Privacy Policy

1.0 Introduction

MyHives is a safety, participation, and lived-experience platform. We help people move more safely, document what they experience, support one another, make their voice visible, and access rapid help when needed.

Because MyHives is built around navigation, reporting, trusted relationships, and emergency support, some of the data processed through the platform can be highly sensitive in practice. This includes live and historical location, route and destination data, safety diary entries, public and private reports, trusted-circle relationships, emergency video and audio, language preferences, AI-assisted conversations, and in some cases information that may reveal health, ethnicity, religion, sexuality, political opinions, discrimination experiences, or other special-category personal data. Under the GDPR, such data requires extra protection and, where users choose to provide it, explicit consent is often the most appropriate legal route.

This white paper adopts four foundational positions.

• First, privacy by design. MyHives is designed so privacy protection is part of product architecture from the start, in line with Article 25 GDPR and EDPB guidance.
• Second, user control with honest limits. Users should control private/public sharing, permissions, trusted-circle access, and many retention choices, but we do not promise impossible outcomes such as instant deletion from all backups, screenshots, caches, reposts, or third-party copies.
• Third, high-risk processing governance. Because MyHives involves location, emergency media, public/private safety reporting, and AI-supported interpretation, we treat DPIA-level assessment as required before launch and whenever major new processing is introduced.
• Fourth, AI must be governed. The EU AI Act is phased in, with general-purpose AI obligations already in force and transparency obligations for certain AI interactions and AI-generated content applying from 2 August 2026.

2. Who we are

For the consumer-facing MyHives service, MyHives Coöperatie U.A. acts as the primary data controller. That means MyHives Coöperatie U.A. determines the purposes and means of the core B2C processing described in this policy.

MyHives B.V. may act as an affiliated technical services company and, depending on the processing context, as a processor or subprocessor to the cooperative where it develops, hosts, secures, supports, and maintains the platform on behalf of the cooperative. In other contexts, such as corporate administration, investor relations, finance, legal claims, security investigations, or internal governance, MyHives B.V. may act as its own controller for those separate purposes. These roles must be contractually documented and reflected in internal governance.

If you need to contact us about privacy, please use:

Email: privacy@myhives.nl

Controller: MyHives Coöperatie U.A.

3. Scope of this policy

This white paper covers the MyHives consumer platform, including:

• Nest: navigation, real-time location, destination handling, route preferences, safer route scoring, route history, and route explanations.
• Safety Diary: private and public logging, text, photos, video, audio, categories, tags, public/private toggles, selected sharing, and AI-assisted drafting or logging.
• Trusted Circle: invite-based support relationships, trip sharing, emergency visibility, and revocation.
• Panic and emergency support: live location, audio/video, alarm-centre access, trusted-circle access, translation, and escalation logic.
• myHive GPT / myHive OS: interactive AI assistance, voice conversation, contextual logging, visual understanding through camera input or smart-glasses input where enabled, emergency translation, route recommendations, and AI-assisted safety interpretation.
• Operations and governance: support, analytics, security, integrity, abuse prevention, legal compliance, model and workflow improvement, and internal risk controls.

4. Core privacy and governance principles

MyHives is governed by the following principles.

• Purpose limitation. We process data only for specific, explicit, and legitimate purposes.
• Data minimisation. We collect and use the least amount of data needed for the feature you choose to use.
• Default privacy. Private is the default for diary content unless you actively choose public or directed sharing.
• Layered consent. High-risk permissions and high-risk sharing actions require clear user action and should not rely on hidden defaults.
• Retention discipline. We do not keep precise location, route, emergency, or diary data longer than justified.
• Pseudonymisation where possible. We reduce identifiability wherever functionality allows.
• Honest transparency. We tell users plainly what is recorded, who can see it, how long it is retained, and what cannot be guaranteed after public sharing.

These principles reflect GDPR and EDPB expectations around lawful processing, data minimisation, storage limitation, security, and privacy by design.

5. Cloud, hosting, and infrastructure

MyHives may use cloud and infrastructure partners including Amazon Web Services (AWS) and related service providers. Our primary cloud hosting and storage are intended to be in the EU region in Frankfurt, Germany.

EU-region hosting is helpful from a data residency perspective, but it does not automatically eliminate international transfer analysis. Personal data may still be transferred outside the EEA if support, remote access, analytics, model operations, or vendor services involve third countries. If data is transferred outside the EEA, MyHives will use lawful transfer tools such as an adequacy decision or the European Commission's Standard Contractual Clauses, together with supplementary safeguards where required. The Commission continues to recognise SCCs as the core transfer tool for non-adequate third-country transfers.

