Privacy Policy
Draft. This policy is not yet in force and must be reviewed by a lawyer before Domivan launches. Text marked like [THIS] still needs to be filled in.
1. Who is responsible
StepsNest B.V., registered in the Netherlands under KvK number 42105882, Sprangstraat 10, 6004 XD Weert, is the controller of your personal data when you use Domivan (for travellers) or Domivan Driver (for transporters). For privacy questions, write to us through Help and support in the app or at privacy@domivan.com.
2. What we collect and why
| Data | Who | Why | Legal basis (GDPR) |
|---|---|---|---|
| Email address and one-time sign-in codes | Everyone with an account | Create your account and sign you in | Contract |
| Name and phone number | Everyone with an account | Shown to the other side of your trip about 12 hours before pickup, so you can find each other | Contract |
| Profile photo (optional) | Everyone who adds one | Shown in the app so the other side recognises you | Consent (remove it any time) |
| Company name, van plate number, number of seats, and documents we ask for when checking you | Transporters | Check that you may carry passengers, match trips to your van, tell travellers which van to look for | Contract; legitimate interest in passenger safety |
| Trip details: pickup and destination addresses and their map coordinates, date and time, passengers, bags, notes, price, status | Travellers and their transporter | Price, book, offer and carry out the trip; keep records | Contract; legal obligation (bookkeeping) |
| Live location of the transporter, from tapping "Towards client" until the traveller is picked up | Transporters | Show the traveller where their van is | Contract; legitimate interest in a smooth pickup |
| Chat messages between traveller and transporter | Both | Arrange the trip; handle complaints | Contract; legitimate interest |
| Support messages | Everyone who writes to support | Answer your questions and complaints | Contract; legitimate interest |
| Payment references (we never see your full card number), refunds, payout amounts | Travellers and transporters | Take payments, refund, pay transporters, bookkeeping | Contract; legal obligation |
| Push notification token | Everyone who allows notifications | Send alerts about new offers, your trip, chat and support replies | Consent (turn off in your phone settings) |
| Technical data such as IP address and app version in server logs | Everyone | Security, preventing fraud and fixing errors | Legitimate interest |
We do not use your data for advertising, we do not sell it, and we do not use automated decision-making that has legal effects on you. Offers are shown to all eligible transporters at the same time and go to whoever accepts first.
Location. The traveller app does not track your location. Addresses you type are turned into map coordinates by your phone's built-in map service (Apple on iPhone, Google on Android), which receives the address for that purpose. The Driver app uses your location only while a trip is in the "Towards client" stage and the app is open; it keeps only your latest position for that trip, visible only to you and that traveller.
3. Who we share it with
- The other side of your trip. Your transporter or traveller sees your name, phone number and photo from about 12 hours before pickup (right away for Live trips), plus the trip details and your chat. Transporters see the trip route, date and passengers, without names, when it is offered.
- Service providers who process data for us:
- Supabase (database, sign-in, file storage and servers), hosted in Frankfurt, Germany.
- Stripe (payments and transporter payouts). For transporter payouts, Stripe also collects identity and bank details itself, as a separate controller under its own privacy policy.
- Lettermint (sending sign-in code emails).
- Expo (delivering push notifications), with Apple and Google, which deliver notifications to your phone.
- Apple and Google (app stores, and turning addresses into map coordinates on your phone).
- Authorities, when the law requires it, or to protect the safety of passengers.
4. Transfers outside the EU
Our main database is in the EU. Some providers (such as Stripe, Expo, Apple and Google) may process data in the United States or other countries. Where that happens, we rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. [LAWYER: confirm each provider's transfer mechanism and sign data processing agreements.]
5. How long we keep it
- Account details: as long as your account exists. Deleting your account in the app removes them right away.
- Trip, payment and payout records: 7 years, as Dutch tax law requires.
- Chat and support messages: [1 year] after the trip or conversation, unless needed for an open complaint.
- Live location: only the latest position, kept with the trip record. [DECIDE: delete live location when the trip is completed.]
- Transporter documents: as long as you are active, then [1 year].
- Server logs: [90 days].
6. Your rights
You can ask us to see, correct, delete or export your data, to restrict how we use it, or object to our use based on legitimate interest. Where we rely on consent, you can withdraw it at any time. You can change your name, phone and photo yourself in the app. To use your other rights, write to us through Help and support or at privacy@domivan.com; we answer within one month.
You can delete your account yourself in the app under Profile, Delete account. See Delete your account.
You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.
7. Security
Data is encrypted in transit, access to the database is limited by strict per-user rules, sign-in uses one-time codes instead of passwords, and card details are handled only by Stripe. No system is perfectly safe; if a breach puts your data at risk, we will tell you and the authorities as the law requires.
8. Children
You must be 18 or older to have an account. Travellers may book for children travelling with them; we receive only the number of passengers, not their names.
9. Changes
If we change this policy in an important way, we tell you in the app before the change takes effect.