Draft before pilot launch
Privacy without the small print.
This document describes the implemented waitlist. Controller and contact details must be completed and legally reviewed before public launch.
Required before launch: the controller's name and address and any additional processors. The provisional privacy contact is hello@statiedelen.nl; confirm that it is monitored before publication.
Data collected
The waitlist asks for your email address, preferred role, preferred city and optional postcode. It also stores the language, submission time and consent.
The form does not store your IP address and the website does not build advertising profiles.
Data in the app pilot
If you use an app account, FlesVriend processes your email address, display name, language, account and security data. Depending on what you do, this can include postcodes, pickup addresses and map points you enter, listings and photos, offers, pickups, messages, ratings, favourites, notifications, disputes and support messages.
An exact pickup address is shared only with the selected participant. The app does not request device location and blocks location and microphone permissions. Push notifications, if enabled, use a device-specific Expo push token.
Asking prices and offers describe a listing. FlesVriend does not collect payment-card, bank-account, Tikkie-login, escrow or payout data and cannot see or confirm a payment between participants.
Why it is used
- to assess whether both sides have enough people in the same area;
- to invite you to a suitable test group;
- to contact pilot partners separately;
- to prevent duplicate registrations using the same email address.
The legal basis is consent. You may withdraw it before or during the pilot.
Retention and security
The Cloudflare KV storage expires waitlist records no later than five years after the latest registration.
Access should be limited to people composing the pilot. Encrypt exports and delete them after use.
The app uses short access sessions, hashed refresh sessions, encrypted transport, protected media and participant, reviewer and administrator roles. Operational retention removes expired authentication, session, notification and unlinked-media data. Older unreported marketplace details are minimised; evidence attached to a safety report or dispute may need to be kept longer.
Suppliers and transfers
The proposed hosting and waitlist use Cloudflare Pages, Pages Functions and Workers KV. Review contracts, data locations and current privacy terms before launch. Add every other supplier before it receives data.
Your rights
Email hello@statiedelen.nl to request access, correction, deletion, restriction or transfer, object, or withdraw consent. Define a response period before launch.
In the app, you can download your data as JSON and close your account under Profile → Settings → Privacy. If you cannot sign in, use the account-deletion page. Deletion removes personal preferences, devices and open activity; minimal transaction, safety, legal and audit data may be retained only under a pseudonym when there is a valid reason.
Cookies and local storage
The new public page does not place cookies or store interface preferences. If analytics, spam protection or embedded media are added, update this notice and any required consent flow first.