StallaNLPrivacy statement
Draft, version 9 September 2026. Stalla is an independent initiative being set up; this statement is reviewed by a lawyer before any pilot with an operator and complemented with a data processing agreement where required.
What Stalla does
You hold your phone against a tag on the bike rack (or scan its QR code). Stalla remembers where and when you parked, and can remind you before parking starts costing money or the bike may be removed. There is no account.
What we process
| Data | Why | How long |
|---|---|---|
| A random device token (UUID) that your browser creates and keeps | To link your parking spots to your phone without an account | Until you clear the site data in your browser |
| The tag code and the time you parked and picked up | To find your bike and compute reminders | 30 days after pick-up, then deleted automatically |
| A nickname for your bike, if you enter one | To tell several bikes apart | On your phone only: the server receives a random id such as b_3f9c1a20e4, never the name. A reminder is sent with a placeholder that your phone fills in. |
| How long finding the bike took, if you tell us | To measure whether Stalla works (aggregated) | With the parking data |
| A push subscription (your browser's push-service address and keys), only if you enable reminders | To deliver reminders | Until you disable reminders or the push service revokes it |
| "Tag missing / damaged" reports with the code | Tag maintenance | Until handled |
| Your IP address, in server memory only | Abuse prevention (request limits per minute) | A few minutes; never logged or stored |
We process no name, e-mail address, phone number, public-transport card number, phone location or photos. The tag is the location; your phone never has to share positioning. There are no cookies and no third-party analytics.
Reminders
Reminders travel through your browser's push service (Google, Apple or Mozilla, depending on your device). The content is encrypted per RFC 8291; the push service cannot read the message. It does see that a message exists for your browser.
What an operator sees
A parking operator or municipality using Stalla gets a dashboard of racks, counts and durations: how many bikes are parked, which rack segments are past the free period, how long people take to find their bike. The dashboard and exports contain no device tokens or other identifiers of people.
Legal basis and roles
We process this data because you use the service (performance of the service you start yourself by tapping the tag) and, for abuse prevention, on the basis of legitimate interest. In a pilot with an operator, roles are laid down in a data processing agreement.
Your rights
You can end your data yourself: press "Got my bike" (the spot is deleted 30 days later) or clear Stalla's site data in your browser (the token disappears too, and the server data can no longer be linked to you). For access or deletion requests, or questions, e-mail [email protected]. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Hosting
The server runs in the Netherlands or elsewhere in the EU. No data is sold or passed to third parties, apart from the encrypted push messages to your browser's push service as described above.