6. What data we process

7. Why we process your data

We process personal data for the following purposes:

• to create and manage your account;
• to provide Nest navigation and route guidance;
• to power route scoring and safety scoring;
• to let you create, store, publish, or share Safety Diary content;
• to operate Trusted Circle features;
• to provide Panic and emergency support;
• to support AI-assisted logging, translation, and contextual guidance;
• to improve security, reliability, and service quality;
• to prevent abuse, fraud, and misuse of the platform;
• to comply with legal obligations;
• and, where lawful, to improve our services, models, and safety intelligence.

8. Legal bases for processing

We rely on one or more of the following legal bases.

• Performance of a contract. We use this basis where processing is necessary to provide the service you asked us for, such as account creation, navigation, trusted-circle features, route history, and core service delivery.
• Consent. We use consent where you choose to enable specific permissions or disclosures, including public publishing choices, camera/microphone use where required, selected third-party sharing, and especially sensitive or special-category content you choose to provide. Consent under GDPR must be freely given, specific, informed, and unambiguous, and you must be able to withdraw it.
• Legitimate interests. We may rely on legitimate interests for platform security, abuse prevention, limited analytics, reliability, service improvement, and some fraud and legal-risk controls, but only where those interests are necessary and not overridden by your rights.
• Legal obligation. We may process or preserve data to comply with court orders, lawful authority requests, accounting and tax obligations, and other mandatory legal duties.

9. Special-category and high-risk data

MyHives recognises that user-generated content may reveal:

• racial or ethnic origin,
• sexuality or gender identity,
• religion,
• health information,
• political views,
• or discrimination and harassment experiences.

MyHives does not require these categories by default. If you choose to submit them, we process them only as needed for the feature you selected, with explicit consent or another valid legal basis, with enhanced access controls, and with tighter retention rules.

Emergency video or audio may also capture highly sensitive information incidentally. Where that occurs, we process it only to provide urgent support, assist communication, preserve safety, investigate abuse, or comply with law.

10. myHive GPT / myHive OS

11. Public, private, and directed sharing

12. User responsibility and platform responsibility

Users must not upload, publish, or share:

• intimate images of others without lawful authority,
• private or sensitive personal data of others without a lawful basis,
• defamatory or knowingly false allegations,
• doxxing content,
• or other unlawful content.

Users remain responsible for reviewing AI-assisted output before publishing or sharing it.

MyHives reserves the right to moderate, restrict, remove, preserve, or disclose content where necessary to enforce platform rules, protect people, comply with law, investigate abuse, or support legal and safety obligations.

13. Device permissions and controls

14. Retention and deletion

Retention must be practical and reflected in system design.

15. Data sharing and recipients

MyHives may share personal data with:

• service providers and processors, including AWS and other infrastructure vendors, analytics and crash services, support tools, mapping and routing providers, notification providers, moderation or security tools, and AI/model-support vendors where approved;
• Trusted Circle members, at the user's direction;
• alarm centres and emergency partners, when panic support is activated;
• selected recipients such as lawyers or employers, only at the user's direction or where law requires otherwise;
• and authorities, where required by law, emergency necessity, or lawful request.

16. International transfers

Even with primary storage in Frankfurt, transfers may occur if vendors or support teams outside the EEA access personal data. If that happens, MyHives will rely on adequacy decisions where available or SCCs plus supplementary measures where required.

17. Security posture

MyHives aims to apply security measures appropriate to the risk, including:

• encryption in transit and at rest,
• role-based access,
• access logging,
• multi-factor authentication for internal access,
• separate environments,
• restricted emergency-media access,
• vendor due diligence,
• vulnerability management,
• and incident response.

For panic and private diary content, access should be strictly need-to-know, logged, reviewable, and internally segmented.

18. User rights

Subject to applicable law, users may have rights to:

• access,
• rectify,
• erase,
• restrict,
• object,
• port data where applicable,
• and withdraw consent.

MyHives should provide:

• in-app privacy controls where possible,
• clear settings for public/private status,
• deletion tools,
• and a dedicated privacy contact.

Users may also lodge a complaint with the Dutch Data Protection Authority or another competent supervisory authority.

19. Children and age-positioning

If MyHives is offered to minors or likely to be used by minors, separate age and parental-consent analysis is required. If the platform is intended primarily for adults, this should be stated clearly in the final public policy and Terms.

20. Changes to this policy

We may update this Privacy Policy from time to time. If changes are material, we will provide notice by reasonable means, such as in-app notice, email, or another service communication. The updated policy becomes effective on the date stated in the policy.