Privacy Policy
Last updated: 8 October 2026
This notice explains what personal data we hold, why, on which legal basis, who else receives it, how long we keep it, and how to exercise your rights. It describes what our systems actually do.
1. Who is responsible for your data
The controller of your personal data is FALÉSIA DA MAGNÓLIA - UNIPESSOAL LDA, a company registered in Portugal with NIPC 517885042. Our registered office is at Lisbon, Portugal. We operate through GetVoolo (getvoolo.com) and the GetVoolo Driver app.
For anything about your personal data, write to developer@getvoolo.com. TODO: state whether a Data Protection Officer is appointed (see lib/legal/company.ts)
2. Whose data, in short
GetVoolo is a marketplace for airport transfers in Lisbon. Passengers describe a journey. Licensed local drivers offer to carry it out.
We hold data about four groups of people: passengers, drivers, people who join our waitlist, and anyone visiting the site. Each section below says what we collect, why, the legal basis, and how long we keep it.
We do not sell personal data. We do not use it for advertising. We do not make decisions about you by automated means that have legal or similarly significant effects — which driver carries a trip is the passenger's choice, and admitting a driver onto the platform is decided by a person reviewing their documents.
3. Passengers
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Account: email address, password (stored hashed by our authentication provider), or your Google sign-in; name and phone number you add to your profile | To sign you in and show you your own bookings | Contract (6(1)(b)) |
| Booking: name, email, phone, pickup and drop-off addresses and their map coordinates, date and time, passengers, luggage, child seats, vehicle class, optional flight number, trip type, notes | To describe the trip to drivers, carry it out, and send you confirmations and updates | Contract |
| Flight number and date | To check the flight's status so the driver adjusts to a delay | Contract |
| Payment: amount, currency, refunds and Stripe references. Your card details are entered on Stripe's own page and never reach us | To take payment, refund, and keep accounting records | Contract; legal obligation (6(1)(c)) for tax records |
| Messages with your driver; support requests and our replies | To let you and your driver arrange the pickup, and to help you | Contract; legitimate interest (6(1)(f)) in resolving complaints |
| Reviews you leave (rating and comment — shown without your name) | To show drivers' ratings to other passengers | Legitimate interest in a trustworthy marketplace |
| Notification preferences and, if you allow them, browser push subscriptions | To send the notifications you asked for | Consent (6(1)(a)) for push; contract for service emails |
Who sees your contact details. While your request is open for offers, drivers see the trip — addresses, time, passengers, luggage, vehicle class. They do not see your name, email, phone or tax number; the database refuses those to them. Once you choose a driver, that driver can see your name, phone and email so they can reach you on the day. That lasts while the trip is under way and for 48 hours after it ends, so a lost bag can still be returned. They never see your tax number. You can see your driver's phone on the same terms.
4. Drivers
Paid passenger transport in Portugal is licensed, so before a driver can bid we must verify documents we would otherwise never ask for.
| Data | Why | Legal basis |
|---|---|---|
| Name, email, phone, photo, languages, service area | Your driver profile. Passengers see your name, photo, rating, languages and vehicle with your offer. Your phone and email are given only to the passenger whose trip you are assigned to, while that trip is under way and for 48 hours after it ends | Contract |
| NIF, and for companies the NIPC | Tax identification and payouts | Legal obligation |
| Identity document, driving licence, TVDE certificate or RNAAT registration, operator licence, company registration; document numbers and expiry dates | To confirm you may lawfully carry paying passengers, and to remind you before a document expires | Legal obligation |
| Criminal record certificate (registo criminal) | Required to operate as a TVDE driver. This is data about criminal convictions (GDPR art. 10): it is kept in a private store, is seen only by the administrators who verify it, and is never shown to passengers | Legal obligation under Portuguese transport law TODO: legal review: confirm the art. 10 basis (Lei 45/2018) for each driver track |
| Vehicle registration, inspection and insurance documents; plate, make, model, year, photo | To confirm the vehicle is roadworthy and insured for paid transport | Legal obligation |
| Stripe Connect account (identity checks are carried out by Stripe on its own pages) | To pay you | Contract |
| Live GPS position, only while a trip is under way (from “on the way” to completion) | So your passenger can see you approaching. It is not recorded before or after a trip, the record is deleted when the trip ends, and there is no location history | Contract |
| Push-notification token of the Driver app | To alert you to new jobs and trip changes; removed when you sign out | Contract |
5. The waitlist
Before the site offered a full booking flow, visitors could leave their email address with a priced trip so we could tell them when they could book it. If you did that, we still hold your email with the pickup and drop-off you had entered, for at most 1 year, and you can ask us to delete it at any time. Legal basis: your consent (6(1)(a)), which you can withdraw by writing to developer@getvoolo.com.
6. Everyone who visits the site
| Data | Why | Legal basis |
|---|---|---|
| IP address, or your account id if signed in, in short-lived counters | To stop abuse — too many bookings, sign-in attempts or form submissions from one source. Deleted after 24 hours | Legitimate interest in security |
| What you type into the address search | Sent to Mapbox to suggest addresses and calculate the route and guide price | Legitimate interest / taking steps at your request before a contract |
| Anonymous counts: that a page was viewed, a price was shown or a booking button was pressed, with the route, car class, trip type and language only | To see where people stop before booking, so we can fix it. No IP address, account, device or cookie is stored with them, so they cannot be linked to you or to each other. Not sent at all if your browser asks not to be tracked. Deleted after 13 months | Legitimate interest in improving the service |
7. Who else receives your data
We use the following providers. Each acts on our instructions under a data processing agreement, and receives only what it needs for its task.
