Documents

Melon app privacy policy

Version 1.0, effective from 26 October 2026. This is an English translation; if the two versions differ, the Polish version prevails.

1. What this policy covers

This policy explains how we process personal data in the Melon mobile app for iOS and Android (the “App”) and in the panel used by schools, clubs and other institutions that organise activities (the “Institutions”). It provides the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

Melon helps the guardians of children in the same group (for example a team or a class) arrange shared rides to and from activities: who drives, which child travels, where and when the pickup and drop-off happen, and in which car. For this to work, we have to process the data of guardians, children and drivers, including the car's location during a ride. Below we describe exactly what data this is, who sees it and how long we keep it.

The data of people who visit melon.edu.pl and send the pilot sign-up form is covered by a separate website privacy policy.

2. Data controller

The controller is Nublado sp. z o.o., ul. Henryka Sienkiewicza 3, 80-227 Gdańsk, Poland, entered in the Register of Entrepreneurs of the National Court Register by the District Court Gdańsk-Północ in Gdańsk, 7th Commercial Division of the National Court Register, under KRS 0001050386, NIP (tax ID) 9571161497, REGON 525989527 (“we”).

For anything related to personal data, write to us at info@melon.edu.pl or by post to our registered office. We have not appointed a data protection officer.

3. Whose data this is and where we get it

• Guardians (parents and other guardians of children) who use the App. A guardian's account is created by the Institution the child's group belongs to, based on data the guardian has given it. You add some of the data yourself in the App (for example your phone number, vehicles and addresses).
• Children enrolled in groups. Their data is entered by the Institution or by a guardian. The App is meant for adults: children do not have accounts and do not use the App on their own.
• People authorised to pick up a child, whom a guardian adds in the App (for example grandparents). Their data is provided by the guardian; we ask the guardian to pass the link to this policy on to them.
• Staff and associates of Institutions (for example coaches and coordinators) who use the panel. Their accounts are created by the Institution or by us.

4. What data we process

Guardian account: first name and surname, email address (login), phone number, password (we store only a secure hash of it), the avatar you chose, your Microsoft account identifier if you sign in with Microsoft, Google, Apple or Facebook, membership of groups and Institutions, notification settings and muted chats.

Child: first name and surname, date of birth, links to guardians and groups, home address and other saved pickup places together with their map coordinates.

Addresses and vehicles: saved addresses (street, number, postcode, town, coordinates) and the driver's vehicle details: name, make, model, year of manufacture, colour, number of seats, registration number and, optionally, VIN and a note.

Organising rides: ride requests and ride offers (with a short note from the driver), the assignment of children to rides, the planned and actual times and places of each child's pickup and drop-off (coordinates and address), whether the pickup or drop-off was recorded by the driver or recorded automatically after the car stopped near the place, who changed the pickup place or cancelled the ride, the reason a driver withdrew, and a route summary (start and end time, distance, driving time).

Driver's location during a ride: described separately in section 5.

Messages: the content of messages in the group chat and in conversations with organisers, the author, mentions of people, and the time sent.

Notifications: the content of notifications sent in the App (they may contain the first names of children and of the driver), whether they have been read, device tokens for push notifications (Expo, APNs, FCM) and the operating system type (iOS, Android), and a technical delivery log.

People authorised to pick up a child: first name, phone number, relationship to the child, a note.

Institution staff: first name and surname or display name, email address, phone number (shown to guardians only if the staff member chooses to), role in the Institution.

Change log: for security reasons, we record who created, changed or deleted data in the system and when (for example an account, a ride or an address), together with the content of the change. It does not record the driver's live location or the route of the ride.

We do not process PESEL numbers, health data or photos. The App does not use the camera, microphone, contacts or photo library. We do not use analytics, advertising or tracking tools, and we do not sell data.

5. Location

Your location outside a ride is used only to show you on the map in the App. It stays on your phone and we do not send it to our servers.

