contact the publisher at the following address: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @).

DriveCost Monster has not appointed a data protection officer (DPO) to date. For any request relating to personal data, the user may contact the publisher at the address indicated above.

DriveCost Monster is a service that allows users to prepare, generate, organize, and export mileage expense reports based on information entered by the user and, where applicable, on data from connected services such as a digital calendar.

In particular, the service may allow:

• the creation of a user account;
• the connection to one or more calendars;
• the analysis of professional appointments;
• the identification or entry of departure and arrival addresses;
• the calculation of trip distances;
• the generation of mileage expense reports;
• the export or download of documents;
• the management of the access years purchased;
• the sending of emails related to the operation of the service.

DriveCost Monster is not a substitute for a chartered accountant, a tax advisor, a lawyer, or a public authority. The user remains responsible for verifying the information contained in their reports.

Depending on how the service is used, DriveCost Monster may collect the following categories of data.

This data may include:

• first and last name;
• email address;
• user identifier;
• account creation date;
• account status;
• language, country, or currency preferences;
• login history and security information.

This data may include:

• the current plan;
• type of plan (free or paid);
• the access years purchased;
• the start and end dates of the access periods;
• payment history;
• invoices;
• promotional codes used;
• data needed to manage disputes, unpaid amounts, or refunds.

Payments may be processed by an external payment provider, for example Stripe. DriveCost Monster does not store full bank card numbers. Payment data is processed directly by the payment provider in accordance with its own security and privacy rules.

This data may include:

• vehicle type;
• fiscal horsepower or local equivalent;
• powertrain, for example combustion, electric, hybrid, or plug-in hybrid;
• country applicable to the calculation;
• scale or calculation method used;
• custom settings possibly entered by the user.

This data may include:

• trip dates;
• departure and arrival addresses or places;
• calculated or entered distances;
• estimated or calculated amount of the mileage expenses;

If the user connects a calendar, DriveCost Monster accesses only the following calendar data:

• the title or name of the events;
• the date and time of the events;
• the place or address of the events;
• the technical identifier of the event;
• the link to the original event in the calendar.

When the user connects an iCal calendar (Apple iCloud, Yahoo, Outlook.com or any published calendar), DriveCost Monster additionally stores, in encrypted form, the subscription link the user provided, together with the date of the last read of that link and, where applicable, a technical error code.

The technical identifier of the event also makes it possible to avoid reprocessing an event that has already been analyzed (duplicate prevention). Details of the use, sharing, and disclosure of data obtained from Google Calendar are set out in section "7. Calendar Connections, Authorizations, and Google Calendar, Microsoft Outlook and iCal Calendar Data".

DriveCost Monster aims to use calendar data solely to identify appointments likely to correspond to professional trips and to help the user prepare their mileage expense reports.

The user may be asked to check, correct, delete, or validate the detected events before they are included in a report.

Route-sheet documents uploaded by the user. When the user chooses to upload a route-sheet document (a route sheet, a visit schedule, a photo or a spreadsheet of appointments) in order to extract their trips from it, DriveCost Monster does not keep the document itself. The data kept is:

• for each stop read in the document: the date, the time, the address and, where the document shows one, the name of the place (facility, residence, building), together with a confidence level for the reading;
• the date shown on the document, where there is one;
• the name of the uploaded file, its format, its size and a technical fingerprint of the file (a one-way computation whose only use is to recognize a duplicate upload without a new analysis);
• the upload date, the number of stops read and the technical counters of the analysis (model used, volume processed).

No person's name and no medical, billing or payment information is extracted from the document. The details of this feature, of the provider used and of the applicable safeguards are set out in section "18. Route-Sheet Document Import and Use of an Artificial Intelligence Service".

This data may include:

• IP address;
• device type;
• operating system;
• browser;
• technical identifiers;
• connection logs;
• pages viewed;
• actions performed in the application;
• technical errors;
• performance and security data.

This data may include:

• messages sent to support;
• assistance requests;
• responses provided;
• communication preferences;
• consents or objections to marketing emails.

When the user subscribes to a newsletter, downloads content, creates an account, or agrees to receive communications, DriveCost Monster may process certain data for commercial prospecting purposes, in particular:

• email address;
• first and last name;
• prospect or customer status;
• country;
• language;
• email open or click history, where such data is collected;
• marketing segments related to the use of the service.

The user can unsubscribe from commercial communications at any time, in particular via the unsubscribe link in the relevant emails.

Usage journal, optional. If — and only if — the user has switched on the corresponding option from the "My account" page, DriveCost Monster records some of the actions they perform in the application. This data may include:

• the nature of the action performed, taken from a closed list;
• the date and time of the action;
• the internal identifier of the account;
• the internal identifiers of items already stored in the account, for example a trip or a vehicle;
• counters, for example the number of trips detected during a calendar scan;
• the names of the edited fields, excluding their values.

This collection is disabled by default and only takes place after explicit consent. It contains no private content from appointments and no other personal data. It is described in detail in the "Optional Usage Journal During the Beta Phase" section.

Anonymous usage statistics. Independently of that journal, the service records, for every user, anonymous usage events (nature of the action, screen concerned, outcome, counters, timestamp rounded to the minute) that carry no account identifier and no other data that could link an event to a person. Since they cannot identify anyone, they are not personal data; they are nonetheless described, for transparency, in the "Anonymous Usage Statistics" section.

DriveCost Monster does not intend to collect sensitive data within the meaning of the regulations, such as data relating to health, political opinions, religious beliefs, trade union membership, racial or ethnic origin, or sexual life.

However, certain data may appear indirectly in the titles, descriptions, or locations of calendar events, if the user chooses to connect a calendar containing this type of information.

The user is encouraged not to connect a calendar containing sensitive information that is not necessary for the use of the service, or to delete/correct the relevant events before validation.

DriveCost Monster reserves the right to delete any data that is manifestly sensitive or not necessary for the operation of the service.

