YourADI Privacy Policy

1. Who we are (Data Controller)

YourADI Limited is a company registered in the Republic of Ireland.

• Company Number (CRO): 813121
• Registered Office: 20 The Meadows, Whitefield Manor, Bettystown, Co. Meath, A92 F8EX, Ireland
• Data Protection Contact: dpo@youradi.ie

For the purposes of the GDPR, YourADI acts as either a Data Controller or a Data Processor depending on your relationship with the platform, as explained in the next section.

2. Our role in processing your data

Driving Instructors (ADIs) and School Administrators

YourADI acts as a Data Controller for your account, billing, and business-related data. We determine the purposes and means of processing this information in order to provide you with the platform.

Students

YourADI acts as a Data Processor on behalf of your Driving Instructor, who is the Data Controller of your booking, training, and progress data. We process student data strictly in accordance with the instructor’s documented instructions and under an appropriate data processing agreement.

3. Information we collect

We collect data through three primary channels:

A. Information provided by Driving Instructors

When you create a YourADI account, we collect your name, email address, ADI number, business details, and payment/billing information.

Your mobile number is optional. If you give us one, we use it to send you service texts about your account, such as changes to our Terms, and any booking texts you turn on. It is also shown as your contact number in the emails we send your students for you. We never use it for marketing.

From 19 November 2026, an instructor’s or school’s legal name, any trading name and business address are shown to students at checkout, in booking confirmations and on receipts, so students know who they are buying from. Where an instructor hasn’t added a business address, the business address on their register listing is shown instead (see Section 3C). The address is never shown on the public booking page.

If you choose to connect a Google or Microsoft Outlook calendar, we also access calendar data from that account. See Calendar sync in Section 5.

If you turn on push notifications, we store a push address for your browser, and when you use YourADI on a device a copy of your upcoming lessons is kept on that device for the offline diary. See Push notifications and the offline diary in Section 5.

B. Information provided by Students

When you book a lesson through an instructor’s YourADI storefront, we collect your name, contact details (email and phone), booking and appointment details, and payment information (processed securely via Stripe — we do not store full card details). We also store your driver training progress and appointment history as managed by your instructor.

If you turn on lesson reminders as push notifications, we store a push address for your browser. See Push notifications and the offline diary in Section 5.

C. Information from public sources

We hold professional details for Approved Driving Instructors in Ireland. Where we did not get those details from you directly, they come from a publicly accessible register of approved driving instructors published by the Road Safety Authority (RSA) and, for ESDS trainers, from the RSA’s public list of ESDS trainers. We hold only what those lists publish: name, business name, ADI number, business address, phone numbers, business email address, any website shown, counties served, vehicle categories, the qualifications they list, and the listing’s dates (when it was created, last changed and published).

YourADI is an independent private company. We are not affiliated with, endorsed by, approved by, or connected to the Road Safety Authority, and we do not act on its behalf or under any arrangement with it. We name the RSA here for one reason only: to tell you where your details came from, which Article 14 of the GDPR requires us to do.

We use this information to verify the credentials of instructors who sign up, to keep lapsed listings off the platform, and to send a single introductory email to instructors who have recently joined or rejoined the register, letting them know the platform exists. We send each instructor that email once. We do not sell this data, we share it only as this section describes, we do not add to it from any other source, and we do not use it to profile anyone.

If you have a YourADI account and haven’t given us a mobile number yourself, we may use the mobile number on your register listing to send you occasional service texts about your account, such as changes to our Terms. We never use it for marketing.

If you haven’t added a business address, we show the business address on your register listing to your students at checkout, in confirmations and on receipts.

You can object at any time. Every introductory email carries a one-click unsubscribe link, and we honour it permanently and across every channel. You can also object, or ask us to erase your details, using the contact details in Section 13. You do not have to give a reason and we will not ask for one. Section 4 sets out the legal basis we rely on and Section 8 how long we keep this data.

