How Wheelz uses your data.

This Privacy Policy explains how Vortac Labs collects, uses, shares, and protects information when you use the Wheelz iOS application or the wheelz.club website. It also describes your privacy rights under United States state privacy laws, the European Union and United Kingdom General Data Protection Regulations, and other applicable laws. For privacy questions or to exercise your rights, email support@vortac.io. Effective date: June 23, 2026. Last updated: June 23, 2026.

In shortWheelz records your drives — route, speed, distance, duration — and lets you save vehicles, photos, and a profile. We use that information to run the app, and that is all. We do not sell your data, and we do not share it with third parties for their own purposes. The only companies that touch your data are the vendors that run the app for us (like our cloud host and map provider), and they may only use it to provide those services to us. You can ask us to access, correct, or delete your data at any time by emailing support@vortac.io. The full policy below governs.

1. Who we are

Wheelz is published by Vortac Labs, Inc. (doing business as “Vortac Labs”), an independent app studio. In this policy, “Vortac Labs,” “Wheelz,” “we,” “us,” and “our” refer to the entity that operates the Wheelz mobile application and the wheelz.club website. For purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), Vortac Labs is the “business.” For purposes of the European Union General Data Protection Regulation and the United Kingdom General Data Protection Regulation (collectively, “GDPR”), Vortac Labs is the “controller” of personal data processed through the services described here.

2. Scope

This policy applies to the Wheelz iOS application, the wheelz.club website, and any related online services that link to this policy (together, the “Services”). It does not apply to third-party websites, applications, or services that are not operated by Vortac Labs, even if you reach them through the Services. Those third parties have their own privacy practices.

3. Summary at a glance

We collect account information, vehicle information, drive and location information, device information, photographs you upload, push-notification tokens, and support correspondence.
We use that information to run the Services, authenticate you, generate drive summaries and statistics, send notifications, prevent fraud and abuse, and improve the product.
We do not sell your data, and we do not share it with third parties. There is no exception for aggregated or de-identified data, and we have no plans to add one.
The only disclosures we make are to the service providers that run the app on our behalf (such as Google Firebase, Apple, and Mapbox), which may use the information only to provide those services to us.
You have rights to access, correct, delete, port, restrict, and opt out of certain processing of your personal information. You can exercise those rights by emailing support@vortac.io.

4. Categories of personal information we collect

The categories of personal information we collect, framed using the California Consumer Privacy Act's defined categories, are:

We do not knowingly collect government identifiers, biometric data, health information, financial account numbers, racial or ethnic information, religious beliefs, union membership, sexual orientation, or genetic data.

5. How we collect personal information

Directly from you. When you create an account, complete onboarding, add a vehicle, upload a photo, send a support message, or otherwise interact with the Services.
Automatically from your device. When you use the app, our software collects device information, app interaction information, crash and diagnostic logs, and, with your permission, precise geolocation data.
From third parties. If you sign in with Apple or Google, we receive a limited identifier and the information you authorize that provider to share. We may also receive aggregated information from analytics and infrastructure providers about how the Services are performing.

6. Why we use personal information

We use personal information for the following purposes:

Provide the Services. Create and authenticate accounts, store vehicles and drives, generate route previews and statistics, display leaderboards, and deliver push notifications.
Manage your account. Honor your settings, respond to support requests, and communicate operational information.
Safety and abuse prevention. Detect, investigate, and prevent fraud, harassment, impersonation, and other misuse of the Services.
Enforcing our policies. Enforce our Terms of Service and Safety Policy.
Product research and improvement. Understand how the Services are used, debug issues, and improve features. This includes training internal machine-learning models on de-identified or aggregated data. This work stays inside Vortac Labs; we do not package it into datasets for anyone else.
Corporate transactions. Evaluate, negotiate, or execute a merger, acquisition, financing, reorganization, sale of assets, or similar transaction.

7. Location data

In shortWheelz needs background location access to automatically detect and record drives. You can revoke location permission at any time in your device settings; if you do, automatic drive detection, route recording, and speed statistics will stop working.

