Privacy Policy

The controller responsible for processing personal data is:

Sudo Software

Legal form: SAS (French simplified joint-stock company)

Share capital: EUR 1,000

Registered office: 15 RUE DES HALLES, 75001 PARIS, FRANCE

Registration: RCS Paris, SIREN 902 520 188

Intra-EU VAT number: FR61902520188

Contact email: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @)

The data controller determines the purposes and means of the processing carried out as part of the DriveCost Monster service.

For any question relating to the protection of personal data, the user may contact the publisher at the following address: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @).

DriveCost Monster has not appointed a data protection officer (DPO) to date. For any request relating to personal data, the user may contact the publisher at the address indicated above.

DriveCost Monster is a service that allows users to prepare, generate, organize, and export mileage expense reports based on information entered by the user and, where applicable, on data from connected services such as a digital calendar.

In particular, the service may allow:

• the creation of a user account;
• the connection to one or more calendars;
• the analysis of professional appointments;
• the identification or entry of departure and arrival addresses;
• the calculation of trip distances;
• the generation of mileage expense reports;
• the export or download of documents;
• the management of the access years purchased;
• the sending of emails related to the operation of the service.

DriveCost Monster is not a substitute for a chartered accountant, a tax advisor, a lawyer, or a public authority. The user remains responsible for verifying the information contained in their reports.

Depending on how the service is used, DriveCost Monster may collect the following categories of data.

This data may include:

• first and last name;
• email address;
• user identifier;
• account creation date;
• account status;
• language, country, or currency preferences;
• login history and security information.

This data may include:

• the current plan;
• type of plan (free or paid);
• the access years purchased;
• the start and end dates of the access periods;
• payment history;
• invoices;
• promotional codes used;
• data needed to manage disputes, unpaid amounts, or refunds.

Payments may be processed by an external payment provider, for example Stripe. DriveCost Monster does not store full bank card numbers. Payment data is processed directly by the payment provider in accordance with its own security and privacy rules.

This data may include:

• vehicle type;
• fiscal horsepower or local equivalent;
• powertrain, for example combustion, electric, hybrid, or plug-in hybrid;
• country applicable to the calculation;
• scale or calculation method used;
• custom settings possibly entered by the user.

This data may include:

• trip dates;
• departure and arrival addresses or places;
• calculated or entered distances;
• estimated or calculated amount of the mileage expenses;

If the user connects a calendar, DriveCost Monster accesses only the following calendar data:

• the title or name of the events;
• the date and time of the events;
• the place or address of the events;
• the technical identifier of the event;
• the link to the original event in the calendar.

The technical identifier of the event also makes it possible to avoid reprocessing an event that has already been analyzed (duplicate prevention). Details of the use, sharing, and disclosure of data obtained from Google Calendar are set out in section "7. Calendar Connections, Authorizations, and Google Calendar and Microsoft Outlook Data".

DriveCost Monster aims to use calendar data solely to identify appointments likely to correspond to professional trips and to help the user prepare their mileage expense reports.

The user may be asked to check, correct, delete, or validate the detected events before they are included in a report.

This data may include:

• IP address;
• device type;
• operating system;
• browser;
• technical identifiers;
• connection logs;
• pages viewed;
• actions performed in the application;
• technical errors;
• performance and security data.

This data may include:

• messages sent to support;
• assistance requests;
• responses provided;
• communication preferences;
• consents or objections to marketing emails.

When the user subscribes to a newsletter, downloads content, creates an account, or agrees to receive communications, DriveCost Monster may process certain data for commercial prospecting purposes, in particular:

• email address;
• first and last name;
• prospect or customer status;
• country;
• language;
• email open or click history, where such data is collected;
• marketing segments related to the use of the service.

The user can unsubscribe from commercial communications at any time, in particular via the unsubscribe link in the relevant emails.

Usage journal, optional. If — and only if — the user has switched on the corresponding option from the "My account" page, DriveCost Monster records some of the actions they perform in the application. This data may include:

• the nature of the action performed, taken from a closed list;
• the date and time of the action;
• the internal identifier of the account;
• the internal identifiers of items already stored in the account, for example a trip or a vehicle;
• counters, for example the number of trips detected during a calendar scan;
• the names of the edited fields, excluding their values.