4. Legal basis for processing

We only process personal data when we have a valid legal basis to do so under Article 6 of the GDPR:

• Contractual Necessity (Art. 6(1)(b)): To provide our core software services, process bookings, manage calendars, and facilitate payments between students and instructors.
• Legitimate Interests (Art. 6(1)(f)): To verify ADI credentials, prevent fraud, improve our platform, send a single introductory email to instructors newly listed on the public register described in Section 3C, and send account holders the service texts described there, and, where an account holder hasn’t added a business address, show their students the business address on their register listing. We have carried out a written balancing assessment for that outreach, those texts and that use of the address. You can request a summary of it, and object to the outreach, using the details in Section 13.
• Legal Obligation (Art. 6(1)(c)): To maintain accurate financial ledgers and tax records as required by Irish law.
• Consent (Art. 6(1)(a)): For optional marketing communications, and for push notifications, which you turn on yourself and your browser asks you to allow. If we add analytics in future, we will update this policy first, and ask for your consent before setting any analytics cookies. You may withdraw consent at any time.

5. How we use your data

We use personal data to:

• Operate, maintain, and secure the platform
• Facilitate lesson bookings, scheduling, and payments between students and instructors
• Send booking confirmations, reminders, and transactional notifications, by email, SMS, WhatsApp or, if you turn them on, push notifications
• Track driver training progress on behalf of instructors
• Provide customer support and respond to queries
• Improve platform performance, reliability, and usability
• Prevent fraud, detect abuse, and uphold the integrity of the platform
• Comply with our legal, tax, and regulatory obligations in Ireland

Calendar sync (Google Calendar and Microsoft Outlook)

Instructors can choose to connect a Google Calendar or Microsoft Outlook calendar in Settings → Calendar sync. Connecting is optional, and only the instructor who connects a calendar shares it with us.

What we access. With your permission, we access:

• your calendar account’s email address, so you can see which account is connected;
• the list of your calendars, so you can choose which ones to use;
• for the calendars you choose: each event’s start and end time, title, whether it lasts all day, and whether it shows you as busy, from 30 days ago to 12 months ahead;
• the one calendar you choose to receive new lessons, where we add, update and cancel an event for each YourADI lesson. The event shows the lesson’s time, the lesson type and your student’s name.

How we use it. Only to provide calendar sync: to show your other commitments on your YourADI calendar, to stop students booking lessons at times you are busy, and to keep your lessons in your own calendar. We do not use calendar data for advertising, we do not sell it, and we do not use it to train artificial intelligence or machine-learning models. People at YourADI do not read your calendar data, except with your permission, where needed for security, or to comply with the law.

Storage and sharing. We store event times and titles with our database provider (Supabase, see Section 6) to work out when you are free. Event titles and the access tokens for your calendar account are encrypted. We do not share calendar data with other users: students only see whether a time is available.

Disconnecting and retention. We keep cached events only for the period above. When you disconnect a calendar in Settings → Calendar sync, we stop syncing, revoke our access to your Google account, remove the cached events from your account at once and permanently delete them within 7 days. Lessons we have already added to your calendar stay there as your own events. You can also remove YourADI’s access at any time in your Google Account (Security → Your connections to third-party apps and services) or your Microsoft account (Privacy → Apps and services).

Google API Services User Data Policy. YourADI’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Push notifications and the offline diary

YourADI can be added to a phone’s home screen and used like an app. Two of its features work with data on your device.

Push notifications (optional). Instructors can turn on notifications in Settings → Account, and students can turn on lesson reminders in My profile. Your browser asks you to allow them first. When you do, we store:

• the push address your browser gives us for that browser on that device (a web address at your browser maker’s push service), with the keys used to encrypt notifications to it;
• the kind of browser and device, for example “Chrome on Android” (we do not keep your browser’s full identification string);
• when we last sent a notification to it, and whether sending failed.

How we use it. Only to send the notifications you turned on. For instructors: when a booking needs confirming, and 30 minutes before each lesson, with the time, the student’s first name, the lesson type and any pickup. For students: lesson reminders, with the lesson, the instructor, the date and time, and any pickup. We keep a record of each notification we send with our other message records.