The driver's location during a ride. When you drive a ride in Melon, the App sends the position of your phone (and therefore of the car) so that the guardians of the children you are carrying know where the car is, and so that the children's pickup and drop-off can be recorded. The rules:

• The position is sent only within the ride window: by default from 30 minutes before the planned time until 90 minutes after it, or until the ride ends. The Institution can change these values in its settings.
• The position is sent only while the App is open on screen or while you are using navigation in the App. During navigation the position is also sent when the screen is locked or after you switch to another app, until navigation ends or is stopped. The system then shows that the App is using your location (a blue indicator on iPhone, a notification on Android).
• The position goes to the real-time database (Firebase) every few seconds and to our server roughly every 15–20 seconds, as well as at the moment the ride starts and when a child is picked up and dropped off.
• When the car stops near a pickup or drop-off place, the server may record the child's pickup or drop-off by itself (the driver sees a countdown and can cancel it).
• The car's live position is visible only to the guardians of the children carried on that ride, and only in specific situations: when their child is in the car, when the car is approaching their child's pickup place, or on the return trip. Authorised Institution staff can also see the last position.
• The App never asks for “Always” location permission and does not track you outside rides.

We send your location only if you allow access to it in your phone's system settings. You can withdraw this permission at any time in your phone's settings. Without it you can still drive a ride, but guardians will not see the car on the map and you will record pickups and drop-offs manually.

Google navigation. Navigation in the App uses the Google Navigation SDK. The first time you start it, you accept Google's terms. During navigation Google receives your phone's location and processes it under its own rules (Google privacy policy).

6. Who sees your data in the App

• Other guardians in the same group see: the first names of the children in the group and their exact pickup places on the group map (without surnames and without the address text), the first names, phone numbers and email addresses of the guardians in the group, messages in the group chat, and ride requests and ride offers.
• The guardians of the children on your ride (when you are the driver) also see: your first name and phone number, the car's details (make, model, colour, registration number), the car's position under the rules in section 5, and the pickup and drop-off times and places.
• The driver of a ride sees the first names of the children being carried, their pickup and drop-off places, and the people authorised to pick up those children together with their phone numbers.
• Authorised Institution staff see in the panel the data of the members of their groups, rides, the car's last position and conversations with organisers.
• Our authorised staff have access to data when this is needed to maintain and secure the service, handle enquiries or enable you to exercise your rights. Only they have access to the detailed route trace of a ride and to the change log.

7. Purposes and legal bases

• Running your account and providing the Melon service in accordance with the App terms of service: groups, ride requests and ride offers, planning, navigation, sharing the car's position, recording pickups and drop-offs, chat, notifications. Legal basis: contract (Article 6(1)(b) GDPR).
• Data of children, other guardians and people authorised to pick up a child: organising rides clearly and safely, so that it is always known who is taking which child, from where, to where, when and in which car. Legal basis: our and the guardians' legitimate interest (Article 6(1)(f) GDPR). We use the child's date of birth to tell children apart and to assign them to groups by year of birth.
• Sharing the driver's location during a ride: performing the service (Article 6(1)(b) GDPR) and the safety of the children being carried (Article 6(1)(f) GDPR).
• Security of the service: the change log, detecting abuse, protecting accounts. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Handling enquiries, complaints and requests concerning data. Legal basis: contract (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c) GDPR).
• Establishing, exercising or defending legal claims, for example if a dispute arises about how a ride went. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Where we process data on the basis of legitimate interest, you can object (section 11).

8. Do you have to provide your data

Providing data is voluntary, but without your first name, surname and email address we cannot create an account, and without the child's data, the pickup place and (for a driver) the car's details a ride cannot be organised. A phone number and location are not required, but without them some features will not work.

