Privacy Policy
Last updated: 21 October 2026
On this page
- 1. Who We Are
- 2. What Data We Collect and Why
- 3. How We Use Your Data
- 4. Legal Bases for Processing
- 5. Background Location Tracking
- 6. Data Sharing and Third Parties
- 7. International Data Transfers
- 8. Data Retention
- 9. Your Rights Under UK GDPR
- 10. Data Security
- 11. Children's Privacy
- 12. Cookies and Web Technologies
- 13. Changes to This Policy
- 14. How to Contact Us and Make a Complaint
- 15. Account Deletion
1. Who We Are
Dashe is operated by Greenleaf TDG, a company registered in the United Kingdom. We are the data controller for the personal data we collect through the Dashe mobile application, our website at https://www.dashe.ai (including its contact, newsletter and demo booking forms), and associated services.
Alongside the mobile application, Dashe provides a business platform for organisations: web dashboards, integrations and carbon reporting. Where you use Dashe through your employer or organisation, Sections 2.7 and 6.2 describe how organisational data is handled.
Contact details:
- Company: Greenleaf TDG
- Email: [email protected]
- Website: https://www.dashe.ai
If you have any questions about this privacy policy or how we handle your data, please contact us using the details above.
2. What Data We Collect and Why
We collect only the data necessary to provide and improve the Dashe service. Below is a full account of the categories of data we collect, what we use them for, and the lawful basis under UK GDPR for each.
2.1 Personal Information
| Data | Purpose | Lawful Basis |
|---|---|---|
| First and last name | Account identification and personalisation | Performance of a contract |
| Email address | Account creation, login, and communication | Performance of a contract |
| Phone number (optional) | Account recovery and optional contact | Consent |
| Password | Account authentication (handled entirely by Firebase Authentication; Dashe does not store or have access to your password) | Performance of a contract |
2.2 Location Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Precise GPS location (latitude, longitude, altitude, speed, bearing, accuracy) | Journey tracking and carbon emission calculation | Consent |
| Full route geometry for journeys | Accurate distance measurement and journey visualisation | Consent |
| Background location collection | Continuous journey detection even when the app is not in active use (see Section 5 below) | Consent |
2.3 Activity and Health Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Activity recognition (walking, driving, cycling, stationary, running, and other activities) | Automatic classification of travel mode for emission calculation | Consent |
| Step count from device pedometer | Supporting transport mode classification and walking journey detection | Consent |
2.4 Device Information
| Data | Purpose | Lawful Basis |
|---|---|---|
| Device model | Debugging, compatibility, and support | Legitimate interest |
| App version | Debugging, feature rollout, and support | Legitimate interest |
| Operating system and version | Compatibility and debugging | Legitimate interest |
| Firebase UID (unique identifier) | Linking your device to your account securely | Performance of a contract |
2.5 Vehicle Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Vehicle registration number | Looking up vehicle details via DVLA data | Performance of a contract |
| Vehicle make, model, fuel type, and year | Calculating accurate per-vehicle carbon emissions | Performance of a contract |
| CO2 emissions rate (derived from DVLA lookup) | Carbon emission calculation for driving journeys | Performance of a contract |
2.6 Journey Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Start and end times | Journey logging and analysis | Performance of a contract |
| Start and end locations | Journey logging and route mapping | Consent |
| Distance travelled | Emission calculation | Performance of a contract |
| Calculated carbon emissions | Core app functionality, showing your carbon footprint | Performance of a contract |
| Travel mode (detected and user-corrected) | Accurate emission reporting | Performance of a contract |
| Journey status and user corrections | Ensuring data accuracy when automatic detection is wrong | Performance of a contract |
2.7 Work Schedule and Organisation Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Work schedule (days and times) | Distinguishing commute journeys from other travel | Performance of a contract |
| Organisation membership and role | Enabling employer or organisational carbon reporting | Performance of a contract |
| Invitation and link codes | Joining an organisation within the app | Performance of a contract |
2.8 Holiday Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Holiday dates, type, and description | Excluding holiday periods from commute calculations and reporting | Performance of a contract |
2.9 Car Share Data
| Data | Purpose | Lawful Basis |
|---|---|---|
| Car share session codes | Linking participants in a shared journey | Performance of a contract |
| Participant count | Splitting carbon emissions among occupants | Performance of a contract |
| Car share session duration | Accurate journey and emission reporting | Performance of a contract |
2.10 Website Enquiries, Demo Bookings and Marketing
This section covers personal data collected through our website at https://www.dashe.ai, separately from the mobile application.
| Data | Purpose | Lawful Basis |
|---|---|---|
| Name, work email and message (contact form) | Responding to your enquiry | Legitimate interest |
| Company name (contact form, optional) | Understanding the context of your enquiry | Legitimate interest |
| Email address (newsletter sign-up) | Sending you product updates and articles you have subscribed to | Consent |
| Pricing calculator selections attached to a demo booking (headcount, chosen modules, quoted totals) | Preparing your demo around your configuration | Steps taken at your request prior to entering into a contract |
| Name and email address (registering for a live session through Eventbrite) | Sending you the joining link, reminders, the recording and the session materials | Consent |
| Demo booking details entered via our scheduling provider (name, email, phone number, meeting notes) | Scheduling and holding your demo | Steps taken at your request prior to entering into a contract |
Using the pricing calculator on its own does not identify you: selections are only linked to you if you choose to book a demo with your quote.