This collection is disabled by default and only takes place after explicit consent. It contains no private content from appointments and no other personal data. It is described in detail in the "Optional Usage Journal During the Beta Phase" section.

DriveCost Monster does not intend to collect sensitive data within the meaning of the regulations, such as data relating to health, political opinions, religious beliefs, trade union membership, racial or ethnic origin, or sexual life.

However, certain data may appear indirectly in the titles, descriptions, or locations of calendar events, if the user chooses to connect a calendar containing this type of information.

The user is encouraged not to connect a calendar containing sensitive information that is not necessary for the use of the service, or to delete/correct the relevant events before validation.

DriveCost Monster reserves the right to delete any data that is manifestly sensitive or not necessary for the operation of the service.

Personal data is processed for the following purposes.

Data is used to:

• create an account;
• enable connection to the service;
• secure access to the account;
• manage user preferences;
• prevent fraudulent access.

Data is used to:

• analyze potential appointments and trips;
• calculate distances;
• apply the relevant scales or calculation rules;
• generate mileage expense reports;
• enable the correction, validation, and export of data;
• retain the history useful for the operation of the account.

Data is used to enable connection to the supported external calendar services, namely Google Calendar and Microsoft Outlook.

Access to these services requires the user's prior authorization. The user may withdraw this authorization in accordance with the procedures provided by the third-party service or by DriveCost Monster where this option is available.

DriveCost Monster uses Google Maps Platform, via the Google Distance Matrix API, to calculate the driving distance and duration between the departure address and the arrival address of a trip.

The only data sent to this service is the departure and arrival addresses required for the calculation. The title, date, time, and identifier of calendar events are not sent to this service.

Data is used to:

• manage access to the free offer;
• open or withdraw access to a purchased year;
• process payments;
• issue invoices;
• manage refunds, unpaid amounts, and complaints;
• apply any promotional offers.

Data is used to:

• respond to user requests;
• send service emails;
• inform the user of important changes to the service;
• handle technical incidents;
• improve user support.

Data may be used to:

• understand the general use of the service;
• detect errors;
• improve usability;
• measure performance;
• prioritize developments;
• produce aggregated statistics.

As far as possible, these analyses are carried out on aggregated or pseudonymized data.

Where the user has expressly consented to it, and only in that case, DriveCost Monster additionally records some of their actions in a usage journal, in order to understand how the service is actually used, to identify the obstacles users run into, and to decide which improvements to make to the product during its beta phase. The legal basis for this processing is consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. This journal is described in the "Optional Usage Journal During the Beta Phase" section.

Data may be used to:

• detect fraudulent behavior;
• prevent abuse;
• protect the integrity of the service;
• retain evidence in the event of a dispute;
• comply with legal, accounting, or tax obligations;
• respond to a request from a competent authority.

Data may be used to:

• send information about DriveCost Monster;
• offer commercial deals;
• send usage tips;
• present new features;
• re-engage a user, for example at the end of an access year.

The user may object to these communications at any time.

Certain data is necessary to create an account, access the service, calculate mileage expenses, generate reports, manage the access years purchased, or comply with the publisher's legal obligations.

Where such data is mandatory, its absence may prevent access to all or part of the service.

The other data is optional. The user may choose not to provide it, but certain features may then be limited or unavailable.

Connecting a calendar is optional. However, without connecting a calendar, the user will have to manually enter the trips needed to generate their reports.

The usage journal offered during the beta phase is entirely optional and disabled by default. Not switching it on, or later withdrawing the authorization granted, has no consequence whatsoever: neither on access to the service, nor on the features available, nor on the price of the access years.

When the user chooses to connect a calendar, they authorize DriveCost Monster to access the data needed to identify appointments likely to generate a professional trip.

Calendar access is used solely within the scope of the service requested by the user.

DriveCost Monster does not resell calendar data and does not use it to display behavioral advertising.

Depending on the calendar provider used, the user can withdraw the access granted to DriveCost Monster:

• from the settings of their DriveCost Monster account, where this feature is available;
• from the settings of the relevant third-party service;
• by contacting DriveCost Monster support.