The same applies to the route-sheet documents the user chooses to upload: they may concern third parties, for example the people visited during a professional round. The user is encouraged to upload only documents that contain neither a person's name nor medical information, such as a route sheet limited to the times and addresses of the visits. In any event, the instructions given to the analysis service forbid it to extract a name or any medical, billing or payment information, and the mandatory response format has no field that could receive them.

Personal data is processed for the following purposes.

Data is used to:

• create an account;
• enable connection to the service;
• secure access to the account;
• manage user preferences;
• prevent fraudulent access.

Data is used to:

• analyze potential appointments and trips;
• calculate distances;
• apply the relevant scales or calculation rules;
• generate mileage expense reports;
• enable the correction, validation, and export of data;
• retain the history useful for the operation of the account.

Data is used to enable connection to the supported external calendar services, namely Google Calendar and Microsoft Outlook.

Access to these services requires the user's prior authorization. The user may withdraw this authorization in accordance with the procedures provided by the third-party service or by DriveCost Monster where this option is available.

DriveCost Monster uses Google Maps Platform, via the Google Distance Matrix API, to calculate the driving distance and duration between the departure address and the arrival address of a trip.

The only data sent to this service is the departure and arrival addresses required for the calculation. The title, date, time, and identifier of calendar events are not sent to this service.

When the user uploads a route-sheet document, that document is sent to OpenAI, an automated document-analysis provider acting as a processor, for the sole purpose of extracting the list of stops (date, time, address, place name) and suggesting the matching trips to the user. This processing, described in section "18. Route-Sheet Document Import and Use of an Artificial Intelligence Service", is necessary for the performance of the service requested by the user (Article 6(1)(b) of the General Data Protection Regulation); it only takes place on the user's initiative, one document at a time.

Data is used to:

• manage access to the free offer;
• open or withdraw access to a purchased year;
• process payments;
• issue invoices;
• manage refunds, unpaid amounts, and complaints;
• apply any promotional offers.

Data is used to:

• respond to user requests;
• send service emails;
• inform the user of important changes to the service;
• handle technical incidents;
• improve user support.

Data may be used to:

• understand the general use of the service;
• detect errors;
• improve usability;
• measure performance;
• prioritize developments;
• produce aggregated statistics.

As far as possible, these analyses are carried out on aggregated or pseudonymized data.

Technical errors encountered by the service are sent to an error-monitoring provider, so that they can be detected and fixed quickly. This processing relies on the publisher’s legitimate interest in keeping the service working properly and securely (Article 6(1)(f) of the General Data Protection Regulation). It is described in the "Technical Error Monitoring" section.

Where the user has expressly consented to it, and only in that case, DriveCost Monster additionally records some of their actions in a usage journal, in order to understand how the service is actually used, to identify the obstacles users run into, and to decide which improvements to make to the product during its beta phase. The legal basis for this processing is consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. This journal is described in the "Optional Usage Journal During the Beta Phase" section.

The anonymous usage statistics described in the "Anonymous Usage Statistics" section serve the same purpose of improving the service, but without any identifier: they involve no personal data and, for that reason, require no consent.

For the same purpose, DriveCost Monster produces aggregated statistics on accounts, from data it already holds to run the service: it counts, for example, how many accounts that signed up in a given month validated a first trip within the following week. This processing relies on the publisher’s legitimate interest in measuring and improving its service (Article 6(1)(f) of the General Data Protection Regulation). It collects no new data, produces only counts free of any identifier, and leads to no decision concerning any user. It is described in the "Anonymous Usage Statistics" section.

Data may be used to:

• detect fraudulent behavior;
• prevent abuse;
• protect the integrity of the service;
• retain evidence in the event of a dispute;
• comply with legal, accounting, or tax obligations;
• respond to a request from a competent authority.

Data may be used to:

• send information about DriveCost Monster;
• offer commercial deals;
• send usage tips;
• present new features;
• re-engage a user, for example at the end of an access year.

The user may object to these communications at any time.

Certain data is necessary to create an account, access the service, calculate mileage expenses, generate reports, manage the access years purchased, or comply with the publisher's legal obligations.

Where such data is mandatory, its absence may prevent access to all or part of the service.

The other data is optional. The user may choose not to provide it, but certain features may then be limited or unavailable.

Connecting a calendar is optional. However, without connecting a calendar, the user will have to manually enter the trips needed to generate their reports.

The usage journal offered during the beta phase is entirely optional and disabled by default. Not switching it on, or later withdrawing the authorization granted, has no consequence whatsoever: neither on access to the service, nor on the features available, nor on the price of the access years.

When the user chooses to connect a calendar, they authorize DriveCost Monster to access the data needed to identify appointments likely to generate a professional trip.

Calendar access is used solely within the scope of the service requested by the user.

DriveCost Monster does not resell calendar data and does not use it to display behavioral advertising.

Depending on the calendar provider used, the user can withdraw the access granted to DriveCost Monster:

• from the settings of their DriveCost Monster account, where this feature is available;
• from the settings of the relevant third-party service;
• by contacting DriveCost Monster support.

When calendar access is withdrawn, DriveCost Monster will no longer be able to synchronize future events. Data already included in reports or in the account history may nonetheless be retained for as long as necessary for the purposes set out in this policy.

This section specifies, in a dedicated manner, how DriveCost Monster uses, shares, and discloses the data obtained from Google Calendar when the user chooses to connect their Google account.

Categories of Google Calendar data accessed

When the user connects Google Calendar, DriveCost Monster accesses only the following data from the events of their primary calendar:

• the title or name of the event;
• the start and end date and time of the event;
• the place or address indicated in the event;
• the technical identifier of the event, used to link the trip to its source and to avoid reprocessing an event that has already been analyzed (duplicate prevention);
• the link to the original event in Google Calendar, so that the user can find the source event.

DriveCost Monster does not read the detailed description of events, nor the list of attendees, nor attachments.

Single purpose

This data is used for a single purpose: to identify appointments likely to generate a professional trip, propose the corresponding trips, calculate the associated distances, and allow the user to prepare or validate their mileage expense reports. It is not used for any other purpose.

Trips suggested from Google Calendar are provided as suggestions only. The user must check, correct, validate, or reject each proposed trip before it is included in a mileage expense report.

