This policy explains what personal information SPSV.IO collects, why we collect it, and what rights you have over it. It is written in plain language rather than legal shorthand.
1. Who we are
SPSV.IO is operated by Nasir Ahamed, a sole trader based at 8 Ellwood Park, Ballymakenny Road, Drogheda, Co. Louth, A92 K5KR, Ireland.
We provide an income and expense record-keeping application for taxi drivers and other self-employed people in Ireland. For the purposes of the General Data Protection Regulation and the Irish Data Protection Act 2018, we are the data controller for the information described here.
You can reach us at hello@spsv.io about anything in this policy.
2. What we collect
Information you give us
- When you register: your email address, first name, last name and a password. The password is stored only as a cryptographic hash - we cannot read it, and neither can anyone who obtains our database.
- Optionally, in your profile: your postal address, Eircode, PPS number and mobile number. These are not required to use the service. They exist so they can appear on your annual statement, which is the document you give to an accountant. You can leave them blank, and you can remove them at any time.
- Your records: the income and expense entries you create, including amounts, dates, categories and any notes or descriptions you add.
- If you contact us: your message and whatever you include in it.
Information collected automatically
- Sign-in and account activity: when you sign in, change your password, enable two-factor authentication, reset your data and similar events. Each record includes the time, your IP address and your browser or device description.
- Server logs: standard web server records of requests made to the service, including IP address, the page requested and the time.
- A session cookie: see our Cookie Policy.
- A notification token, if you allow notifications: your phone issues an identifier that lets a message reach that particular device. It identifies the device rather than you, and it is the only way a notification can be delivered. Turning notifications off for SPSV.IO in your phone's settings withdraws it.
What we do not collect
We do not collect your location. We do not use analytics or tracking of any kind. We do not show advertising, and we have no advertising partners. We do not access your contacts, photos, files, camera or microphone.
The mobile apps ask for two things: access to the internet, and permission to show notifications. Nothing else. If you unlock the app with Face ID or a fingerprint, that check is carried out by your phone and never leaves it - no biometric information reaches us, and none is stored by us.
3. How and why we use it
- To run the service - storing your entries, showing them back to you, and producing your reports and annual statement.
- To manage your account - signing you in, verifying your email address, and letting you reset a forgotten password.
- To keep the service secure - the activity log exists so that you can see sign-ins to your own account and notice anything you do not recognise. We also email you whenever your password is changed or reset.
- To answer you when you get in touch.
- To send you a notification, where you have allowed them - about your account, or about the service itself. We carry no advertising from anyone else.
- To meet our legal obligations, including keeping records of any payments for the period Irish tax law requires.
We do not use your information to profile you, to make automated decisions about you, or to market anything to you.
4. Legal basis
Under GDPR we must have a lawful basis for using your information. Ours are:
- Performance of a contract. Your entries, name, email address and account details are needed to provide the service you signed up for. This is our basis for most of what we hold.
- Legitimate interests. The activity log, server logs and rate limiting exist to keep accounts secure and the service working. We consider this proportionate: the data is minimal, retained briefly, and used for nothing else.
- Legal obligation. Records relating to payments, where Irish tax law requires us to keep them.
- Consent. The optional profile fields - address, Eircode, PPS number, mobile - are provided entirely at your choice, and you may remove them at any time. Notifications rest on consent as well: your phone asks before showing any, and turning them off in your phone's settings withdraws that consent.
5. Who we share it with
We do not sell your information. We do not share it for anyone else's purposes. It is not used for advertising.
Three service providers process data on our behalf, under contract and on our instructions only:
- Brevo (Sendinblue SAS, France) sends our emails - verification codes, password notifications and backup copies you request. They receive your email address and the message content.
- OVHcloud (France) hosts the server the service runs on, in their German datacentre.
- Google (Google Ireland Limited) delivers notifications to the mobile apps, through Firebase Cloud Messaging. It receives the notification token for your device and the text of the message being sent. It does not receive your name, your email address, or any of your records. On an iPhone or iPad the message travels its final step through Apple's Push Notification service, which is part of iOS.
We will also disclose information where the law requires it, such as a valid court order.
6. Where it is stored
Your account, your entries, and everything else you put into SPSV.IO are stored on a server in Limburg, Germany, operated by OVHcloud, a French company. Both the company holding that data and the country it sits in are subject to European data protection law.
Our email provider, Brevo, is a French company and also processes data within the EEA.
Notifications are the one exception, and it is worth being precise about it. They are delivered through Google's Firebase Cloud Messaging, which runs on Google's global infrastructure and may process your notification token outside the EEA, including in the United States. What crosses that border is the token for your device and the text of the notification - no entries, no name, no email address. Google is certified under the EU-US Data Privacy Framework, and the transfer is additionally covered by the European Commission's Standard Contractual Clauses. Google holds the token until it is deleted and removes it from its own systems within 180 days of that.
If you would rather nothing at all left the EEA, turn notifications off in your phone's settings. No token is issued and nothing is sent.
7. How long we keep it
- Your account and entries: for as long as your account is open. If you close it yourself, everything is held for 30 days and then permanently deleted - signing back in during those 30 days cancels the closure and restores all of it. See our deletion page.
- Activity log: for as long as your account is open, so you can review your own sign-in history.
- Automated backups: up to 30 days, after which they are deleted automatically.
- Server logs: up to 14 days.
- Email delivery records: up to 30 days, held by our email provider.
- Notification tokens: until you turn notifications off, sign out of that device, or the account closes. Google removes the token from its own systems within 180 days of our deleting it.
- Payment and invoicing records: for the period Irish tax law requires, currently six years.
8. Your rights
Under GDPR you have the right to:
- Access the information we hold about you. You can do this yourself at any time using Download my data or Email my data to me in your account.
- Correct anything inaccurate. Your profile is editable, and every entry can be changed.
- Delete your information. You can close the account yourself at any time, from My account › Danger zone in the app or on the web - see our deletion page.
- Restrict or object to how we use it.
- Portability - your backup file is a standard JSON file you can take elsewhere.
- Withdraw consent for the optional profile fields, by clearing them.
Email hello@spsv.io to exercise any of these. We will respond within one month.
If you are unhappy with how we have handled your information, you can complain to the Irish Data Protection Commission at dataprotection.ie, 21 Fitzwilliam Square South, Dublin 2, D02 RD28.
9. Security
- All traffic is encrypted in transit using TLS.
- Passwords are stored as salted hashes, never in a readable form.
- Two-factor authentication is available and we recommend enabling it.
- Sign-in attempts and verification codes are rate limited.
- We email you whenever your password is changed or reset, so an unauthorised change does not go unnoticed.
- You can see every significant action on your account in your activity log.
No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the Data Protection Commission as GDPR requires.
10. Children
SPSV.IO is intended for people aged 18 and over. It is a business record-keeping tool for licensed drivers, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.
11. Changes
If we change this policy we will update the date at the top and add a line to the list below. If a change materially affects how we use your information, we will tell you by email before it takes effect.
Revisions
- 6 October 2026 - notifications documented: the token your phone issues, Google as the provider that delivers them, and the transfer outside the EEA that involves. The 30-day grace period that now applies when you close your own account is set out in section 7.
Nasir Ahamed
8 Ellwood Park, Ballymakenny Road
Drogheda, Co. Louth, A92 K5KR
Ireland
hello@spsv.io