You can unsubscribe from the newsletter at any time using the link in any email we send, or by contacting us at the details above. We do not use website enquiry or booking data for advertising, and we do not sell it to anyone.
3. How We Use Your Data
We use the data described above to:
- Provide the core service: track your journeys, detect your mode of transport, and calculate your carbon emissions.
- Manage your account: create and maintain your Dashe account, authenticate your identity, and communicate with you about your account.
- Enable organisational features: allow you to join an organisation, share relevant travel data with your employer for corporate carbon reporting, and manage work schedules and holidays.
- Enable car sharing features: allow you to share journeys with other users and split emissions accordingly.
- Improve the app: diagnose crashes, fix bugs, understand how features are used, and develop new functionality.
- Ensure security: detect and prevent fraud, abuse, and unauthorised access.
We do not sell your personal data to third parties. We do not use your data for advertising or ad targeting.
4. Legal Bases for Processing
Under UK GDPR, we rely on the following legal bases:
Consent. We ask for your explicit consent before collecting location data, background location data, activity recognition data, and step count data. You can withdraw consent at any time by adjusting your device permissions or contacting us. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal, but it will prevent further collection of that data. Note that withdrawing consent for location tracking will prevent core features of the app from functioning.
Performance of a Contract. When you create a Dashe account and use the app, you enter into a contract with us (governed by our Terms of Service). Processing your account information, vehicle data, journey data, work schedule, holiday data, and car share data is necessary to fulfil that contract.
Legitimate Interest. We process limited device information (device model, app version, operating system) for our legitimate interest in maintaining, securing, and improving the app. We have assessed that this processing does not override your rights and freedoms, given the non-sensitive nature of the data and the minimal impact on your privacy.
5. Background Location Tracking
This is important, please read carefully.
Dashe collects your precise GPS location continuously in the background, even when the app is closed or not in active use on your screen. This is essential to the core function of the app: automatically detecting and recording your journeys so that your carbon emissions can be calculated without requiring you to manually start and stop tracking.
What this means in practice:
- When you grant Dashe "Always Allow" or equivalent background location permission, the app will receive location updates at regular intervals throughout the day.
- Location data is collected including latitude, longitude, altitude, speed, bearing, and accuracy.
- This data is used solely for journey detection and carbon emission calculation. It is not used for advertising, profiling, or any purpose unrelated to the core service.
How to control this:
- You can revoke background location permission at any time through your device settings. If you do so, the app will only be able to track journeys while it is open and in the foreground.
- You can request deletion of all stored location data by contacting us at [email protected] or by deleting your account within the app.
We understand that background location collection is sensitive. We have implemented this feature with the minimum data collection necessary and apply the security measures described in Section 10.
6. Data Sharing and Third Parties
We share your data only in the following limited circumstances.
6.1 Third-Party Service Providers
| Provider | Data Shared | Purpose | Location |
|---|---|---|---|
| Firebase Authentication (Google Ireland Limited) | Email, password (encrypted), Firebase UID | Account authentication and management | EU (Ireland) |
| Firebase Crashlytics (Google Ireland Limited) | Device model, OS version, app version, crash logs | Crash reporting and app stability monitoring | EU (Ireland) |
| Google Maps SDK (Google Ireland Limited) | Location data (as needed for map rendering) | Displaying maps and routes within the app | EU (Ireland) |
| AWS (Amazon Web Services) | All data transmitted to and from the Dashe backend API | Hosting the Dashe backend infrastructure | EU region |
| Google Cloud / Firebase (Google Ireland Limited) | Website form submissions (contact, newsletter, demo quote details) | Receiving and storing website enquiries | EU (Ireland) |
| Google Analytics (Google Ireland Limited) | Pseudonymous website usage data: pages viewed, device and browser type, approximate location worked out from a truncated IP address, and the site or search that brought you to us. Collected only after you accept analytics cookies | Understanding how visitors use our website so we can improve it | EU (Ireland), with some processing in the United States (safeguards as described in Section 7) |
| Cal.com, Inc. | Demo booking details (name, email, phone number, meeting notes) | Scheduling demo calls booked through our website | United States (safeguards as described in Section 7) |
| Eventbrite, Inc. | Event registration details (name, email address) | Registering you for live sessions and sending the joining link, reminders and recording | United States (safeguards as described in Section 7) |
These providers act as data processors on our behalf and are contractually required to process your data only for the purposes we specify and in accordance with UK GDPR.
6.2 Your Organisation
If you join an organisation within Dashe (for example, your employer), certain journey and emission data may be shared with that organisation's administrators for the purpose of corporate carbon reporting. You will be informed of this when you join an organisation. The data shared with organisations is aggregated or limited to what is necessary for reporting purposes.
6.3 Legal Requirements
We may disclose your data if required to do so by law, regulation, legal process, or enforceable governmental request.