Recipients of Google Calendar data

Data obtained from Google Calendar is processed by DriveCost Monster on its hosting infrastructure, described in section "9. Data Transfers Outside the European Union", solely in order to provide this feature. It is stored in the service's database in the form of trips containing the date, the title, the departure and arrival addresses, the distance, and the identifier of the source event. It may also appear temporarily in the technical logs hosted on this same infrastructure, used solely to operate, diagnose, and secure the service.

Where necessary to calculate a route or a distance, only the departure and arrival addresses required for the calculation are sent to Google Maps Platform, via the Google Distance Matrix API. The title, date, time, and identifier of the event are not sent to this service.

Services that do not receive Google Calendar data

Data obtained from Google Calendar is not transmitted to any of the following services:

• the payment provider (Stripe);
• emailing providers;
• audience measurement or analytics tools;
• commercial partners, advertisers, and advertising networks;
• artificial intelligence tools or services.

DriveCost Monster does not sell, rent, publicly disclose, or use data obtained from Google Calendar for advertising, marketing, profiling, resale, data enrichment, or the training of artificial intelligence models.

Human access

No member of DriveCost Monster views the data obtained from Google Calendar, except where strictly necessary to respond to a support request initiated by the user, to ensure the security of the service, to prevent fraud, or to comply with a legal obligation. In such cases, access is limited to authorized personnel only and to the strictly necessary data only.

Withdrawal of access

The user may withdraw the access granted to DriveCost Monster at any time, either from the security settings of their Google account or from the settings of their DriveCost Monster account where this option is available. After access is withdrawn, DriveCost Monster no longer performs any future synchronization of Google Calendar events.

Compliance with the Google API Services User Data Policy

DriveCost Monster's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained from Microsoft Outlook

When the user connects a Microsoft Outlook (Microsoft 365) calendar, DriveCost Monster accesses, through the Microsoft Graph API, the same categories of data as for Google Calendar, solely for the purpose described above:

• the title or name of the event;
• the start and end date and time of the event;
• the place or address indicated in the event;
• the technical identifier of the event, used to link the trip to its source and to avoid re-processing an already-analyzed event (duplicate prevention);
• the link to the original event in Microsoft Outlook, so that the user can find the source event.

DriveCost Monster does not read the detailed description of events, the list of attendees, or attachments.

Data obtained from Microsoft Outlook is processed, shared, and disclosed in exactly the same way as data obtained from Google Calendar: it is processed by DriveCost Monster on its own hosting infrastructure (see section "9. Data Transfers Outside the European Union"), and only the departure and arrival addresses needed for a distance calculation are sent to Google Maps Platform, through the Google Distance Matrix API. The title, date, time, and identifier of the event are not sent to this service. Human access to this data is limited under the same conditions described above for Google Calendar (user-initiated support requests, service security, fraud prevention, or legal obligations).

Data obtained from Microsoft Outlook is not shared with the payment provider (Stripe), emailing providers, audience-measurement or analytics tools, business partners, advertisers or ad networks, or any artificial-intelligence tool or service. DriveCost Monster does not sell, rent, publicly disclose, or use this data for advertising, marketing, profiling, resale, data enrichment, or training artificial-intelligence models.

The user may withdraw the access granted to DriveCost Monster at any time, either from the security settings of their Microsoft account or from their DriveCost Monster account settings where this option is available. After access is withdrawn, DriveCost Monster ends the associated Microsoft session, deletes the stored access tokens, and no longer performs any future synchronization of Microsoft Outlook events.

Information received from the Microsoft Graph API is used solely to provide this feature, in accordance with the applicable Microsoft API terms.

iCal calendars (Apple iCloud, Yahoo, Outlook.com and any published calendar)

The user may also connect a calendar by providing, themselves, the iCalendar subscription link (an address starting with "webcal://" or "https://") made available by their calendar provider, for example Apple iCloud, Yahoo or Outlook.com. In that case no authorization is requested from the provider: the link itself grants read-only access to the calendar's content. The user is invited to treat it as confidential information; they may disable or regenerate it at any time with their provider.

This link is stored encrypted in the service's database. It is never displayed in clear text after being saved, never shared with a third party, and never written to the technical logs. At connection time, then on every scan requested by the user or triggered when the application opens, DriveCost Monster's servers read the feed published at that address and retain only the categories of data described above for Google Calendar (title, dates and times, location, technical identifier of the event). The feed itself is not kept. DriveCost Monster never writes to the calendar: reading is strictly one-way.

Data obtained from an iCal calendar is processed, shared and disclosed exactly like data obtained from Google Calendar and Microsoft Outlook, with the same limits on human access. The service additionally keeps the date of the last read of the feed and, where applicable, a technical error code (for example "link unreachable"), so as to tell the user that the link needs checking; the content of the provider's error response is not kept.

The user may disconnect this calendar at any time from their DriveCost Monster account settings: the subscription link is then deleted immediately and the feed is no longer read. The link is also deleted when the account is deleted. Trips already created from this calendar remain subject to the retention periods described in section "10. Data Retention Periods".

The route-sheet document import, described in section "18. Route-Sheet Document Import and Use of an Artificial Intelligence Service", is a feature separate from connected calendars: only the documents the user uploads for that purpose are sent to the document-analysis provider. Data obtained from Google Calendar, Microsoft Outlook and iCal calendars is never sent to it.

Data obtained from Google Calendar is accessible only to DriveCost Monster and to the providers explicitly identified in section "7. Calendar Connections, Authorizations, and Google Calendar, Microsoft Outlook and iCal Calendar Data", strictly to the extent necessary to provide the service. The general categories of providers listed below do not mean that each of them receives data obtained from Google Calendar.

