Privacy Policy

Effective and last updated: 17 August 2026

This Policy applies to the Bonvo Ski mobile application, bonvo.ski, business.bonvo.ski and related services. The data controller is Bonvo Consulting Korlátolt Felelősségű Társaság (“Bonvo”, “we”).

1. Controller

2. Data we process

• Account and contact data, authentication identifiers, profile details and support messages.
• GPS coordinates, time, altitude, speed, heading, accuracy, recorded routes and derived run statistics when location features are active.
• Group membership, invitations, messages and location shared with selected group members.
• Photos, profile content, map contributions and content submitted to an optional AI feature.
• App Store entitlement and transaction status, but not full payment-card details.
• Device/app version, language, IP address, diagnostics, security events and feature usage.
• Necessary website cookies and consent-based analytics or preference cookies where applicable.

3. Location

Bonvo Ski uses location while the map is in use or while the user has started a ski run. Background location is used only to keep an active run and its optional live location continuous when the screen is locked or the app is not in the foreground.

• Location permission and group sharing are optional and can be stopped.
• Sharing stops when the active run ends or the user stops the sharing session.
• Background location is not used for general off-mountain monitoring, advertising or marketing.
• Precise location is not sold and is not used to build advertising profiles.

4. Offline and group positions

Downloaded maps, resort data, the user's GPS position and run recording can work without mobile service. Live group positions require a connection; offline, the last synchronized position may remain visible until connectivity returns.

A last synchronized marker is historical, not live, and may remain on another group member’s device until the map refreshes or group data is cleared.

5. Why we process data

• Contract: accounts, maps, run recording, groups, purchases, support and requested content generation.
• Consent: device permissions, optional sharing, optional AI/photo processing and non-essential cookies.
• Legitimate interests: security, fraud prevention, reliability and aggregate product improvement.
• Legal obligation: tax, accounting, consumer requests and lawful authority requests.

6. Recipients

We disclose data only as needed to operate the selected feature or comply with law, including to:

• trusted group members selected by the user;
• Apple for app distribution, authentication and App Store transactions;
• Supabase for authentication, database and storage services;
• Mapbox and OpenStreetMap-derived services for map delivery and attribution;
• hosting, CDN, diagnostics, email and security providers acting under contract;
• an AI provider only when an optional AI feature is deliberately used;
• authorities when disclosure is legally required.

We do not sell personal data or precise location.

7. Retention and transfers

• Account and saved run data remains while the account or saved item exists, subject to deletion, backups and legal obligations.
• Live group location is used for the active sharing session; saved run history remains until deleted.
• Support correspondence is normally retained for up to 24 months after closure.
• Accounting records are retained as required by Hungarian law; diagnostic logs only for a proportionate period.

Where a provider processes data outside the EEA, we use an adequacy decision, Standard Contractual Clauses or another valid GDPR transfer mechanism where required.

8. Children

Children may use Bonvo Ski with permission and appropriate supervision from a parent or legal guardian, especially for accounts, purchases, content and location sharing.

A parent or guardian should control a child’s account, purchases, group membership, content and location sharing, and may contact us to review or delete the child’s data.

9. Rights, security and complaints

Subject to applicable law, users may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. We use access controls, encrypted transport, restricted provider access, backups and monitoring appropriate to the risk.

Requests can be sent to kovigerri@gmail.com. Complaints may be made to the Hungarian data-protection authority, NAIH, or the competent authority in the user’s country.

10. Changes

Material changes will be dated here and communicated through the service or by email where appropriate. The current version is always published at this URL.