Privacy Policy

Effective: 29 December 2025

Last Updated: 29 December 2025

V0.5

1. Introduction

New Roads Collective Limited (“NR”, “we”, “us”, “our”) is committed to protecting your privacy and handling your personal information responsibly and transparently.

This Privacy Policy, which forms part of our agreed Terms with every User of the website and/or Service, explains how we collect, use, store, share, and protect personal data when you use our web application, AI road trip planner, or other related services (together, the “Service”). It also explains your rights under data protection law. The definitions in the Terms are adopted here.

NR is the data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 and other applicable European data protection laws.

“Personal Data” means any information relating to an identified or identifiable individual, including name, address, email address, phone number, car information, and road trip history.

Our contact details are:

New Roads Collective Limited

85 Great Portland Street, First Floor, London, United Kingdom, W1W 7LT

Email: [email protected]

New Roads Collective Limited is registered with the UK Information Commissioner’s Office (ICO) under registration number ZC042965.

2. The Personal Data we collect

We collect and process the following categories of Personal Data:

Identity and contact data: such as name, address, email address, phone number.
Vehicle information: make, model, and year of your car(s) stored in your garage (the NR Garage feature).
Account and subscription data: login credentials, account type (Guest Account, Trail Account or Subscription Account), payment status.
Trip history and itinerary data: including User Content, AI chat inputs, trip preferences, generated itineraries, and related AI Outputs. AI prompts and responses (“AI Inputs” and “AI Outputs”) may be transmitted through third-party APIs for processing. NR does not use these for profiling or decision-making about individuals.
Technical information: device type, browser, IP address (including IP tracking to prevent circumvention of Free use limits), and analytics data to maintain security and performance;
Payment data: payment transactions are processed securely by Stripe. NR does not store full payment card details.
Marketing preferences: your consent choices regarding marketing from NR and our approved partners.
Usage Data: including communication records and preferences; approximate location data (IP-based) to maintain security, improve route relevance and mapping accuracy.

Personal Data may be anonymised at any time at NR’s discretion.

3. How we use your Personal Data

We use the Personal Data we collect for the purposes described below. Each use of Personal Data must have a lawful basis under the UK General Data Protection Regulation (UK GDPR). The table below explains these purposes, the lawful basis that applies, the types of Personal Data involved, and how long we normally keep that information.

Purpose of processing	Lawful basis for processing	Personal Data typically used	How long we keep it
Creating and managing your Account – To register you as a user, verify your identity, and maintain your profile.	Performance of a contract – Article 6(1) (b) UK GDPR.	Name, email address, login credentials, subscription details, device identifiers.	While your Account is active + up to 12 months for audit, billing, or dispute resolution.
Providing and improving the Service – To generate itineraries, routes, and recommendations using AI tools and mapping integrations, and to analyse how users engage with the Service.	Legitimate interests – Article 6(1)(f) UK GDPR – to operate and improve our Service in a way that does not override your rights or freedoms.	Trip information, preferences, AI Inputs and Outputs, User Content, technical and usage data.	AI User Content inputs are processed transiently and anonymised after one year following account termination.
Customer support and communication – To respond to queries, provide updates, and handle complaints.	Performance of a contract – Article 6(1) (b).	Contact details, communication history, account information.	Retained for the duration of the query and anonymised after one year following account termination.
Marketing and newsletters – To send updates, offers, or newsletters you have opted in to receive.	Consent – Article 6(1) (a) and Regulation 22 of the Privacy and Electronic Communications Regulations 2003 (PECR).	Name, email address, marketing preferences.	Until you withdraw consent or unsubscribe.
Legal, regulatory, and security purposes – To comply with legal obligations, enforce our Terms, prevent fraud, and maintain network and information security.	Legal obligation – Article 6(1)(c) and legitimate interests – Article 6(1)(f).	Account and transaction records, audit logs, system activity data.	As required by law or regulatory retention periods (normally 6 years for accounting records).

NR uses your Personal Data to provide, maintain, and improve the Service, generate and personalise AI-powered road trip itineraries, manage your account and subscription, and communicate with you about service updates or issues. We may contact you by email, phone, or text message for service-related purposes such as account management, security updates, or subscription notices.

If you have opted in to marketing communications, NR and its approved partners may also contact you about offers, updates, or events. You can withdraw marketing consent at any time by emailing [email protected].

We do not intentionally collect special-category data (for example, health, ethnicity, or religious information). If you choose to include such information in your User Content or communications with us, it will be deleted once identified.

We do not use your Personal Data for automated decision-making or profiling that produces legal or significant effects.

4. Lawful bases for processing

We rely on the following lawful bases under UK GDPR:

Performance of a contract – where processing is necessary to deliver the Service and manage your account.
Legitimate interests – including service improvement, analytics, fraud and abuse prevention; and AI Tool model training (in anonymised form).
Consent – where required for marketing communications or optional features.
Legal obligation – to comply with laws or respond to lawful requests.
Special-category – NR does not intentionally collect special-category Personal Data (e.g., health, race, religion). If Users include such data in User Content, NR will delete it once identified.