Personal data may be accessible, within the limits of their respective roles, to the following persons and providers:

• the publisher of DriveCost Monster;
• staff responsible for customer support;
• staff responsible for technical maintenance;
• hosting providers;
• payment providers;
• emailing providers;
• route calculation, mapping, or geocoding providers;
• the automated document-analysis provider (artificial intelligence service), solely for the route-sheet documents the user uploads themselves;
• Google, through Google Analytics, for audience measurement and the analysis of usage journeys on the website and in the application, only after the matching cookies have been accepted (see the "Cookies and Other Trackers" section);
• security, logging, or monitoring providers, including Sentry for technical error monitoring (see the "Technical Error Monitoring" section);
• the publisher's external advisors, such as a chartered accountant, lawyer, or statutory auditor, where necessary;
• administrative or judicial authorities, only where required or permitted by law.

Providers act, depending on the case, as processors, separate controllers, or joint controllers. DriveCost Monster takes care to select providers offering sufficient guarantees regarding the protection of personal data.

The anonymous usage statistics and the aggregated statistics on accounts described in the "Anonymous Usage Statistics" section contain no personal data. The usage events themselves are passed to no provider other than the service’s hosting provider. Only aggregated statistics, never an individual event, are additionally sent to the artificial intelligence provider mentioned above, OpenAI, to derive product-improvement reports from them. Only the publisher consults these statistics and reports.

DriveCost Monster's main data is hosted on Google Cloud infrastructure located in a datacenter in Brussels, Belgium, within the European Union. The anonymous usage statistics described in the "Anonymous Usage Statistics" section are recorded on that same infrastructure as well, then kept in an analytics warehouse hosted on the same Google Cloud infrastructure in Belgium; the usage events themselves do not leave that infrastructure.

However, some providers used by DriveCost Monster, in particular for payment, emailing, audience measurement (Google Analytics, on the website as in the application), mapping, or connected calendars, may process certain data outside the European Union, in particular when they are established in the United States or use international infrastructure.

In such cases, DriveCost Monster ensures that transfers are governed by appropriate safeguards, such as:

• an adequacy decision of the European Commission;
• standard contractual clauses;
• additional security measures;
• any other mechanism recognized by the applicable regulations.

The provider that analyzes route-sheet documents, OpenAI, is a company established in the United States. For this processing, DriveCost Monster uses a project configured for data residency in Europe and the European endpoint of that service: the uploaded documents are processed on infrastructure located in the European Union, and the option not to store the responses is enabled on every request. This processing is governed by the data processing agreement entered into with that provider, which incorporates the European Commission's standard contractual clauses for any access to the data from a third country. The same project is used, under the same conditions, for the analysis of aggregated statistics described in the "Anonymous Usage Statistics" section, which contain no personal data.

The technical error-monitoring provider, Sentry (Functional Software, Inc.), is a company established in the United States. DriveCost Monster uses an account configured for data residency in the European Union: the errors sent are stored on infrastructure located in Frankfurt, Germany. Any access to that data from a third country is governed by the data processing agreement entered into with that provider, which incorporates the European Commission's standard contractual clauses.

The user may contact DriveCost Monster to obtain further information about the safeguards applicable to transfers of data concerning them.

DriveCost Monster keeps personal data only for as long as the purposes it is processed for require. The periods below describe how the service actually behaves.

While the account exists. Account data, vehicles, addresses, trips, payments and reports are kept for as long as the account exists. Users can correct or delete them at any time from the service, and delete their own account from the "My account" page.

What is erased when an account is deleted. Deletion is carried out immediately. The following is erased at once:

• the email address, replaced by a technical, non-deliverable identifier;
• the first name, last name, display name and profile picture;
• the access tokens for connected calendars and, where applicable, the iCal subscription link, the access authorization being additionally revoked with Google and Microsoft;
• the payment provider customer and payment identifiers held by DriveCost Monster;
• every trip, vehicle, address, payment, support request and beta usage journal entry;
• the route-sheet import records, including any extracted stops not yet imported;
• the matching contact in the emailing tool, which is deleted.

What remains after deletion, and why. Deletion leaves behind a technical record stripped of everything that identifies a person, together with the matching authentication identity. That record is what stops a deleted account from signing up again straight away to obtain a fresh free plan. It contains:

• a one-way digest of the erased email address: an irreversible computation protected by a secret key held outside the database. It is not the address, and the address cannot be recovered from it. Its only use is to recognize a person who signs in again, so that their account is handed back to them instead of a new one being created;
• the authentication identity (the Firebase Authentication account behind the Google sign-in, the Microsoft sign-in or the email-and-password sign-in) and its technical identifier, which serve the same purpose: deleting them would hand back a brand-new identifier on the next sign-in;
• the history of access periods — start and end dates, free plan or year purchased — with no link to the payment provider, so that signing up again does not restart a fresh free plan;
• the account country and language, the display and notification preferences, and activity timestamps (last sign-in, first and last export, first and last calendar scan, first and last trip validation): once the identifying items above are erased, these no longer identify anyone and only serve as usage statistics.

These items are kept with no time limit. DriveCost Monster would rather state this than display a period it does not enforce: a digest that expired would defeat the safeguard entirely, since waiting would be enough to start over on a new free plan. This retention relies on the publisher’s legitimate interest in preventing abuse of its free plan. If the person signs in again, the digest is erased and the record becomes an ordinary active account.

Invoices and accounting records. Invoices, payments and refunds are issued and kept by the payment provider, for as long as its own legal and accounting obligations require. Deleting an account does not erase those documents, which answer a legal retention obligation; it erases the copy of the identifiers that linked them to the account at DriveCost Monster.

Route-sheet documents. The uploaded file is never kept: it is processed in memory for the duration of the analysis, then disappears with it. The extracted stops are kept while the user reviews them, until they import them or abandon the import, and for thirty days after the upload at most: past that period, an extraction that was not imported is deleted automatically, as is the result of a failed or abandoned analysis. Upon import, the stops are erased from the import record and become trips, subject to the retention rules for trips described above. The import record itself (file name, technical fingerprint, format, size, upload date, number of stops and technical counters of the analysis) is kept for as long as the account exists, so that the monthly upload cap works and the same document is never analyzed twice; it is erased together with the account.

Technical and security logs. Logs produced by the service and by its hosting provider are kept for a limited period, set by the hosting configuration, solely for diagnostics, security and fraud prevention. Technical errors sent to the error-monitoring provider, described in the "Technical Error Monitoring" section, are kept by that provider for ninety days at most, then deleted automatically.