Wheelz depends on precise location data to provide its core functionality. When you grant the app “Always Allow” location permission on iOS, the app uses a combination of significant location changes, geofence triggers, and high-accuracy location updates to detect when a drive begins, to record the route and speed while the drive is in progress, and to determine when the drive ends.

During an active drive, Wheelz collects latitude, longitude, course, speed, horizontal accuracy, altitude where available, and timestamps. These data points are written to your account's drive log. Speed samples are used to compute top-speed records, personal bests, and leaderboard positions where applicable.

You can change location permissions at any time in your device settings. If you set location permission to “While Using” or “Never,” the app will not be able to record drives automatically in the background, and some features (route recording, speed tracking, leaderboards, drive summaries) will degrade or stop working. You can also delete previously recorded drives from inside the app.

We treat precise geolocation as sensitive personal information under applicable law. See Section 10 for your right to limit our use of sensitive personal information.

8. How we share your data

We do not sell your personal information, and we do not share it with third parties for their own purposes. Disclosure happens only in the limited circumstances below:

Service providers and processors. We share information with vendors that perform services on our behalf and under written contracts that restrict their use of the information to providing those services to us. These include cloud infrastructure providers (Google LLC, including Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, and Firebase Cloud Messaging), authentication providers (Apple Inc., Google LLC), and mapping providers (Mapbox, Inc.).
Corporate transactions. If Vortac Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, personal information may be transferred as part of that transaction, subject to the terms of this policy or with notice to you where required by law.
With your direction or consent. If you ask us to share information with another party, or if we obtain your consent for a specific disclosure not described above.

9. We do not sell or share your data

In shortWe do not sell your data. We do not share it with third parties. That applies to your account information, your drives, your location, your photos, and to aggregated or de-identified versions of any of it.

Vortac Labs does not sell your personal information and does not share it with third parties, as those terms are used in the California Consumer Privacy Act as amended, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the Texas Data Privacy and Security Act, and comparable laws in Oregon, Montana, Iowa, Tennessee, and any other US state in which we offer the Services. We have never done so, and we do not reserve the right to start.

This applies to aggregated and de-identified data as well. We do not license, publish, or otherwise monetize datasets derived from your drives, vehicles, or usage of the Services. We do not use your information for targeted advertising, and we do not run profiling that produces legal or similarly significant effects about you.

The only parties that receive your information are the service providers listed in Section 8, which act on our behalf under contracts that limit them to providing services to us, and legal authorities where the law requires disclosure. Those disclosures are not sales or shares under the laws named above.

9.1 Global Privacy Control

Because we do not sell or share personal information, there is nothing to opt out of. If your browser or device transmits a Global Privacy Control (“GPC”) signal when interacting with the wheelz.club website, we honor it, and our practices already meet what the signal asks for.

9.2 Categories disclosure (CCPA / CPRA twelve-month look-back)

Categories of personal information we collect, why we collect it, who we share it with, and how long we keep it
Category	Source	Purpose	Disclosed to	Sold or shared	Retention
Identifiers	You; sign-in providers; your device	Account creation, authentication, communications, security	Cloud infrastructure providers; authentication providers	No	Active account plus 30 days after deletion request; backups up to 90 days
Customer records	You; the app	Display profile, vehicles, and drive history	Cloud infrastructure providers	No	Active account plus 30 days after deletion request
Commercial information	You; payment processor (future)	Process transactions if and when paid features launch	Payment processor (future)	No	As required by tax and accounting law (typically seven years)
Internet or network activity	Your device; the app; the website	Operate, secure, debug, and improve the Services	Cloud infrastructure providers; analytics processors	No	Up to 24 months
Geolocation data (precise)	Your device (with permission)	Drive detection, route and speed recording, leaderboards	Cloud infrastructure providers; mapping provider for tile rendering	No	Active account plus 30 days after deletion request
Sensory or audiovisual information (photos)	You	Display profile and vehicle photos in the app	Cloud storage provider	No	Active account plus 30 days after deletion request
Inferences	Derived by the app	Top-speed records, leaderboards, drive summaries	Cloud infrastructure providers	No	Active account plus 30 days after deletion request
Sensitive personal information (precise location, credentials)	Your device; you; sign-in providers	Provide the Services and secure your account only	Cloud infrastructure providers; authentication providers	No	Active account plus 30 days after deletion request