Delivery. Notifications travel through the push service of the company that makes your browser, for example Google (Chrome), Apple (Safari on iPhone, iPad and Mac), Mozilla (Firefox) or Microsoft (Edge on Windows). We encrypt each notification so that only your browser can read it: the push service sees the push address, when a message is sent and its size, not what it says. These services may be outside the EEA (see Section 7).

Who can see it. A student’s instructor can see whether that student gets lesson reminders as push notifications, on what kind of device, and when one was last sent, so they know how best to reach them.

Turning them off and deletion. You can turn notifications off at any time in the same place in YourADI, or in your browser or phone settings. We delete a push address when you turn notifications off in YourADI, when you sign out in that browser, when the push service tells us it no longer works (for example after you remove the app or block notifications), or after five failed attempts in a row. We keep at most ten browsers per person.

Offline diary (instructors). When you use YourADI on a device, a copy of your own lessons and blocked time for the next two weeks (times, your students’ first names, lesson types and pickups) is kept in that browser’s storage on the device, so you can read your diary with no signal. It stays on the device, is refreshed while you are online, and is deleted when you sign out, when your session ends, or when someone else signs in on that browser. The app’s own files, and a note of when the home-screen app was last opened, are also kept on the device; they hold no personal data.

6. Third-party sub-processors

To provide a secure and reliable enterprise platform, we share specific data with vetted third-party service providers under contractual safeguards (including data processing agreements). We do not sell your data. Our sub-processors include:

• Supabase (PostgreSQL): Secure cloud database storage and user authentication.
• Vercel: Application hosting and frontend delivery.
• Stripe Connect: Payment processing and payout routing. YourADI does not directly store full credit card numbers.
• Vonage: Delivery of SMS booking and account notifications.
• Meta (WhatsApp Business Platform): Delivery of WhatsApp booking notifications.
• Resend: Delivery of transactional platform emails.
• Sentry (Functional Software Inc., EU data region): Error monitoring. It receives a pseudonymous account ID and technical details of errors.
• Google Workspace: Internal company administration and customer support ticketing.
• HostingIreland.ie: Domain routing and DNS management.
• Revolut Business: Internal corporate banking operations.

Push notifications you turn on are delivered through your browser maker’s push service (Google, Apple, Mozilla or Microsoft). Those services are chosen by your browser, not by us, and receive only encrypted notifications and the push address (see Push notifications and the offline diary in Section 5).

7. International data transfers

We aim to process personal data within the European Economic Area (“EEA”). Some of our sub-processors may process data outside the EEA. Where this occurs, we ensure that appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission, and/or
• Reliance on an adequacy decision by the European Commission where one applies.

You may request further details of the safeguards applicable to specific transfers by emailing dpo@youradi.ie.

8. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy:

• Active account data is retained for the duration of your use of the platform.
• On account closure, your active workspace is deactivated.
• Financial records, invoices, and transaction data are retained for 7 years to comply with Irish Revenue and statutory record-keeping requirements.
• Instructor details taken from the RSA’s public lists (Section 3C) are refreshed each time we update them from the register. Details from the RSA’s ESDS-trainer list were collected between August and September 2026 and are not currently refreshed. When a listing is removed from the register, we mark it as lapsed and stop using it for credential checks and introductory emails, but we keep the record, contact details included, so that we recognise the instructor if they are listed again and never send them a second introductory email. The record of any introductory email we sent is kept for 7 years so we can show what was sent, to whom and on what basis.
• Unsubscribe and suppression records are kept indefinitely, as an exception to the below. If we deleted them we would have no way of knowing you had opted out, and you could be contacted again. We keep only your email address and the fact that you objected — nothing else — and we never use it to contact you.
• Calendar data from a connected Google or Outlook calendar is cached only from 30 days ago to 12 months ahead, and permanently deleted within 7 days of disconnecting the calendar (see Calendar sync in Section 5).
• Push notification addresses are kept while notifications are on in that browser and deleted as described in Push notifications and the offline diary (Section 5).
• The offline diary copy is kept only on your device, covers the next two weeks, and is deleted when you sign out.
• After the relevant retention period, data is permanently and securely deleted.