Beta usage journal. When the user has switched this optional journal on, each entry is kept for twelve months from the time it is recorded, then deleted automatically. Withdrawing the authorization immediately stops new entries from being recorded, but does not erase those already recorded; they are erased at the end of that period, when the account is deleted if that happens first, or upon an erasure request sent to the publisher. This journal is described in detail in the "Optional Usage Journal During the Beta Phase" section.

Anonymous usage statistics. The anonymous usage events described in the "Anonymous Usage Statistics" section are kept for ninety days in the service database, and for thirteen months at most, from the time they are recorded, in the analytics warehouse, then deleted automatically. The aggregated statistics computed from these events and from the accounts, which relate to no person, are kept with no time limit. As neither these events nor these statistics are attached to any account, account deletion does not concern them: there is nothing to erase there.

Administration audit trail. Actions taken by the publisher on an account (suspension, reactivation, deletion, ban, commercial gestures, changes to the beta usage journal setting) are recorded in an append-only log, kept with no time limit for traceability and evidence. That log does not contain the email address of the account concerned, only its internal identifier.

Banned accounts. When an account is banned for abuse or for breaching the Terms of Service, the matching email address — or, if the account has already been deleted, its digest alone — is added to an exclusion list kept with no time limit, so that the banned identity cannot sign up again. Lifting the ban removes that entry.

How to exercise the right to erasure is set out in the "User Rights" section.

DriveCost Monster implements technical and organizational measures designed to protect personal data against loss, unauthorized access, disclosure, alteration, or destruction.

These measures may include:

• encryption of communications;
• access control;
• secure authentication;
• restriction of rights to authorized personnel only;
• logging of sensitive access and actions;
• backups;
• monitoring of technical incidents;
• security updates;
• contractual clauses with providers;
• internal incident management procedures.

Despite these measures, no computer system can guarantee absolute security. The user is also responsible for the confidentiality of their credentials and the security of their own device.

In the event of a personal data breach likely to create a risk to the rights and freedoms of the persons concerned, DriveCost Monster will take the necessary measures to limit the consequences of the incident.

Where required by regulation, DriveCost Monster will notify the breach to the competent supervisory authority and, if necessary, to the users concerned.

In accordance with the applicable regulations, the user has the following rights over their personal data:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to object;
• the right to restriction of processing;
• the right to data portability;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to define directives regarding the fate of their data after their death, where this right is applicable.

To exercise their rights, the user may contact DriveCost Monster at the following address: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @).

The user may also access certain data management features directly from the "My Account" page, in particular the account and data deletion procedure, as well as the data export procedure where available.

The request must specify the right being exercised and make it possible to identify the user concerned. In the event of reasonable doubt about the identity of the requester, DriveCost Monster may ask for additional information strictly necessary to verify their identity.

DriveCost Monster will respond within the time limits set by the applicable regulations.

If the user considers that their rights are not respected or that the processing of their personal data does not comply with the regulations, they may lodge a complaint with the competent supervisory authority.

In France, the competent authority is:

CNIL – Commission Nationale de l'Informatique et des Libertés

Website: www.cnil.fr

The user is nonetheless encouraged to contact DriveCost Monster beforehand in order to allow an amicable resolution of their request.

DriveCost Monster may use cookies or similar technologies on its website and application.

These trackers may serve various purposes:

• ensuring the technical operation of the service;
• maintaining the user session;
• remembering preferences;
• securing the service;
• measuring audience;
• analyzing performance;
• improving the user experience;
• carrying out marketing campaigns, only where the user has consented when such consent is required.

Cookies strictly necessary for the operation of the service may be placed without prior consent.

Non-essential cookies, in particular certain audience measurement, advertising, or marketing tracking cookies, are only placed with the user's consent where required by regulation.

Google Analytics, on the website and in the application. DriveCost Monster uses Google Analytics to measure the audience of its website and of its application, and to analyze usage journeys and behaviors: pages viewed and, in the application, actions performed (for example validating a trip or starting a calendar scan), as events described by their nature alone and by counters, with no personal data and no account identifier. Google Analytics is only activated if the user accepts the matching cookies through the consent banner shown during their visit; until they accept, no audience measurement tracker is placed and no data is sent to Google. On the website, a refusal is not stored in a cookie: the question may be asked there again on a later visit. In the application, a refusal is stored under the conditions described below.

On the website as in the application, this banner is only shown on the production version of the service: the test and development environments load no audience measurement tool and place no consent cookie.

Storing and withdrawing consent. The user’s choice is stored in a cookie named "drivecost_consent", valid for one year and placed for the whole drivecost.monster domain. That cookie records the acceptance given on the website or in the application, as well as the refusal expressed from the application. Because it is placed for the whole domain, the stored choice applies to the website as to the application: an acceptance given on the website applies to the application, and a refusal stored from the application also applies to the website. The user can change their mind at any time, in either direction:

• from the application, through the "Manage cookies" link on the "My account" page, which reopens the banner: refusing stops Google Analytics, deletes the "_ga" cookies placed by Google and stores that refusal for one year; accepting switches it back on. In both cases, the choice applies to the website as to the application;
• from the website, which has no such module, by deleting the cookies of the drivecost.monster domain from their browser settings, which erases the stored choice and ends audience measurement until a new acceptance;
• at any time, by configuring their browser, or a browser extension, to block audience measurement tools.

The anonymous usage statistics described in the "Anonymous Usage Statistics" section rely on no cookie and do not depend on this consent.

A separate cookie policy may specify the list of trackers used, their purposes, their retention periods, and the means to object to them.

DriveCost Monster may send two types of emails.

These emails are necessary for the operation of the service. They may concern:

• account creation;
• login;
• password recovery;
• the validation of an action;
• the purchase of an access year;
• billing;
• security alerts;
• important notifications related to the service.

The user cannot object to receiving emails strictly necessary for the operation of the service, other than by no longer using the service.

These emails may concern:

• usage tips;
• promotional offers;
• news;
• commercial follow-ups;
• educational content.

