Ride Check privacy policy
This policy explains what personal data the Ride Check app uses, why, and what your rights are. Ride Check is made by East Hill Software Ltd ("we", "us").
1. Who we are
East Hill Software Ltd, 6A Breeds Place, Hastings, East Sussex TN34 3AA, United Kingdom. Email: hello@easthillsoftware.co.uk.
2. Two kinds of data, two roles
Ride Check is a tool for businesses that run amusement rides ("operators"). It handles two kinds of personal data:
- Your account data: the email address and password you use for cloud backup, and details of how you use the service. For this data, we are the controller.
- The records you keep in the app: ride checks, accident reports, staff training records, food hygiene records and sales. These records can include personal data about other people, such as your staff, injured guests and witnesses. For these records, your business is the controller and decides what is recorded and why. When those records are stored in our cloud backup, we are a processor acting on your instructions (see section 9).
3. What's saved on your phone
Ride Check works without an account. Everything you enter is saved on your phone first, including:
- your business name, rides, ADIPS IDs, DOC details and documents you add;
- daily check results, fault notes, wind readings and sign-off signatures;
- accident book entries: the injured person's name, home address, phone number, whether they're a guest, child or member of staff, what happened, the injury, first aid given, witness details and signatures;
- staff training records: staff names, roles, first aid certificate expiry dates, training given and signatures;
- food hygiene diary entries and sales (amounts, times and whether cash or card);
- photos you take or attach of faults and accidents.
If you don't turn on cloud backup, this data stays on your phone and we don't receive it.
4. Cloud backup (optional)
If you create an account and turn on cloud backup, we store your email address, a securely hashed password and a copy of your app records (section 3, except photos and PDF documents, which currently stay on your phone). This lets you restore your records on a new phone. Each account can only ever read its own records.
5. Card payments (optional)
If you take card payments in Ride Check, payments are processed by Stripe through your own Stripe account, set up with Stripe through Ride Check (Stripe Connect). Stripe collects the identity and bank details it needs to open your account and pay you, under the Stripe privacy policy. We store your Stripe account ID, your Stripe location ID and your business name so the app can take payments for you. We never see or store customers' full card numbers.
To take contactless payments on a phone, Stripe and the card networks require the phone's location while you're taking a payment. Ride Check only asks for location for this, and only while the app is open.
6. Other services the app contacts
- ADIPS (adipsdoc.co.uk): when you use ADIPS check, the app sends the ride's ADIPS ID to the ADIPS website to look up its public record.
- Open-Meteo (open-meteo.com): to show a wind forecast, the app sends the park's location (not your phone's location) to Open-Meteo.
- DOC reminders are scheduled on your phone. No data is sent to us for them.
7. Why we use your data, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating your account, backing up and restoring your records | Contract: to provide the service you asked for |
| Setting up and processing card payments with Stripe | Contract |
| Emails about your account, such as confirmation and password reset | Contract |
| Keeping the service secure and fixing problems | Legitimate interests |
| Keeping business and tax records | Legal obligation |
We don't sell your data, we don't use it for advertising, and the app has no advertising or analytics trackers.
8. Who we share data with
We use these service providers to run Ride Check:
- Supabase: cloud database and sign-in. Data is stored in the European Union (Ireland).
- Stripe: card payments, if you use them.
- Expo: the app framework and app updates. It doesn't receive your records.
- Apple and Google: app distribution and, where used, subscriptions through the App Store or Google Play.
Some of these providers are based in, or may access data from, the United States. Where that happens, transfers are protected by the UK International Data Transfer Addendum, the EU Standard Contractual Clauses or the UK–US data bridge. We may also share data if the law requires it.
9. For operators: our role as your processor
When your records are in our cloud backup, we process them only to store, back up and restore them for you, and on your documented instructions. We keep them confidential, protect them with appropriate security, use only the sub-processors listed in section 8 (and will tell you before adding new ones), help you respond to requests from the people in your records, tell you without undue delay about any personal data breach, and delete the records when you delete your account. Your business is responsible for having a lawful basis to record that data, for telling staff and guests how it's used, and for keeping accident records for as long as the law requires (for example, RIDDOR records must be kept for at least three years). Keep a backup or exported copy before you delete your account.
10. How long we keep data
- Account and cloud records: until you delete your account. They're then removed from our live systems straight away, and from any backups within 30 days.
- Inactive accounts: if an account hasn't been used for 3 years, we'll email you and then delete it if we don't hear back.
- Payment records: Stripe keeps its own records under its policy. We keep business and tax records for 6 years.
- Data on your phone stays until you delete it or uninstall the app.
11. Security
Data sent between the app and our servers is encrypted in transit. Cloud records are protected so that each account can only read its own data. Passwords are stored hashed, never in plain text. Photos and records on your phone are only as secure as the phone itself, so use a screen lock.
12. Your rights
You have the right to access, correct, delete, restrict or object to the use of your personal data, and to receive a copy of it in a portable format. You can delete your account and cloud data at any time from the app (see deleting your account). For anything else, email us.
If you're a staff member, guest or witness named in an operator's records, please contact that business first, because they control those records. We'll help them respond.
You can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), but please contact us first so we can try to put things right.
13. Children
Ride Check is for businesses and isn't meant for anyone under 18. Records about injured children are entered by the operator, who is responsible for them as controller.
14. Changes to this policy
We'll update this page if anything changes, and tell you in the app or by email if the change is significant.