9. Cookies and tracking technologies

YourADI uses cookies and similar technologies to make the platform work securely.

Essential cookies

Strictly necessary for the application to function, including keeping you logged in securely (authentication tokens) and remembering the language you chose. The platform cannot function without these.

Storage on your device for the app

To work offline and to send the notifications you turn on, YourADI keeps a few things in your browser’s storage on the device: for instructors, the offline diary copy and the app’s files; and the push address it registered and whether notifications were switched off on that device. These are strictly necessary for features you choose to use and are never used for tracking or analytics. See Push notifications and the offline diary in Section 5.

Analytics cookies

We do not currently use analytics or advertising cookies. If we add analytics in future, we will update this policy first, and ask for your consent before setting any analytics cookies.

Email delivery and engagement tracking

When we send you an email — whether a service message (booking confirmation, reminder, receipt) or a marketing email (outreach) — our email provider Resend records standard delivery events so we can see that the message reached you and diagnose issues when it doesn’t. These events include:

• Delivered / bounced / complained: whether the message reached your mailbox, was rejected by the receiving server, or was reported as spam. We rely on these signals to protect sender reputation and to meet Gmail’s and Yahoo’s February 2024 bulk-sender requirements.
• Opened: our marketing and outreach emails carry a 1×1 tracking pixel. When your mail client loads images, we record that the message was opened, along with a coarse device type and IP-derived country. We do not store your IP address. Service messages are not pixelled.
• Clicked: links in our marketing and outreach emails are routed through a tracking domain so we can count clicks. Transactional links (e.g. booking confirmations, magic-link sign-ins) are not wrapped.

Our lawful basis for this processing is Article 6(1)(f) GDPR (legitimate interests): operating a reliable messaging service and complying with bulk-sender requirements. You can object at any time via the unsubscribe link in any marketing email, or by contacting us. You can also disable image loading in your mail client to prevent the open-pixel from firing.

Hard bounces and spam complaints automatically add your address to our internal suppression list so we stop contacting you.

10. Your rights under GDPR

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your personal data (subject to our 7-year legal retention requirements).
• Restrict or object to our processing of your data, including direct marketing.
• Data portability, allowing you to receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.

You also have the right to lodge a complaint with the Irish Data Protection Commission (“DPC”) at dataprotection.ie, or by post at 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

Important note for Students: Because your Driving Instructor is the Data Controller of your booking and training records, requests regarding your student data should generally be directed to your instructor first. We will fully assist instructors in fulfilling these requests.

11. Data security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful loss, destruction, alteration, or unauthorised access. These include:

• Secure cloud infrastructure hosted within the EEA
• Encryption in transit (TLS 1.2+) and at rest
• Row-level security on all database tables
• Role-based access controls limiting staff access on a need-to-know basis
• Continuous security monitoring, logging, and audit trails

No method of transmission or storage is completely secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the DPC within 72 hours and, where required, notify affected users without undue delay.

12. Children’s data

In Ireland, individuals must be at least 17 years old to hold a learner driving permit. Accordingly, the YourADI platform and services are strictly intended for individuals who are 17 years of age or older. We do not knowingly collect or process the personal data of children under the age of 17. If such data is identified, it will be deleted promptly.

13. Contact us

If you have any questions about this Privacy Policy, wish to file a Data Subject Access Request (DSAR), or want to exercise any of your GDPR rights, please contact our Data Protection Officer at:

Email: dpo@youradi.ie
Company: YourADI Limited (CRO 813121)
Registered Office: 20 The Meadows, Whitefield Manor, Bettystown, Co. Meath, A92 F8EX, Ireland