5. Data sharing and third parties

We only share Personal Data with trusted third-party service providers who process limited Personal Data on our behalf under strict contractual safeguards, to support the operation of the Service, sponsorship, advertising, or events only where NR has a lawful basis under the.

These include:

OpenAI API – to generate AI Outputs based on your User Content;
Google Maps – for route visualisation and export functionality;
Stripe – for secure payment processing;
Mailchimp – for sending service and marketing communications;
Hetzner – for secure cloud hosting within the EU;
Google Analytics – for website and app performance monitoring.

All third parties are required to protect your Personal Data in accordance with UK GDPR and may not use it for their own purposes. Each third-party processor acts only on NR’s documented instructions under a written DPA meeting UK GDPR Article 28. Please read the privacy policy of each third party where you are entering your own Personal Data which shall apply and keep inputs of Personal Data limited to what is necessary for the Services.

6. International transfers

Your Personal Data is primarily stored in European data centres (Hetzner). Where our third-party partners transfer such data outside the UK or EEA (e.g., OpenAI or Stripe), NR ensures appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office. Where SCCs apply, NR uses the UK International Data Transfer Addendum (IDTA) or UK Addendum to the EU SCCs approved by the ICO (2022). In the case of transfers to USA, the Data Processor may be self certified pursuant to the data privacy framework.

7. Data retention

We retain User account Personal Data for a minimum of one (1) year after account termination, unless a longer period is required for legal, accounting, or dispute-resolution or other legitimate purposes, and may retain anonymised data for longer including to support analytics, AI training, learning, and system improvement. Personal Data may also be retained where necessary for compliance, fraud prevention, or marketing insights.

8. Your rights

You have the following rights under data protection law:

Access – request a copy of your Personal Data.
Rectification – correct inaccurate or incomplete information.
Erasure – delete your Personal Data and account (subject to legal or contractual retention obligations).
Restriction – limit how we use your Personal Data in certain circumstances.
Portability – obtain and reuse your Personal Data in a structured, machine-readable format.
Objection – to certain processing, including marketing. Users have the right to object at any time to the processing of their Personal Data for direct marketing purposes or for any processing carried out on the basis of legitimate interests. Where a User objects, NR will stop processing their Personal Data for those purposes unless NR can demonstrate compelling legitimate grounds that override the User’s interests, rights, and freedoms. Withdrawal of consent – where processing is based on consent (e.g., marketing emails).

You can exercise these rights through your account settings or by emailing [email protected].

If you are dissatisfied with our handling of your Personal Data, you may lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

Users may update their Personal Data (such as name, address, email, and phone number) and manage their subscription through the Services My Profile page. Account deletion permanently removes personal information, subject to any legal or contractual retention obligations.

9. Cookies and analytics

NR uses cookies and similar technologies to provide core functionality and analyse site usage. We use Google Analytics to understand how Users interact with our website and web app and to improve performance. Use of non-essential cookies is subject to your consent under the Privacy and Electronic Communications Regulations 2003 (PECR). You can manage or withdraw cookie consent at any time through your browser settings. A full Cookie Notice is published separately.

10. Marketing communications

When creating an account, Users may choose to opt in to receive marketing communications by email, phone, or text message from NR and its approved partners. These communications may include product updates, event invitations, special offers, and partner promotions relevant to road trips or motoring activities.

Users who opt in may withdraw their consent to marketing at any time by:

clicking the “unsubscribe” link in any NR marketing email; or
contacting NR directly at [email protected].

NR records consent for marketing and keeps an auditable log in accordance with ICO Direct Marketing Guidance (2022).

Unsubscribing from marketing communications will not affect the delivery of essential Service messages by email, phone, or text message, such as account confirmations, password resets, billing or subscription notices, and other operational updates that are necessary to manage a User’s account.

We do not sell or rent Personal Data to third parties for marketing purposes and will only send marketing messages where Users have provided valid consent in line with applicable data protection laws.

11. Security

We use appropriate technical and organisational measures to protect Personal Data from unauthorised access, loss, or misuse, including access controls, secure hosting (Hetzner), and restricted staff access. While NR takes all reasonable steps to secure data, users acknowledge that no online service can be completely risk-free.

12. Children’s data

NR’s Service is intended for users aged 18 and over. We do not knowingly collect or process Personal Data relating to minors. If we become aware that we hold such information, it will be deleted promptly.

13. Changes to this Privacy Policy

NR may update this Privacy Policy periodically to reflect legal, technical, or operational changes. Updates take effect immediately upon publication. For material changes (e.g., new Personal Data uses or partner integrations), NR will notify Users by email at least thirty (30) days in advance.

14. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your data, please contact: