Version: 2026-11-05
Werydo is operated by SOVERSERIQ · KVK 42188425 · VAT / btw-id NL005571514B15
1. Controller and contact
The data controller is Emmanuel Prince Igwe, trading as SOVERSERIQ, operating Werydo as a Dutch sole proprietorship registered under KVK 42188425. Contact hello@werydo.com for privacy questions or requests; no special subject line is required. This notice covers pre-launch registration, enquiries and any existing restricted account records. Business registration does not mean that ride bookings or a commercial mobility service have launched.
2. Registration: data, purpose and legal basis
We ask for your name, email, interest category and city/region/country to record your early-access interest and contact you about that registration, on your consent (Article 6(1)(a) GDPR). Departure and destination are required only for a route request; a travel date and free-text message are optional. Do not send identity documents, health information or other sensitive details. Without required fields and registration consent we cannot record your interest, but you can still browse. There is no legal obligation to register.
3. Marketing is optional
Only the separate, unchecked marketing box requests Werydo launch news, promotional offers and research invitations by email, based on consent. You can register without it. We record the choice, time, wording version and language. Historical registration alone is not marketing permission. Email ownership must be checked before a marketing request is used. Every marketing email must offer an unsubscribe option. You can also withdraw by emailing hello@werydo.com, without losing registration. Withdrawal does not affect the lawfulness of earlier processing.
4. Enquiries, planning and security
We use enquiries and necessary correspondence to answer you under our legitimate interest in responding (Article 6(1)(f)); steps you request before a contract may rely on Article 6(1)(b). Interest categories and optional campaign labels in registration links help us understand demand and registration sources. Our legitimate interests are proportionate launch planning, abuse prevention and system security. Hosting may process IP addresses, device/browser information, URLs, timestamps and security events. You may object to legitimate-interest processing. We do not sell personal data.
5. Optional accounts and restricted pilot
Chosen hosted sign-in provides an account ID, email and, if supplied, display name. Existing restricted pilot records can include driver declarations and review status, routes, seat requests, participant messages, contribution proposals, notifications and moderation logs. Early-access registration alone does not create these records. Where a pilot is available, necessary account/pilot processing serves the requested service (Article 6(1)(b)); moderation and security use legitimate interests. Participants see information necessary for their interaction; authorised staff can review messages for support and moderation. Approved listings may show a driver name and route. Paid bookings remain disabled; administrative payment tests do not activate customer charges.
6. Recipients and providers
Authorised SOVERSERIQ staff and necessary providers can access records. The implementation uses OpenAI Sites for managed hosting/sign-in, Cloudflare Workers and D1 for delivery, security and storage, and Resend for owner registration alerts when configured. The receiving business mailbox provider processes alerts and correspondence. Alerts include registration details; they are not marketing emails to registrants. Providers processing on our behalf require appropriate processor contracts; sign-in providers may also process account data under their own notices. Information may be disclosed to competent authorities where legally required.
7. International transfers
Our hosting and email providers can process information outside the EEA, including in the United States. OpenAI's published subprocessor information identifies Cloudflare for web hosting in the United States and describes Standard Contractual Clauses for transfers among OpenAI affiliates. The provider links below explain their published processing and transfer arrangements. A published provider policy is not a statement that every arrangement applies to our account: account-specific contractual coverage is still being checked. Contact hello@werydo.com for the applicable recipient locations and safeguards or to request a copy. We do not claim that all data stays in the EU.
8. Retention
Our retention policy calls for review and removal of early-access records no later than 24 months after the last meaningful interaction, unless an ongoing request or documented legal obligation justifies retention. Valid withdrawal or erasure requests may require earlier action. The review includes linked CRM tasks, notes, consent evidence, email copies and exports. Resolved enquiries are reviewed within 12 months; account/pilot records on closure and within 24 months of inactivity. Marketing use stops on withdrawal. Minimum suppression or consent evidence is retained only while necessary to honour your choice or establish legal claims, with annual necessity review. Retention is manually administered, not automatic deletion. Provider-controlled security logs and backup expiry are separate; their account-specific periods are being confirmed and can be requested at hello@werydo.com.
9. Cookies and browser storage
Werydo's application does not add advertising trackers or analytics cookies. Its public hosting sets Cloudflare's __cf_bm security cookie, observed with a 30-minute expiry, to help distinguish automated traffic. It is Secure and HttpOnly. Chosen ChatGPT sign-in can additionally use provider-controlled authentication cookies; see the provider cookie notice below. The page help widget does not send conversations to an AI service. We do not enable optional advertising or analytics tracking through this application. Browser settings can remove or block cookies, but blocking essential authentication/security cookies may prevent sign-in or access.
10. Your rights
You may request access and a copy, correction, erasure, restriction and, where applicable, portability of automatically processed data based on consent or contract. You may object to legitimate-interest processing and always to direct marketing. Email hello@werydo.com to withdraw consent or exercise rights; specify whether you want marketing stopped, registration withdrawn or data deleted. We may ask only for proportionate identity verification; do not send a passport by default. We respond without undue delay, normally within one month. Complex or numerous requests may justify up to two additional months; we must explain within the first month. Requests are normally free. You may complain to the Dutch Autoriteit Persoonsgegevens or the competent authority where you live, work or the alleged infringement occurred.
10a. Account request centre
You can also submit a request from your signed-in account. We store the account ID, sign-in email, selected request category, language, notice version, timestamps, response due date and staff status changes. The form accepts no document files, selfies or free-text details. We use this information to fulfil privacy obligations (Article 6(1)(c)) and answer verification enquiries (Article 6(1)(f)). Requests are visible only to the account holder and authorised staff. Request records and status history are reviewed within 12 months after closure and removed when no longer needed, unless a documented legal obligation or claim requires longer. This is a manual retention procedure. Cancelling a request does not erase its record. A marketing-stop request immediately removes the marketing choice from registrations matching your sign-in email; cancellation does not restore consent. Other email addresses need separate ownership checks. Erasure requests require staff action; submitting or closing a request is not proof that deletion has occurred.
11. Automated decisions and changes
Intake automation creates a staff review task, not automatic driver approval, a booking or a decision with legal or similarly significant effects. This registration flow does not carry out such automated decision-making or profiling. Werydo currently does not perform document or facial verification for customers. Owner-only integration tests use Didit with simulated outcomes; the capture interface can still collect a real selfie if the tester uses the camera. Test outcomes never activate customers, drivers, bookings or payments. A provider-hosted verification process is planned, not active. Before activation we will explain the provider, required data, legal basis, retention, review route and any applicable non-biometric alternative. We provide updated information before materially changing processing purposes and seek new consent where required. This notice is available in English and Dutch.
12. Owner verification tests and planned customer checks
Didit Identity Spain, S.L. provides the owner-only test service. Didit processes verification data on our instructions and also describes separate security and fraud-prevention purposes in its own notice. Werydo receives a server-checked result and uses a signed one-hour browser cookie to link the owner test; it does not save document images or facial scans. The test application is configured for one-month retention with biometric templates deleted with the session; completion does not mean immediate erasure. Didit describes EEA infrastructure and safeguards for any international transfers in its DPA. Ask hello@werydo.com about test-data access or erasure. Customer verification remains unavailable while the lawful basis, biometric safeguards, non-biometric alternative, human review, live retention and contractual coverage are finalised. We do not collect customer biometric consent before those arrangements are ready. Registration and marketing choices remain separate.