Privacy

A vehicle position is personal data as soon as it can be linked to someone. Relay’s answer is not to blur positions — imprecision would destroy the usefulness of knowing which lane an obstacle is in. The answer is that Relay never stores a trajectory. Only isolated point events. There is no trace, so there is no journey to reconstruct.

The contract carries no vehicle identifier and no driver identifier at all. That is not pseudonymisation, it is absence, and absence is stronger.

Cudatus is the controller for the data described here. Registration details are on the legal notice.

Data-protection enquiries, including a data-processing agreement for your own review, reach a person at contact@cudatus.com.

• Organisation and contact details. The name of the organisation holding a key, and the name and email of the people we deal with there. Used to operate the account and to reach you about the service.
• API key metadata. A hash of the key, when it was issued, and which organisation it belongs to. The plaintext key is shown once at issue and is never stored.
• Console account data. Your email address, the one-time sign-in codes we send to it, a session cookie, TOTP enrolment secrets and recovery codes if you enable a second factor, the email addresses on invitations you send, and an append-only audit log that records account actions — a key issued, a member invited — with the email address of the person who acted. Used to authenticate people without a password, and to let an organisation reconstruct what happened in its own account.
• Event payloads.A type, a position or a road geometry, a severity, an optional road reference and an optional short free-text note. The wire carries no publisher identity at all — not the organisation’s real name, and not a derived pseudonym either. We hold the real organisation internally, for trust decisions and for billing; it is never returned in an API response.
• Technical logs. Request metadata including IP address, for security and for diagnosing faults.

• Vehicle trajectories or traces of any kind.
• Vehicle or driver identifiers — the contract has no field for one.
• Anything about individual road users. If a free-text note contains personal data, the publishing organisation put it there in breach of the terms; tell us and we will remove it.

Contract, for operating an account and providing the API. Legitimate interest, for security logging and for keeping the network free of false reports.

• Live events: until they expire. Each event type carries its own time to live, and the operational store deletes the event shortly after.
• Analytical copy:each state change is written to a warehouse when it happens, and kept for statistics and for measuring each partner’s contribution. Kept for the life of the network’s statistics and reviewed annually; a specific retention commitment can be agreed in your contract.
• Account and contact data: for the life of the relationship and the applicable limitation period afterwards.

Other participants see published events. No publisher identity travels with them at all — provenance is limited to whether an event came from a network participant or an ingested public feed. Our infrastructure providers process data on our instructions; the sub-processor list is available on request.

We do not sell personal data and we do not use it for advertising.

Where the GDPR applies you may request access, correction, erasure, restriction, portability, and object to processing based on legitimate interest. Write to contact@cudatus.com. You may also complain to your national supervisory authority — in France, the CNIL.