When calendar access is withdrawn, DriveCost Monster will no longer be able to synchronize future events. Data already included in reports or in the account history may nonetheless be retained for as long as necessary for the purposes set out in this policy.

This section specifies, in a dedicated manner, how DriveCost Monster uses, shares, and discloses the data obtained from Google Calendar when the user chooses to connect their Google account.

Categories of Google Calendar data accessed

When the user connects Google Calendar, DriveCost Monster accesses only the following data from the events of their primary calendar:

• the title or name of the event;
• the start and end date and time of the event;
• the place or address indicated in the event;
• the technical identifier of the event, used to link the trip to its source and to avoid reprocessing an event that has already been analyzed (duplicate prevention);
• the link to the original event in Google Calendar, so that the user can find the source event.

DriveCost Monster does not read the detailed description of events, nor the list of attendees, nor attachments.

Single purpose

This data is used for a single purpose: to identify appointments likely to generate a professional trip, propose the corresponding trips, calculate the associated distances, and allow the user to prepare or validate their mileage expense reports. It is not used for any other purpose.

Trips suggested from Google Calendar are provided as suggestions only. The user must check, correct, validate, or reject each proposed trip before it is included in a mileage expense report.

Recipients of Google Calendar data

Data obtained from Google Calendar is processed by DriveCost Monster on its hosting infrastructure, described in section "9. Data Transfers Outside the European Union", solely in order to provide this feature. It is stored in the service's database in the form of trips containing the date, the title, the departure and arrival addresses, the distance, and the identifier of the source event. It may also appear temporarily in the technical logs hosted on this same infrastructure, used solely to operate, diagnose, and secure the service.

Where necessary to calculate a route or a distance, only the departure and arrival addresses required for the calculation are sent to Google Maps Platform, via the Google Distance Matrix API. The title, date, time, and identifier of the event are not sent to this service.

Services that do not receive Google Calendar data

Data obtained from Google Calendar is not transmitted to any of the following services:

• the payment provider (Stripe);
• emailing providers;
• audience measurement or analytics tools;
• commercial partners, advertisers, and advertising networks;
• artificial intelligence tools or services.

DriveCost Monster does not sell, rent, publicly disclose, or use data obtained from Google Calendar for advertising, marketing, profiling, resale, data enrichment, or the training of artificial intelligence models.

Human access

No member of DriveCost Monster views the data obtained from Google Calendar, except where strictly necessary to respond to a support request initiated by the user, to ensure the security of the service, to prevent fraud, or to comply with a legal obligation. In such cases, access is limited to authorized personnel only and to the strictly necessary data only.

Withdrawal of access

The user may withdraw the access granted to DriveCost Monster at any time, either from the security settings of their Google account or from the settings of their DriveCost Monster account where this option is available. After access is withdrawn, DriveCost Monster no longer performs any future synchronization of Google Calendar events.

Compliance with the Google API Services User Data Policy

DriveCost Monster's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data obtained from Microsoft Outlook

When the user connects a Microsoft Outlook (Microsoft 365) calendar, DriveCost Monster accesses, through the Microsoft Graph API, the same categories of data as for Google Calendar, solely for the purpose described above:

• the title or name of the event;
• the start and end date and time of the event;
• the place or address indicated in the event;
• the technical identifier of the event, used to link the trip to its source and to avoid re-processing an already-analyzed event (duplicate prevention);
• the link to the original event in Microsoft Outlook, so that the user can find the source event.

DriveCost Monster does not read the detailed description of events, the list of attendees, or attachments.

Data obtained from Microsoft Outlook is processed, shared, and disclosed in exactly the same way as data obtained from Google Calendar: it is processed by DriveCost Monster on its own hosting infrastructure (see section "9. Data Transfers Outside the European Union"), and only the departure and arrival addresses needed for a distance calculation are sent to Google Maps Platform, through the Google Distance Matrix API. The title, date, time, and identifier of the event are not sent to this service. Human access to this data is limited under the same conditions described above for Google Calendar (user-initiated support requests, service security, fraud prevention, or legal obligations).