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

Right to know or access. Confirm whether we are processing your personal information and obtain a copy of it.
Right to correct. Correct inaccurate personal information we maintain about you.
Right to delete. Request deletion of your personal information, subject to legal exceptions.
Right to portability. Receive a copy of personal information in a portable, structured format.
Right to opt out of sale or sharing. Direct us to stop selling or sharing your personal information. We do not sell or share it in the first place, so there is nothing for you to opt out of. See Section 9.
Right to limit use of sensitive personal information. Direct us to limit the use of your sensitive personal information (including precise geolocation) to purposes necessary to provide the Services.
Right to opt out of targeted advertising and profiling. Under VCDPA, CPA, CTDPA, UCPA, TDPSA, and comparable laws.
Right to appeal. If we deny a privacy request, you may appeal by replying to our written decision. In Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and Tennessee, the law specifically provides this appeal right; we honor it in all jurisdictions.
Right against retaliation. We will not deny you Services, charge you a different price, or provide you a different level of quality because you exercised a privacy right.

10.1 How to exercise your rights

To exercise a right, email support@vortac.io from the email address associated with your Wheelz account, or send a written request to the mailing address listed in Section 18. We may ask you to verify your identity before responding to certain requests. We will respond within forty-five (45) days of receiving a verifiable request, and may extend that period by an additional forty-five (45) days when reasonably necessary. An authorized agent may submit a request on your behalf if you provide written authorization that we can verify.

10.2 State-by-state summary

California (CCPA/CPRA). Right to know, access, correct, delete, opt out of sale or sharing, limit use of sensitive personal information, and not be retaliated against. See also the California Supplement in Section 19.
Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Iowa, and Tennessee. Rights to access, correct (where applicable), delete, portability, and opt out of sale, targeted advertising, and profiling that produces legal or similarly significant effects. We do not sell personal data, run targeted advertising, or conduct that kind of profiling, as Section 9 states.
Other states. If a state in which you reside enacts a privacy law granting you rights described here, we honor those rights to the extent the law applies to Vortac Labs and the processing in question.

10.3 European Union and United Kingdom (GDPR / UK GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have the rights described in Sections 10.1 and 10.2 plus the rights to restrict processing, to object to processing based on our legitimate interests or direct marketing, to withdraw consent at any time without affecting the lawfulness of prior processing, and to lodge a complaint with a supervisory authority. See Section 18 for our EU/UK contacts (placeholder) and Section 17 for international transfer mechanisms.

11. Retention

We retain personal information for as long as your account is active or as needed to provide the Services. When you request deletion of your account, we initiate a thirty (30) day soft-delete period during which the account is deactivated and recoverable, after which we delete or anonymize the underlying records in our active production systems.

Encrypted backups taken in the normal course of business are typically retained for up to ninety (90) days on a rolling basis; deleted records are not restored from those backups unless required for disaster recovery, and we re-apply the deletion when a backup is restored.

We may retain de-identified or aggregated statistics about how the Services are used for an unlimited period, for our own product and operational purposes only. Once data has been de-identified in accordance with applicable law, we will maintain and use it only in de-identified form and will not attempt to re-identify it or disclose it to third parties.

We may also retain personal information for longer periods where necessary to comply with law, resolve disputes, enforce our agreements, prevent fraud or abuse, or for tax, accounting, or regulatory recordkeeping.

12. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include encryption in transit using industry-standard Transport Layer Security, encryption at rest where supported by the underlying infrastructure provider, role-based access control, logging, and periodic review of our security posture.

No method of transmission over the internet or method of electronic storage is one hundred percent secure. We cannot guarantee absolute security. If you believe your account has been compromised, contact support@vortac.io.

13. International data transfers

Vortac Labs is based in the United States. When you use the Services, personal information may be transferred to, stored in, and processed in the United States or any other country in which Vortac Labs or its service providers maintain facilities. These countries may have data protection laws that differ from those in your country.

Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not been deemed adequate by the relevant authority, we rely on the European Commission's Standard Contractual Clauses (or, for transfers from the United Kingdom, the UK International Data Transfer Addendum) as the lawful basis for the transfer, together with any supplementary measures necessary to ensure an essentially equivalent level of protection.