The user can unsubscribe at any time via the unsubscribe link in the emails or by contacting DriveCost Monster.

DriveCost Monster may use automated processing to analyze calendar data, read the route-sheet documents uploaded by the user and extract stops from them, identify probable trips, calculate distances, or generate reports.

The purpose of this processing is to assist the user in preparing their mileage expenses.

Unless stated otherwise, DriveCost Monster does not make automated decisions producing legal effects concerning the user or significantly affecting them without human intervention.

The product-improvement reports produced by an artificial intelligence service from aggregated statistics, described in the "Anonymous Usage Statistics" section, concern no individual user and lead to no decision concerning them.

The user remains free to check, correct, exclude, or validate the stops extracted from a document, the generated trips and the reports.

DriveCost Monster lets the user upload a route-sheet document — a route sheet or visit schedule exported from their scheduling software, a photo of such a document, or a spreadsheet of appointments — in order to extract the ordered list of stops and suggest the matching trips. This feature relies on an external artificial intelligence service. This section describes specifically what is sent, to whom, what DriveCost Monster keeps and for how long.

What is sent

When the user uploads a document, it is sent as is to the analysis provider, for the duration of a single analysis: a PDF file or an image (JPEG, PNG, WebP) is sent in full; a spreadsheet (XLSX, CSV) is sent as text, line by line. The file name is not sent: a neutral name is substituted for it. The provider reads the whole document; the instructions it is given require it to return only the stops — date, time, address and place name — and forbid it to return a person's name, initials, a phone number, an email address, a date of birth, a social security number, medical or care information, or billing or payment information. The mandatory response format has no field that could receive such information.

Each document is analyzed only once: a document uploaded again unchanged, after a successful first analysis, is recognized by its technical fingerprint and is not sent to the provider again.

To whom

The provider is OpenAI, acting as a processor of DriveCost Monster, on its instructions and for its sole account. DriveCost Monster uses a project configured for data residency in Europe and the European endpoint of the service: the documents are processed on infrastructure located in the European Union. The documents and the data extracted from them are not used by this provider to train or improve its models. On every request, DriveCost Monster asks that the generated response not be stored by the provider; the data sent may nevertheless be retained temporarily by the provider, for a maximum of thirty days, solely for abuse-detection purposes, unless a zero data retention agreement has been entered into with that provider. The safeguards governing this processing are set out in section "9. Data Transfers Outside the European Union".

What DriveCost Monster keeps

DriveCost Monster never keeps the uploaded document: it is processed in memory for the duration of the analysis and is stored neither on a disk, nor in a database, nor in a storage space. DriveCost Monster keeps only the result of the analysis, that is, for each stop, the date, the time, the address and, where the document shows one, the name of the place, together with a confidence level for the reading; to which are added the date shown on the document, the file name, its format, its size, a technical fingerprint of the file, the upload date, the number of stops read and the technical counters of the analysis. No person's name and no medical information is kept.

Duration

The extracted stops are kept while the user reviews them, until import or abandonment, and for thirty days after the upload at most; an extraction that was not imported is deleted automatically at the end of that period. Upon import, the stops are erased from the import record and become trips of the account, subject to the retention rules for trips described in section "10. Data Retention Periods". The import record is kept for as long as the account exists and is erased together with it.

Purpose and legal basis

The sole purpose of this processing is to suggest to the user, from the document they uploaded, the trips of a round to check, correct and validate: the extracted stops are provided as suggestions, and the user reviews and validates each stop before import, then each trip before it is included in a report. It only takes place on the user's initiative, one document at a time. Its legal basis is the performance of the service requested by the user (Article 6(1)(b) of the General Data Protection Regulation). DriveCost Monster uses this provider for no other processing of personal data, and sends it neither the account data, nor the calendar data, nor the user's trips, vehicles or addresses. The only other use it makes of it concerns aggregated statistics, free of any personal data, described in the "Anonymous Usage Statistics" section.

Third-party data and the user's responsibility

A route-sheet document may contain data relating to third parties, for example the addresses of the people visited by a healthcare professional during their round. The user uploads only documents they are entitled to process, and the processing of that third-party data falls under their professional responsibility, including informing the data subjects where required. They are encouraged to upload only documents that contain neither a person's name nor medical information, such as a route sheet limited to the times and addresses of the visits; where their scheduling software allows it, they favor an export limited to that information alone.

Human access

No member of DriveCost Monster views the content of the uploaded documents, which are not kept. The extracted stops are only viewed under the conditions described for calendar data in section "7. Calendar Connections, Authorizations, and Google Calendar, Microsoft Outlook and iCal Calendar Data" (support at the user's request, security of the service, fraud prevention or legal obligation). The technical logs of this feature contain neither the document, nor the extracted addresses, nor the file name.

Outside this feature

Outside the route-sheet document import, DriveCost Monster does not use any external artificial intelligence service to process users' personal data. It does, however, have the same provider analyze, under the same conditions, aggregated statistics that contain no personal data, described in the "Anonymous Usage Statistics" section. The conventional automated processing described in section "17. Automated Decision-Making" (analysis of calendar data, identification of probable trips, calculation of distances, generation of reports) is carried out by DriveCost Monster on its own infrastructure. The user's personal data is not resold and is not used to train artificial intelligence models, whether by DriveCost Monster or by its providers. In particular, data obtained from connected calendars (Google Calendar and Microsoft Outlook) is under no circumstances sent to an artificial intelligence service. Should DriveCost Monster use another artificial intelligence service involving personal data, or extend its use of this one, this policy would be updated before it goes live, to inform users of the processing concerned, the providers used and the applicable safeguards.

DriveCost Monster is primarily intended for individual use.

Each account corresponds to an identified user. Unless otherwise agreed in writing by the publisher, an account may not be shared between several people or used to manage the mileage expenses of several distinct users.

If DriveCost Monster subsequently offers plans intended for companies, associations, or organizations wishing to make the service available to several employees, collaborators, or members, specific terms may set out the respective roles of the organization and DriveCost Monster regarding data protection.

Depending on the case, the client organization could be the controller for its employees' data, and DriveCost Monster could act as a processor. These arrangements would need to be set out in a specific data processing agreement.