Data obtained from Microsoft Outlook is not shared with the payment provider (Stripe), emailing providers, audience-measurement or analytics tools, business partners, advertisers or ad networks, or any artificial-intelligence tool or service. DriveCost Monster does not sell, rent, publicly disclose, or use this data for advertising, marketing, profiling, resale, data enrichment, or training artificial-intelligence models.

The user may withdraw the access granted to DriveCost Monster at any time, either from the security settings of their Microsoft account or from their DriveCost Monster account settings where this option is available. After access is withdrawn, DriveCost Monster ends the associated Microsoft session, deletes the stored access tokens, and no longer performs any future synchronization of Microsoft Outlook events.

Information received from the Microsoft Graph API is used solely to provide this feature, in accordance with the applicable Microsoft API terms.

Data obtained from Google Calendar is accessible only to DriveCost Monster and to the providers explicitly identified in section "7. Calendar Connections, Authorizations, and Google Calendar and Microsoft Outlook Data", strictly to the extent necessary to provide the service. The general categories of providers listed below do not mean that each of them receives data obtained from Google Calendar.

Personal data may be accessible, within the limits of their respective roles, to the following persons and providers:

• the publisher of DriveCost Monster;
• staff responsible for customer support;
• staff responsible for technical maintenance;
• hosting providers;
• payment providers;
• emailing providers;
• route calculation, mapping, or geocoding providers;
• audience measurement or performance analytics tools;
• security, logging, or monitoring providers;
• the publisher's external advisors, such as a chartered accountant, lawyer, or statutory auditor, where necessary;
• administrative or judicial authorities, only where required or permitted by law.

Providers act, depending on the case, as processors, separate controllers, or joint controllers. DriveCost Monster takes care to select providers offering sufficient guarantees regarding the protection of personal data.

DriveCost Monster's main data is hosted on Google Cloud infrastructure located in a datacenter in Brussels, Belgium, within the European Union.

However, some providers used by DriveCost Monster, in particular for payment, emailing, analytics, mapping, or connected calendars, may process certain data outside the European Union, in particular when they are established in the United States or use international infrastructure.

In such cases, DriveCost Monster ensures that transfers are governed by appropriate safeguards, such as:

• an adequacy decision of the European Commission;
• standard contractual clauses;
• additional security measures;
• any other mechanism recognized by the applicable regulations.

The user may contact DriveCost Monster to obtain further information about the safeguards applicable to transfers of data concerning them.

DriveCost Monster keeps personal data only for as long as the purposes it is processed for require. The periods below describe how the service actually behaves.

While the account exists. Account data, vehicles, addresses, trips, payments and reports are kept for as long as the account exists. Users can correct or delete them at any time from the service, and delete their own account from the "My account" page.

What is erased when an account is deleted. Deletion is carried out immediately. The following is erased at once:

• the email address, replaced by a technical, non-deliverable identifier;
• the first name, last name, display name and profile picture;
• the access tokens for connected calendars, the access authorization being additionally revoked with Google and Microsoft;
• the payment provider customer and payment identifiers held by DriveCost Monster;
• every trip, vehicle, address, payment, support request and beta usage journal entry;
• the matching contact in the emailing tool, which is deleted.

What remains after deletion, and why. Deletion leaves behind a technical record stripped of everything that identifies a person, together with the matching authentication identity. That record is what stops a deleted account from signing up again straight away to obtain a fresh free plan. It contains:

• a one-way digest of the erased email address: an irreversible computation protected by a secret key held outside the database. It is not the address, and the address cannot be recovered from it. Its only use is to recognize a person who signs in again, so that their account is handed back to them instead of a new one being created;
• the authentication identity (the Firebase Authentication account behind the Google or Microsoft sign-in) and its technical identifier, which serve the same purpose: deleting them would hand back a brand-new identifier on the next sign-in;
• the history of access periods — start and end dates, free plan or year purchased — with no link to the payment provider, so that signing up again does not restart a fresh free plan;
• the account country and language, the display and notification preferences, and activity timestamps (last sign-in, first and last export, first and last calendar scan, first and last trip validation): once the identifying items above are erased, these no longer identify anyone and only serve as usage statistics.