9. Who receives the data

We use providers that process data on our behalf under data processing agreements, or services in which the provider acts as a separate controller:

• Microsoft (Microsoft Ireland Operations Ltd.): hosting of the App's server, database and files in Microsoft Azure (West Europe region, the Netherlands) and sign-in via Microsoft Entra ID.
• Google (Google Ireland Ltd. and Google LLC): Firebase Realtime Database (live car position and live chat, servers in Belgium), Firebase Authentication (sign-in to live chat; Google receives only the account identifier), Firebase Cloud Messaging (notifications on Android), Google Maps Platform (maps on Android, address search, converting addresses to coordinates and coordinates to addresses, and calculating ride routes between pickup, drop-off and activity locations), Google Navigation SDK (navigation, section 5).
• Apple (Apple Distribution International Ltd.): notifications on iPhone (APNs) and Apple Maps on iPhone.
• Expo (650 Industries, Inc., USA): relaying push notifications to Apple and Google. Expo receives the device token and the content of the notification.
• Google, Apple, Facebook (Meta): if you choose to sign in with these services, we receive your email address from them via Microsoft Entra, and they learn that you are signing in to Melon. In that case they act as separate controllers.
• The Institution your group belongs to, to the extent described in section 6.
• Public authorities, where the law requires it.

Transfers outside the European Economic Area. Google LLC, Apple Inc., Meta Platforms, Inc. and Expo (650 Industries, Inc.) may process data in the USA. The basis is the European Commission's adequacy decision (EU-US Data Privacy Framework) for companies that apply it and, otherwise, including Expo, the standard contractual clauses approved by the European Commission, included in the data processing agreement. You can obtain a copy of the safeguards by writing to info@melon.edu.pl.

10. How long we keep the data

• Account, children's data, addresses, vehicles, people authorised to pick up a child, settings: until the account is deleted (see account deletion). You can remove an authorised person yourself earlier. A vehicle or address deleted in the App is no longer used, but it remains linked to the history of the rides in which it was used.
• The car's live position: until the ride ends; after that we delete it from the real-time database and from the ride.
• Detailed route trace (points at least 50 m apart, visible only to our staff): 30 days from when it is recorded.
• Ride history (who drove, which child, the pickup and drop-off times and places, the route summary, ride requests and offers): 12 months from the day of the ride, after which we delete it. This is why the savings summary in the App covers the rides of the last 12 months.
• Chat messages: 12 months from sending; a message deleted by its author is erased after 30 days, and all of a group's messages when the group is deleted. A conversation with the organisers is deleted 12 months after its last message.
• In-app notifications: 90 days. Technical notification delivery log: 30 days.
• Notification tokens: 90 days after the App was last opened on the device.
• Change log: 12 months from when the entry is recorded.
• Database backups: no longer than 35 days; after that time, deleted data also disappears from the backups.

We may keep longer only the data needed to establish, exercise or defend legal claims, for as long as the limitation periods run.

11. Your rights

You have the right to:

• access your data and your child's data and receive a copy of it,
• have the data rectified (you can correct most of your own and your child's data yourself in the App),
• have the data erased (see account deletion),
• restrict processing,
• data portability for data we process on the basis of a contract,
• object to processing based on our legitimate interest.

A child's rights are exercised by their guardian. To exercise your rights, write to info@melon.edu.pl from the email address linked to your account. We will reply within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

12. Data on your phone and permissions

The App stores on your phone only what it needs to work: the sign-in session token (in the system's secure storage), the language and display settings. We do not use cookies or advertising identifiers.

The App asks for access to your location (section 5) and for permission to send notifications. On iPhone it also uses motion data to make navigation more accurate; this data stays on your phone. You can withdraw any permission in your phone's settings.

13. Security

Connections between the App and the server are encrypted (HTTPS). We store passwords as secure hashes. Only people who need the data have access to it, and their actions are recorded in the change log.

14. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you. The driver can cancel and correct an automatically recorded pickup or drop-off of a child.

15. Changes to this policy

If we change how we process data, we will update this policy, change the date at the top of this page and inform you about significant changes in the App.