| Provider | What it receives | Where |
|---|---|---|
| Supabase — database, sign-in, document storage | Everything described above that we store | EU — AWS eu-west-1, Ireland |
| Stripe — payments, refunds, driver payouts | For a payment: your email, name, the pickup and drop-off addresses and time, the price and booking references (and the driver's name for an offer). You enter your card on Stripe's page directly. For drivers: email and the details Stripe asks for during payout setup | TODO: confirm Stripe contracting entity and region (e.g. Stripe Payments Europe, Ltd., Ireland) |
| Mapbox — address search, routes, maps | What you type in the address box, trip coordinates, and your IP address. On the live-tracking and route map pages, Mapbox also receives a map-load event it uses for billing; we have switched its optional performance telemetry off | USA |
| Resend — email delivery | Your email address and the content of each email: booking details and addresses, offers, flight updates, message notifications (including the message text), support replies | EU region (Ireland) |
| AeroDataBox (via RapidAPI) — flight status | The flight number and date only | USA |
| OVHcloud — hosting (the server the site runs on) | Every request to the site, including your IP address, passes through that server | EU — France |
| Google — sign-in, if you choose “Continue with Google” | Google tells us your name and email; we tell Google nothing else | USA / EU |
| Expo — Driver app notifications | The driver's device token and each notification's title, text and link, which can include a pickup address, the passenger's name, an excerpt of a chat message, or a trip reference | USA |
| Your browser's push service (e.g. Google, Mozilla, Apple) — website notifications you allow | An encrypted notification the push service cannot read | Varies by browser |
| Sentry — error reports, only when enabled | Technical error details. Fields named as emails, phone numbers, tax numbers, licences, passwords, tokens or cookies are removed before sending, and there is no session recording; the text of an error message itself is not filtered | USA |
Within GetVoolo, authorised administrators can see bookings and driver documents to run the service. Every administrative action on accounts, bookings and money is logged. We disclose data to public authorities only where the law requires it.
8. Transfers outside the European Economic Area
Some providers above are based in the United States, or can access data from there. When that happens, we rely on one of two safeguards: the provider's certification under the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. TODO: confirm the transfer mechanism for each non-EU provider (Stripe, Mapbox, Expo, AeroDataBox, Sentry, Google)
9. How long we keep it
These periods are enforced by an automatic nightly clean-up, not only promised here.
| Data | How long | Why |
|---|---|---|
| Bookings, offers, payments, refunds, payouts and balance adjustments | 10 years from the end of the tax year of the transaction TODO: confirm this period | Kept 10 years for Portuguese accounting and tax records (Código do IRC, art. 123.º). Not purged automatically. |
| Passenger name, email and phone on a past booking | Anonymised 3 years after the trip's completion or cancellation TODO: confirm this period | Needed for disputes, chargebacks and complaints; after that the booking is kept without them. |
| Messages between passenger and driver | Deleted 2 years after the trip's completion or cancellation TODO: confirm this period | The record of what was agreed, for disputes. |
| Support tickets and their messages | Deleted 2 years after the ticket's last activity TODO: confirm this period | To answer follow-ups and complaints about the same issue. |
| Waitlist sign-ups (email, pickup and drop-off) | Deleted 1 year after sign-up TODO: confirm this period | Only to tell you when bookings open. |
| Driver identity, licence, criminal-record and vehicle documents | Until account deletion | Deleted with the driver's account; a replaced document's old file is deleted when the new one is uploaded. |
| A driver's live position during a trip | Until the end of the trip (and any row older than 24 hours, as a safety net) | Only so the passenger can see the car approaching. |
| Rate-limit counters (account id or IP address) | Deleted 24 hours after the start of the counting window | To stop abuse of forms and sign-in. |
| Payment event receipts (event id and type only — no personal data) | Deleted 90 days after receipt | To avoid processing the same payment event twice. |
| The administrators' action log | Deleted 5 years after the action TODO: confirm this period | Accountability for actions taken on accounts, bookings and money. |
| Your account (sign-in email, name, phone, preferences, push registrations) | Until account deletion | Kept while the account exists. Deleting it (in your account settings) removes it; booking records are kept anonymised as above. |
10. Your rights, and how to use them
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify anything inaccurate — most of it you can edit yourself in your account;
- erasure — you can delete your account yourself in your account settings; we then remove your personal data except what the law requires us to keep, which is anonymised (see § 9). How to delete your account;
- restrict processing while a complaint is being looked at;
- portability — a copy of the data you gave us, in a machine-readable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, for push notifications or the waitlist, without affecting what happened before.
How: write to developer@getvoolo.com from the email address on your account, or tell us which booking or waitlist entry it is about. Say which right you want to use. We may ask you to confirm your identity. We answer within one month. If a request is complex we may extend that by up to two more months, and we will tell you why.
If you are unhappy with our answer, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt — or to the authority where you live or work.
11. Children
Accounts are for adults. Children may travel as passengers on a booking made by an adult, who provides only the number of child seats needed. TODO: confirm the minimum age for an account (16 is the Portuguese age of digital consent)
12. Security
Access is enforced in the database itself, not only on the screen. In practice, that means:
- a passenger can read only their own bookings;
- a driver sees open trips without passenger contact details, and gets contact details only for the trip they were chosen for;
- driver documents sit in a private store, reachable only through short-lived links issued to administrators;
- confidential driver fields — tax numbers, licence numbers, payment account identifiers — are held apart from the profile passengers can see.
The administration console requires two-factor authentication.
13. Changes to this policy
When we change what we collect or why, we update this page and the date at the top, and we tell account holders by email about changes that affect them. See also our cookie policy and terms of service.