These items are kept with no time limit. DriveCost Monster would rather state this than display a period it does not enforce: a digest that expired would defeat the safeguard entirely, since waiting would be enough to start over on a new free plan. This retention relies on the publisher’s legitimate interest in preventing abuse of its free plan. If the person signs in again, the digest is erased and the record becomes an ordinary active account.

Invoices and accounting records. Invoices, payments and refunds are issued and kept by the payment provider, for as long as its own legal and accounting obligations require. Deleting an account does not erase those documents, which answer a legal retention obligation; it erases the copy of the identifiers that linked them to the account at DriveCost Monster.

Technical and security logs. Logs produced by the service and by its hosting provider are kept for a limited period, set by the hosting configuration, solely for diagnostics, security and fraud prevention.

Beta usage journal. When the user has switched this optional journal on, its entries are kept for as long as the account exists: no automatic expiry is applied to them. Withdrawing the authorization immediately stops new entries from being recorded, but does not erase those already recorded; they are erased when the account is deleted, or earlier upon an erasure request sent to the publisher. This journal is described in detail in the "Optional Usage Journal During the Beta Phase" section.

Administration audit trail. Actions taken by the publisher on an account (suspension, reactivation, deletion, ban, commercial gestures, changes to the beta usage journal setting) are recorded in an append-only log, kept with no time limit for traceability and evidence. That log does not contain the email address of the account concerned, only its internal identifier.

Banned accounts. When an account is banned for abuse or for breaching the Terms of Service, the matching email address — or, if the account has already been deleted, its digest alone — is added to an exclusion list kept with no time limit, so that the banned identity cannot sign up again. Lifting the ban removes that entry.

How to exercise the right to erasure is set out in the "User Rights" section.

DriveCost Monster implements technical and organizational measures designed to protect personal data against loss, unauthorized access, disclosure, alteration, or destruction.

These measures may include:

• encryption of communications;
• access control;
• secure authentication;
• restriction of rights to authorized personnel only;
• logging of sensitive access and actions;
• backups;
• monitoring of technical incidents;
• security updates;
• contractual clauses with providers;
• internal incident management procedures.

Despite these measures, no computer system can guarantee absolute security. The user is also responsible for the confidentiality of their credentials and the security of their own device.

In the event of a personal data breach likely to create a risk to the rights and freedoms of the persons concerned, DriveCost Monster will take the necessary measures to limit the consequences of the incident.

Where required by regulation, DriveCost Monster will notify the breach to the competent supervisory authority and, if necessary, to the users concerned.

In accordance with the applicable regulations, the user has the following rights over their personal data:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to object;
• the right to restriction of processing;
• the right to data portability;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to define directives regarding the fate of their data after their death, where this right is applicable.

To exercise their rights, the user may contact DriveCost Monster at the following address: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @).

The user may also access certain data management features directly from the "My Account" page, in particular the account and data deletion procedure, as well as the data export procedure where available.

The request must specify the right being exercised and make it possible to identify the user concerned. In the event of reasonable doubt about the identity of the requester, DriveCost Monster may ask for additional information strictly necessary to verify their identity.

DriveCost Monster will respond within the time limits set by the applicable regulations.

If the user considers that their rights are not respected or that the processing of their personal data does not comply with the regulations, they may lodge a complaint with the competent supervisory authority.

In France, the competent authority is:

CNIL – Commission Nationale de l'Informatique et des Libertés

Website: www.cnil.fr

The user is nonetheless encouraged to contact DriveCost Monster beforehand in order to allow an amicable resolution of their request.

DriveCost Monster may use cookies or similar technologies on its website and application.

These trackers may serve various purposes:

• ensuring the technical operation of the service;
• maintaining the user session;
• remembering preferences;
• securing the service;
• measuring audience;
• analyzing performance;
• improving the user experience;
• carrying out marketing campaigns, only where the user has consented when such consent is required.

Cookies strictly necessary for the operation of the service may be placed without prior consent.

Non-essential cookies, in particular certain audience measurement, advertising, or marketing tracking cookies, are only placed with the user's consent where required by regulation.

DriveCost Monster provides a cookie management module. Google Analytics is only activated if the user accepts the relevant cookies or trackers through this module.

The user can change their choices at any time via the cookie management module or via their browser settings.