14. Children's privacy

Wheelz is not directed to children. The Services are intended for users who are at least seventeen (17) years of age and who hold a valid driver's license or learner's permit in their jurisdiction. We do not knowingly collect personal information from children under the age of thirteen (13). If we learn that we have collected personal information from a child under thirteen without verifiable parental consent, we will delete that information promptly.

If you are a parent or guardian and believe your child has provided personal information to us, contact support@vortac.io and we will investigate and, where appropriate, delete the information.

15. Third-party links and services

The Services rely on, link to, or interoperate with third-party platforms and services, including Apple iOS and Apple sign-in services, Google Firebase (including Authentication, Firestore, Cloud Storage, Cloud Functions, and Cloud Messaging), and Mapbox. Your interactions with those services are governed by their own privacy policies and terms.

Apple privacy policy: see Apple's published privacy policy.
Google / Firebase privacy policy: see Google's published privacy policy.
Mapbox privacy policy: see Mapbox's published privacy policy.

16. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and provide additional notice through the Services, by email, or by other means we consider reasonable. Your continued use of the Services after the effective date of an update constitutes your acceptance of the updated policy, except where additional consent is required by law.

17. Contact

For general privacy questions or to exercise the rights described in Section 10: support@vortac.io.

For GDPR / UK GDPR inquiries: support@vortac.io.

Mailing address: Vortac Labs, attn: Privacy.

18. European Union and United Kingdom supplement

This section applies to individuals whose personal data is processed by Vortac Labs in connection with the offer of Services to individuals located in the European Economic Area, the United Kingdom, or Switzerland, or in connection with monitoring of their behavior in those territories.

18.1 Lawful bases for processing

Performance of a contract. Processing necessary to provide the Services that you have requested, including account authentication, drive recording, route rendering, and notification delivery (GDPR Art. 6(1)(b)).
Legitimate interests. Processing necessary for our legitimate interests in operating, securing, and improving the Services, preventing fraud, and conducting internal analytics, where those interests are not overridden by your interests, rights, and freedoms (GDPR Art. 6(1)(f)).
Legal obligation. Processing necessary to comply with a legal obligation to which we are subject (GDPR Art. 6(1)(c)).
Consent. Where required by law, we process personal data on the basis of your consent, which you may withdraw at any time (GDPR Art. 6(1)(a) and, for special categories of personal data, Art. 9(2)(a)).

18.2 Data Protection Officer and EU Representative

For inquiries directed to our Data Protection Officer (where appointed) or our Article 27 representative in the European Union (where appointed), contact support@vortac.io.

18.3 Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority in the member state of your habitual residence, place of work, or place of the alleged infringement. We would, however, appreciate the chance to address your concerns first; please contact us at the address above.

19. California supplement (CCPA / CPRA)

This section provides information required by the California Consumer Privacy Act as amended by the California Privacy Rights Act. It supplements, and does not replace, the rest of this policy.

19.1 Notice at collection

At or before the point of collection, we collect the categories of personal information listed in Section 4 for the purposes listed in Section 6. We do not sell or share personal information. We retain personal information for the periods described in Section 11.

19.2 Categories disclosed for a business purpose

In the preceding twelve months, we have disclosed the categories of personal information identified in Section 9.2 to the categories of recipients identified in that section for the business purposes described in Section 6.

19.3 Categories sold or shared

None. In the preceding twelve months, we have not sold or shared any category of personal information, and we do not do so today.

19.4 Sensitive personal information

We collect and use the sensitive personal information identified in Section 4(H) only for the purposes permitted under CCPA/CPRA regulation section 7027(m), including to provide the Services that you request, to ensure security and integrity, to detect and respond to malicious or fraudulent activity, and to perform services on behalf of the business. We do not use sensitive personal information for the purpose of inferring characteristics about a consumer.

19.5 Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for the third parties' direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

20. Related policies

Our Safety Policy describes how Wheelz is intended to be used and the responsibilities of drivers. Our Terms of Service govern your legal relationship with Vortac Labs.