DriveCost Monster is not intended for minors.

The user declares that they have the legal capacity necessary to create an account and buy an access year.

If DriveCost Monster learns that an account has been created by a minor without valid authorization, the publisher may delete or suspend the account concerned.

The DriveCost Monster website or application may contain links to third-party sites or services.

DriveCost Monster is not responsible for the privacy practices of these third-party sites or services. The user is encouraged to review their respective privacy policies.

During the beta phase of the service, DriveCost Monster offers users the option of having some of the actions they perform in the application recorded in a usage journal. This processing is entirely optional and disabled by default on every account, existing and new alike: no action is recorded until the user has switched the corresponding option on themselves, from the "My account" page.

Legal basis. This processing relies exclusively on the user's consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. Without consent, no data is recorded in this journal.

Purpose. The usage journal serves only to understand how the service is actually used, to identify the steps where users run into difficulties, and to decide which improvements to make to the product. It is not used for advertising, commercial prospecting, profiling, resale or disclosure to third parties, nor to train artificial intelligence models.

What is recorded. Each journal entry contains only:

• the internal identifier of the account concerned;
• the nature of the action performed, taken from a closed list of actions defined by the service;
• the date and time of the action;
• a minimal context, limited to the internal identifiers of items already stored in the account (for example the identifier of a trip or of a vehicle), to counters (for example the number of trips detected during a calendar scan), to values taken from closed lists or to yes/no indicators (for example the calendar provider concerned, the status of a trip, the format of an export, or whether an export hid the amounts) and, when a record is edited, to the names of the edited fields only.

The actions that may be recorded fall into the following categories: creating, editing, deleting and changing the status of a trip; scanning a calendar, connecting and disconnecting a calendar; creating, editing, deleting a vehicle and changing the default vehicle; generating an export; editing the profile or preferences; granting and withdrawing the authorization itself; starting a payment, activating and withdrawing an access year; sending a support request.

What is not recorded. The journal contains no private content from appointments: neither the title or name, nor the description, nor the place, nor the list of attendees of a calendar event appears in it. More broadly, the context of the entries contains no personal data: no email address, no postal address, no name, no licence plate, no free-form text typed by the user, and not the values of the edited fields.

Where this data is stored. The usage journal is stored in the service database, on the hosting infrastructure described in the "Data Transfers Outside the European Union" section. It is not sent to the payment provider, to the emailing providers, to audience measurement or analytics tools, to any commercial partner, advertiser or advertising network, or to any artificial intelligence tool or service. Nor is it used to compute the aggregated statistics described in the "Anonymous Usage Statistics" section.

Withdrawing the authorization. The user may withdraw their authorization at any time, from the same "My account" page, without having to give a reason. From that point on, no new action is recorded. The withdrawal itself is recorded as the last entry in the journal, so that the date on which recording stopped remains verifiable.

What happens to entries already recorded. Withdrawing the authorization stops the recording, but does not erase the entries already recorded. Each entry is kept for twelve months from the time it is recorded, then deleted automatically; it is erased earlier if the account is deleted, together with the trips, vehicles, addresses, payments and support requests. A user who wishes to have those entries erased without waiting for their account to be deleted may request it, under their right to erasure, at the contact address given in the "User Rights" section.

Changes made to the setting by support. At the user's request, or in order to stop a recording immediately, DriveCost Monster support may switch this setting on or off from its administration tool. Every change made by support is recorded in the administration audit trail mentioned in the "Data Retention Periods" section, together with the identity of the person who made it, the previous and the new setting, the date and, where applicable, the reason entered by support. That reason is never added to the user's own usage journal.

This journal is specific to the beta phase of the service. Should DriveCost Monster decide to keep it beyond that phase, to broaden its content or to change its retention period, this policy would be updated and the user would be informed.

To understand how the service is actually used and decide which improvements to make, DriveCost Monster records, on its own servers, anonymous usage events when certain actions are performed in the application: for example creating, validating or deleting a trip, starting a calendar scan, connecting or disconnecting a calendar, generating an export, uploading a route sheet, opening a payment or completing the onboarding.

What is recorded. Each event contains only:

• the nature of the action, chosen from a closed list of actions defined by the service, the functional area concerned and the application screen where it takes place, identified by its name and never by its address;
• the outcome of the action (success, failure, cancellation), its duration and, in the event of a failure, a technical error code chosen from a closed list;
• the date and time of the action, rounded to the minute, so as to limit any cross-matching with other logs;
• minimal context, limited to counters (for example the number of trips detected during a calendar scan) and to values taken from closed lists (for example the calendar provider concerned or the format of an export);
• the application version, the environment (test or production) and the component the event comes from (application or server);
• a yes/no flag indicating that the action comes from an internal account of the publisher (test or administration account), so that such actions can be excluded from the statistics: it is set by the server when the event is recorded and comes with no identifier;
• a random identifier specific to the event, whose only use is to avoid counting it twice;
• where applicable, a random session key, generated by the browser and kept only in the session memory of the open tab: it is renewed with every new session, is never derived from an account identifier, is never stored together with one and is never matched against the IP address or any other log. Its only use is to reconstruct the sequence of actions within one session, without making it possible to link that session to a person.

What is not recorded. These events contain no account or user identifier, no email address, no IP address, no browser fingerprint, no postal address, no appointment content and no identifier of any object in the account (trip, vehicle, address). No cross-matching is possible with the user’s account, with the usage journal described in the previous section or with the service’s technical logs.

Nature of this data. Since they cannot identify anyone, directly or indirectly, these events are not personal data. Recording them therefore depends on no consent, is carried out for every user, on the free plan as on an annual licence, and cannot be switched off from the account. It is used neither for advertising, nor for commercial prospecting, nor for profiling, nor for training artificial intelligence models. The events themselves are passed to no provider other than the service’s hosting provider.