A separate cookie policy may specify the list of trackers used, their purposes, their retention periods, and the means to object to them.

DriveCost Monster may send two types of emails.

These emails are necessary for the operation of the service. They may concern:

• account creation;
• login;
• password recovery;
• the validation of an action;
• the purchase of an access year;
• billing;
• security alerts;
• important notifications related to the service.

The user cannot object to receiving emails strictly necessary for the operation of the service, other than by no longer using the service.

These emails may concern:

• usage tips;
• promotional offers;
• news;
• commercial follow-ups;
• educational content.

The user can unsubscribe at any time via the unsubscribe link in the emails or by contacting DriveCost Monster.

DriveCost Monster may use automated processing to analyze calendar data, identify probable trips, calculate distances, or generate reports.

The purpose of this processing is to assist the user in preparing their mileage expenses.

Unless stated otherwise, DriveCost Monster does not make automated decisions producing legal effects concerning the user or significantly affecting them without human intervention.

The user remains free to check, correct, exclude, or validate the generated trips and reports.

To date, DriveCost Monster does not use any external artificial intelligence service to process users' personal data.

DriveCost Monster may use conventional automated processing to analyze calendar data, identify probable trips, calculate distances, or generate reports. The purpose of this processing is to assist the user in preparing their mileage expenses.

The user's personal data is not resold and is not used to train third-party artificial intelligence models for general purposes.

In particular, data obtained from connected calendars (Google Calendar and Microsoft Outlook) is under no circumstances used to train artificial intelligence models, nor transmitted to a third-party artificial intelligence service.

Should DriveCost Monster subsequently use external artificial intelligence services involving personal data, this policy would be updated to inform users of the processing concerned, the providers used, and the applicable safeguards.

DriveCost Monster is primarily intended for individual use.

Each account corresponds to an identified user. Unless otherwise agreed in writing by the publisher, an account may not be shared between several people or used to manage the mileage expenses of several distinct users.

If DriveCost Monster subsequently offers plans intended for companies, associations, or organizations wishing to make the service available to several employees, collaborators, or members, specific terms may set out the respective roles of the organization and DriveCost Monster regarding data protection.

Depending on the case, the client organization could be the controller for its employees' data, and DriveCost Monster could act as a processor. These arrangements would need to be set out in a specific data processing agreement.

DriveCost Monster is not intended for minors.

The user declares that they have the legal capacity necessary to create an account and buy an access year.

If DriveCost Monster learns that an account has been created by a minor without valid authorization, the publisher may delete or suspend the account concerned.

The DriveCost Monster website or application may contain links to third-party sites or services.

DriveCost Monster is not responsible for the privacy practices of these third-party sites or services. The user is encouraged to review their respective privacy policies.

During the beta phase of the service, DriveCost Monster offers users the option of having some of the actions they perform in the application recorded in a usage journal. This processing is entirely optional and disabled by default on every account, existing and new alike: no action is recorded until the user has switched the corresponding option on themselves, from the "My account" page.

Legal basis. This processing relies exclusively on the user's consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. Without consent, no data is recorded in this journal.

Purpose. The usage journal serves only to understand how the service is actually used, to identify the steps where users run into difficulties, and to decide which improvements to make to the product. It is not used for advertising, commercial prospecting, profiling, resale or disclosure to third parties, nor to train artificial intelligence models.

What is recorded. Each journal entry contains only:

• the internal identifier of the account concerned;
• the nature of the action performed, taken from a closed list of actions defined by the service;
• the date and time of the action;
• a minimal context, limited to the internal identifiers of items already stored in the account (for example the identifier of a trip or of a vehicle), to counters (for example the number of trips detected during a calendar scan), to values taken from closed lists or to yes/no indicators (for example the calendar provider concerned, the status of a trip, the format of an export, or whether an export hid the amounts) and, when a record is edited, to the names of the edited fields only.

The actions that may be recorded fall into the following categories: creating, editing, deleting and changing the status of a trip; scanning a calendar, connecting and disconnecting a calendar; creating, editing, deleting a vehicle and changing the default vehicle; generating an export; editing the profile or preferences; granting and withdrawing the authorization itself; starting a payment, activating and withdrawing an access year; sending a support request.