6.4 Business Transfers
If Greenleaf TDG is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.
7. International Data Transfers
Your data is primarily stored and processed within the United Kingdom and the European Economic Area (EEA). Our backend infrastructure is hosted on AWS in an EU region, and our third-party providers (Firebase, Google Maps) process data through Google Ireland Limited.
Where data is transferred outside the UK or EEA (for example, to Google's infrastructure in the United States for certain Firebase services), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO), or the recipient country being subject to an adequacy decision by the UK Secretary of State.
You may contact us for more information about the specific safeguards in place.
8. Data Retention
We retain your data for as long as it is necessary for the purposes described in this policy:
| Data Category | Retention Period |
|---|---|
| Account information (name, email, phone) | Until you delete your account |
| Location and journey data | Until you delete your account or request erasure of specific data |
| Vehicle data | Until you remove the vehicle from your account or delete your account |
| Activity and step count data | Processed in real time for mode detection; raw sensor data is not stored long-term on our servers |
| Work schedule and holiday data | Until you delete your account |
| Car share data | Until you delete your account |
| Device and crash data (Crashlytics) | Retained by Firebase Crashlytics for up to 90 days |
| Server logs | Up to 12 months, then deleted or anonymised |
| Website enquiries and demo booking records | Up to 24 months after the enquiry is resolved |
| Newsletter subscription details | Until you unsubscribe |
When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain certain records.
9. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights:
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can ask us to correct inaccurate or incomplete data.
- Right to erasure ("right to be forgotten"): You can ask us to delete your personal data, subject to certain legal exceptions.
- Right to data portability: You can request your data in a structured, commonly used, machine-readable format and have it transmitted to another controller.
- Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
- Right to object: You can object to processing based on legitimate interest. We will stop processing unless we have compelling legitimate grounds that override your interests.
- Right to withdraw consent: Where we rely on consent (for example, for location tracking), you can withdraw it at any time.
- Rights related to automated decision-making: We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on you.
To exercise any of these rights, contact us at [email protected]. We will respond to your request within one month. In certain circumstances, we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.
If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (see Section 14).
10. Data Security
We take the security of your data seriously and implement appropriate technical and organisational measures, including:
- Encryption in transit: All data transmitted between the app and our servers is encrypted using TLS (Transport Layer Security).
- Encryption at rest: Personal data stored on our servers is encrypted at rest.
- Authentication security: Passwords are managed by Firebase Authentication using industry-standard hashing and security practices. Dashe does not store or have access to your plaintext password.
- Access controls: Access to personal data within our organisation is restricted to personnel who need it to perform their duties, and is subject to confidentiality obligations.
- Infrastructure security: Our backend is hosted on AWS, which provides robust physical and network security controls and holds ISO 27001, SOC 2, and other certifications.
- Regular review: We regularly review our security practices and update them as necessary to address new threats.
While we take all reasonable precautions, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your data to the highest practicable standard.
11. Children's Privacy
Dashe is not intended for use by children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without appropriate parental consent, we will take steps to delete that data as soon as possible.
If you believe that a child under 16 has provided us with personal data, please contact us at [email protected].
12. Cookies and Web Technologies
Our website at https://www.dashe.ai uses two kinds of cookies and similar technologies, described in full in our Cookie Policy.
- Strictly necessary: the record of your cookie choice, held in your browser so we do not ask on every page, and the cookies that embedded services (the demo booking calendar, the Eventbrite registration pop-up and YouTube recordings) need in order to work on the pages that use them. These do not require consent.
- Analytics: Google Analytics cookies, set only if you accept them in the cookie banner. The default is off. You can change your choice at any time through Cookie settings in the footer of every page, and rejecting is as easy as accepting.
You can also manage cookies through your browser settings. Blocking the embedded services' cookies may stop those features working. The Dashe mobile application itself does not use cookies.
13. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this policy and notify you through the app or by email where the changes are significant.
We encourage you to review this policy periodically. Your continued use of Dashe after changes are posted constitutes your acknowledgement of the updated policy.
14. How to Contact Us and Make a Complaint
If you have any questions, concerns, or requests regarding this privacy policy or your personal data, please contact us by email at [email protected] or via https://www.dashe.ai.
If you are not satisfied with how we handle your data or respond to your request, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk
- Telephone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
We would appreciate the opportunity to address your concerns before you contact the ICO, but you are entitled to lodge a complaint at any time.
15. Account Deletion
You can delete your Dashe account at any time, either within the app (account settings → delete account) or by emailing [email protected]. We will verify your identity before processing the request.
When you delete your account, all personal data associated with it, including journey data, location data, vehicle data, work schedule, holiday data, and car share data, will be permanently deleted from our servers within 30 days. Data already shared with your organisation in aggregated or anonymised form may not be retrievable, and data retained by third-party processors (such as Firebase) will be deleted in accordance with their own retention policies. We may retain certain data where required by law, but only for as long as legally necessary.
Account deletion is permanent and cannot be undone. You will need to create a new account if you wish to use Dashe again.
This privacy policy is governed by the laws of England and Wales.