This policy explains what data the rush.cab app and website process, why, and how to exercise your rights. The data controller is Killian Cordelette EI, [being completed] (contact: support@rush.cab). We collect the minimum needed and never sell data.
1. Data we process
Account: email address, language, chosen city, creation date. For Apple or Google sign-in: the account identifier provided by Apple or Google, the related email and an encrypted token used only to revoke access when you delete your account.
Code sign-in: a one-time code, stored hashed and valid for a few minutes.
Location: only if you allow it and while the app is open. It is used to show demand and travel times around you. We keep only your last known position (coordinates and time), replaced at each update, to alert you to nearby demand. No background tracking, no trip history.
Notifications: your device’s notification token, if you enable them, and the list of alerts already sent to avoid duplicates.
Subscription: status, expiry and store of purchase (Apple or Google). We never receive your card details.
Security: a log of sign-ins and sensitive account actions, and server technical logs (including IP address), kept for security and diagnostics.
2. Purposes and legal bases
We do not run targeted advertising and make no automated decisions with legal effects on you.
Providing the Service, managing your account and subscription: performance of a contract.
Using your location and sending notifications: your permission, which you can withdraw at any time in your phone settings.
Securing the Service, preventing fraud and account sharing, diagnosing failures: our legitimate interest.
Meeting legal obligations (accounting, requests from authorities): legal obligation.
3. Service providers
Your data is processed by our providers, on our behalf and only for the Service:
DigitalOcean — server and database hosting (Frankfurt, EU).
Resend — sign-in emails.
Apple, Google — account sign-in, in-app payments and notification delivery.
RevenueCat — purchase and subscription-status verification, using an internal identifier.
Expo — notification delivery.
Mapbox — map display; receives technical data (IP address, device, area viewed).
Stripe — payment of any web subscription.
Cloudflare — domain DNS and receipt of emails sent to support.
4. Transfers outside the European Union
Some providers are located in the United States or may access data from there. These transfers rely on the EU–US Data Privacy Framework where the provider participates, or on the European Commission’s standard contractual clauses.
5. Retention
Account data, last position, notification token and activity log: until you delete your account.
Sign-in codes: a few minutes.
Database backups: rotated and erased no later than 35 days after a deletion.
Billing data held by Apple, Google or Stripe: under their own legal obligations.
6. Your rights
You may access, correct or erase your data, receive a portable copy, object to processing based on our legitimate interest or ask for it to be restricted, by writing to support@rush.cab from your account’s email address. We reply within one month.
You can delete your account and its data at any time in the app (Profile) or at rush.cab/account.
You may lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or the authority in your country. Residents of California and other US states: we do not sell or share personal information for cross-context advertising.
7. Cookies
The website only uses a strictly necessary session cookie, set after sign-in. It uses no advertising or audience-measurement cookies.
8. Security and minors
Traffic is encrypted (HTTPS), server access is restricted and secrets are encrypted or hashed. No system is infallible; we will notify you of a data breach where the law requires.
The Service is reserved for adult professionals and is not directed at minors.
9. Changes
We may update this policy. For a significant change, we will notify you before it takes effect.