Retention. Each event is kept for ninety days in the service database. A daily copy is loaded into an analytics warehouse, hosted on the same Google Cloud infrastructure in Belgium, where each event is kept for thirteen months at most from the time it is recorded, then deleted automatically. The aggregated statistics computed from these events and from the accounts (for example a number of actions per day or a number of accounts per sign-up month) are kept with no time limit, in order to follow how the service evolves over time; they relate to no person. Deleting the account has no effect on these events and statistics, which are not attached to it.

Aggregated statistics on accounts. Since the events carry no identifier, they cannot tell, for example, how many new users come back a month later. To measure this, DriveCost Monster computes every day, on its own servers, counts per sign-up month from data the service already holds on accounts: sign-up date, sign-in method, onboarding progress, dates of the first validated trip and of the last sign-in, free plan or annual licence, connected calendar provider and country. No new data is collected for this, and the optional usage journal is not used. Only counts come out of this computation — for example the number of accounts that validated a first trip within the week following their sign-up — with no identifier; any group of fewer than five accounts is merged into another or removed, so that no result can relate to a person. The publisher’s internal accounts are excluded. This processing relies on the publisher’s legitimate interest in measuring and improving its service (Article 6(1)(f) of the General Data Protection Regulation); it leads to no decision concerning any user, and the user may object to it under the conditions set out in the "User Rights" section.

Analysis by an artificial intelligence service. To produce product-improvement reports, DriveCost Monster has an OpenAI artificial intelligence model analyze aggregated statistics computed from these events and from the accounts: counts, rates, median durations or sequences of actions observed across several sessions. No individual event, no identifier, no personal data, no appointment content, no address and no entry from the optional usage journal is sent; any result covering fewer than five accounts or sessions is masked before sending. The processing uses the project described in section "18. Route-Sheet Document Import and Use of an Artificial Intelligence Service", configured for data residency in Europe and the European endpoint of the service. The statistics sent, which contain no personal data, are not used by this provider to train or improve its models. On every request, DriveCost Monster asks that the generated response not be stored by the provider; the data sent may nevertheless be retained temporarily by the provider, for a maximum of thirty days, solely for abuse-detection purposes, unless a zero data retention agreement has been entered into with that provider. The resulting reports are internal: only the publisher consults them, from its administration tool. They concern no individual user and lead to no decision concerning them.

What this processing is not. It is distinct from the optional usage journal described in the "Optional Usage Journal During the Beta Phase" section, which is attached to the account identifier, is only fed with the user’s consent and serves support purposes. It is also distinct from Google Analytics, described in the "Cookies and Other Trackers" section, which relies on cookies placed with the user’s consent and sends data to Google.

To detect and fix malfunctions quickly, DriveCost Monster sends the technical errors encountered by its server and its application to an error-monitoring provider, Sentry (Functional Software, Inc.), acting as a processor. Only errors are sent: on the server side, only internal errors and unexpected shutdowns of the service. No user journey, no performance measurement and no session recording is sent.

What is sent. For each error, only:

• the type of the error, its technical message and the program’s execution trace at the moment it occurred;
• where applicable, the response code and the service’s technical error code;
• the request method and the path of the address called or of the page displayed, without the parameters that may follow it;
• the environment (test or production) and the version of the service;
• when the user is signed in, the technical identifier of their account, and no other data about them.

What is never sent. The content of requests and responses, headers, cookies, address parameters, email addresses, names, postal addresses, licence plates, access tokens, the IP address, and the history of the browsing or actions that preceded the error.

Location and retention. Errors are stored in the provider’s European Union region, in Frankfurt (Germany), and kept for ninety days at most, then deleted automatically. As the provider is established in the United States, the applicable safeguards are set out in section "9. Data Transfers Outside the European Union".

Legal basis. This processing relies on the publisher’s legitimate interest in keeping the service working properly and securely (Article 6(1)(f) of the General Data Protection Regulation). It serves diagnostics only: not advertising, commercial prospecting, profiling, or training artificial intelligence models. Deleting the account does not erase errors already sent, which carry only the technical identifier of the account and disappear at the end of their retention period.

The DriveCost Monster website offers free calculators, for example the mileage-allowance simulator, the “company car or personal vehicle” comparator and the “buy or lease” comparator. These calculators work without an account and without an email address: the results appear on screen immediately and stay there whatever happens.

What is collected. Nothing is collected unless the user asks to receive the PDF report of their simulation. If they do, the following are recorded:

• the email address provided;
• the display language, which determines the language of the report;
• the calculator used, the parameters entered and the results displayed;
• the date and time of the request;
• the version of the consent wording displayed under the submit button.

Purposes. This data is used to send the requested PDF report, and then to send information about the product: new features, usage tips and commercial offers. It is neither sold, nor made available to advertisers or advertising networks, nor used to train artificial-intelligence models.

Legal basis. The user's consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. That consent is given by the report request itself: the wording displayed under the submit button states explicitly that the email address will be kept in order to send this report and news about the product. The version of that wording is recorded with the request, so that the exact content of what was agreed to remains verifiable.

Recipients. This data is accessible to the publisher of DriveCost Monster and to its emailing provider, which sends the report and the information emails, under the conditions described in the “Recipients of the Data” section.

Retention period. Prospect data is kept until consent is withdrawn and, in any event, for no more than three years from the last contact initiated by the data subject, in line with the French data protection authority's recommendation on commercial prospecting. It is then deleted.

Unsubscribing. Every information email carries a one-click unsubscribe link. The user may also ask for their address to be deleted at the address given in the “Contact” section. Withdrawing consent stops the information emails; it does not affect reports already sent.

A report request does not create a user account and grants no access to the service. A user who subsequently creates an account is covered by the other sections of this policy.

DriveCost Monster may amend this privacy policy in order to take into account:

• changes to the service;
• technical changes;
• new providers used;
• legal or regulatory developments;
• the recommendations of the competent authorities.

In the event of a significant change, the user may be informed by any appropriate means, for example by email, in-app notification, or a notice on the website.

The applicable version is the one available on the website or in the application on the date of consultation.

For any question relating to this policy or to the protection of personal data, the user may contact DriveCost Monster:

Email: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @)

Postal address: Sudo Software 15 RUE DES HALLES, 75001 PARIS, FRANCE