What is not recorded. The journal contains no private content from appointments: neither the title or name, nor the description, nor the place, nor the list of attendees of a calendar event appears in it. More broadly, the context of the entries contains no personal data: no email address, no postal address, no name, no licence plate, no free-form text typed by the user, and not the values of the edited fields.

Where this data is stored. The usage journal is stored in the service database, on the hosting infrastructure described in the "Data Transfers Outside the European Union" section. It is not sent to the payment provider, to the emailing providers, to audience measurement or analytics tools, to any commercial partner, advertiser or advertising network, or to any artificial intelligence tool or service.

Withdrawing the authorization. The user may withdraw their authorization at any time, from the same "My account" page, without having to give a reason. From that point on, no new action is recorded. The withdrawal itself is recorded as the last entry in the journal, so that the date on which recording stopped remains verifiable.

What happens to entries already recorded. Withdrawing the authorization stops the recording, but does not erase the entries already recorded. They are kept for as long as the account exists, with no automatic expiry, and are erased when the account is deleted, together with the trips, vehicles, addresses, payments and support requests. A user who wishes to have those entries erased without waiting for their account to be deleted may request it, under their right to erasure, at the contact address given in the "User Rights" section.

Changes made to the setting by support. At the user's request, or in order to stop a recording immediately, DriveCost Monster support may switch this setting on or off from its administration tool. Every change made by support is recorded in the administration audit trail mentioned in the "Data Retention Periods" section, together with the identity of the person who made it, the previous and the new setting, the date and, where applicable, the reason entered by support. That reason is never added to the user's own usage journal.

This journal is specific to the beta phase of the service. Should DriveCost Monster decide to keep it beyond that phase, to broaden its content or to change its retention period, this policy would be updated and the user would be informed.

The DriveCost Monster website offers free calculators, for example the mileage-allowance simulator, the “company car or personal vehicle” comparator and the “buy or lease” comparator. These calculators work without an account and without an email address: the results appear on screen immediately and stay there whatever happens.

What is collected. Nothing is collected unless the user asks to receive the PDF report of their simulation. If they do, the following are recorded:

• the email address provided;
• the display language, which determines the language of the report;
• the calculator used, the parameters entered and the results displayed;
• the date and time of the request;
• the version of the consent wording displayed under the submit button.

Purposes. This data is used to send the requested PDF report, and then to send information about the product: new features, usage tips and commercial offers. It is neither sold, nor made available to advertisers or advertising networks, nor used to train artificial-intelligence models.

Legal basis. The user's consent, within the meaning of Article 6(1)(a) of the General Data Protection Regulation. That consent is given by the report request itself: the wording displayed under the submit button states explicitly that the email address will be kept in order to send this report and news about the product. The version of that wording is recorded with the request, so that the exact content of what was agreed to remains verifiable.

Recipients. This data is accessible to the publisher of DriveCost Monster and to its emailing provider, which sends the report and the information emails, under the conditions described in the “Recipients of the Data” section.

Retention period. Prospect data is kept until consent is withdrawn and, in any event, for no more than three years from the last contact initiated by the data subject, in line with the French data protection authority's recommendation on commercial prospecting. It is then deleted.

Unsubscribing. Every information email carries a one-click unsubscribe link. The user may also ask for their address to be deleted at the address given in the “Contact” section. Withdrawing consent stops the information emails; it does not affect reports already sent.

A report request does not create a user account and grants no access to the service. A user who subsequently creates an account is covered by the other sections of this policy.

DriveCost Monster may amend this privacy policy in order to take into account:

• changes to the service;
• technical changes;
• new providers used;
• legal or regulatory developments;
• the recommendations of the competent authorities.

In the event of a significant change, the user may be informed by any appropriate means, for example by email, in-app notification, or a notice on the website.

The applicable version is the one available on the website or in the application on the date of consultation.

For any question relating to this policy or to the protection of personal data, the user may contact DriveCost Monster:

Email: support--[@]--drivecost.monster (anti-spam display: please replace --[@]-- with an @)

Postal address: Sudo Software 15 RUE DES HALLES, 75001 PARIS, FRANCE