Privacy Policy

Riderly is a fleet management platform for delivery agencies, owned and operated by ASCENDA GROUP DOO(“we”, “us”, “our”).

ASCENDA GROUP DOO
Doljanska 25, 11253 Sremčica, Serbia
Company reg. no. (MB): 22194836 · Tax ID (PIB): 115699577

We are the data controller for your account data (e.g. company details, login email, usage of the Service). For courier data that you upload (names, earnings, bank and document details), you are the data controller and we process that data on your behalf, as described in our Terms of Service.

If you have any questions about this policy or your data, contact us at support@riderly.io.

We collect the following categories of personal data:

• Account data — company name, email address, registration number, country, city, address, and phone number provided on sign-up.
• Authentication data — email address and hashed password managed by Supabase Auth.
• Courier data — names, payout amounts and delivery statistics you upload, and, where you enter them, phone numbers, bank account details and identity document details of your couriers.
• Usage data — page views and feature interactions for the purpose of maintaining and improving the service.
• Technical data — IP address, browser type, device type, and session identifiers.

We use your personal data to:

• Provide, operate, and maintain the Riderly platform.
• Authenticate your account and keep it secure.
• Process courier payouts and manage fleet records on your behalf.
• Send transactional emails (e.g. email verification, password reset).
• Comply with legal obligations.
• Detect and prevent fraud or abuse.

We do not sell your personal data to third parties.

We process personal data in accordance with the Law on Personal Data Protection of the Republic of Serbia (“Official Gazette of the RS”, No. 87/2018, “ZZPL”) and, where it applies (for example to users located in the European Union), the EU General Data Protection Regulation (GDPR).

We rely on the following legal bases:

• Contract performance — processing necessary to deliver the service you have subscribed to.
• Legitimate interests — security monitoring, fraud prevention, and service improvement.
• Legal obligation — where processing is required to comply with applicable law.
• Consent — for optional cookies and communications, where you have given consent.

Riderly uses a session cookie (riderly_session) to maintain your logged-in state. This cookie expires after 24 hours and contains no personal data.

We use browser localStorage to cache non-sensitive user preferences (e.g. platform selection, theme) locally on your device.

We do not use advertising or third-party tracking cookies.

We share your data only with the following categories of third-party processors:

• Supabase (database and authentication) — servers located in the European Union.
• Anthropic (AI processing) — courier names only, sent to match names across reports and to suggest a name category used for commission rules; no other personal data is shared.
• Vercel (hosting) — EU and US data centres; we use EU-region deployment where available.

Each processor operates under a data processing agreement and is bound to adequate data protection standards.

Some of these providers process data outside the Republic of Serbia. We transfer personal data abroad only to countries that provide an adequate level of protection under the ZZPL, or on the basis of appropriate safeguards (such as standard contractual clauses), as required by Articles 63–65 of the ZZPL.

We retain your account data for as long as your account is active. After account deletion, personal data is purged within 30 days, except where a longer retention period is required by law.

Courier payout records you upload are stored as long as your account exists and are deleted with your account.

Under the ZZPL (and the GDPR, where it applies to you), you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Restriction — ask us to limit processing while a complaint is resolved.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, email us at support@riderly.io. We will respond without undue delay and at the latest within 30 days; this period may be extended by a further 60 days where necessary, in which case we will let you know.

If you believe your data is processed unlawfully, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, www.poverenik.rs). Users in the EU may also contact the data protection authority in their country.

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, hashed passwords, row-level security in our database, and session inactivity timeouts.

Despite these measures, no internet transmission is completely secure. Please use a strong, unique password and keep your credentials confidential.

Riderly is intended for business use by adults only. We do not knowingly collect personal data of anyone under the age of 18 as account holders. If you believe we have inadvertently collected such data, please contact us immediately.

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. Continued use of the platform after changes constitutes acceptance of the revised policy.

For any privacy-related questions, requests, or complaints, please contact: support@riderly.io