Privacy Policy

Caravaan operates the ride-sharing platform at caravaan.ee. This notice explains what personal data we process, why we process it, and the rights you have under the General Data Protection Regulation (GDPR).

We are not yet a registered company. When registration is complete, we will update this notice with our registered name, registry code, and address. Until then, contact us at info@caravaan.ee.

1. Data we collect

Account and profile

  • First name and surname;
  • Email address;
  • Mobile phone number;
  • Date of birth;
  • Password, stored as a hash rather than in plain text;
  • Profile and cover photos;
  • Optional profile details: description, city, education, job, and languages;
  • If you sign in with Google: the name and email address Google shares with us.

Identity and vehicle

  • A copy of an identity document (ID card or passport), if you upload one;
  • Vehicle model, year, and licence plate;
  • Vehicle photos and registration documents.

Rides and messages

  • Rides you offer: origin, destination, date, price, seats, preferences, and description;
  • Booking requests, seats, and comments;
  • Ratings and review comments;
  • Chat messages between members;
  • IBAN, if a driver adds one so a passenger can pay by bank transfer.

Other

  • Contact form: name, email, phone number, and message;
  • Email and SMS notification preferences;
  • Technical data needed to run the site, including session cookies, your language choice, and error reports (such as the page address and browser details) sent to our error-monitoring provider.

We do not ask you to connect a Facebook account, and Facebook login is not offered.

2. Why we use your data, and the legal basis

To provide the service (performance of a contract)

  • Create and manage your account;
  • Publish rides and handle bookings;
  • Let drivers and passengers message each other;
  • After a booking is confirmed, show phone numbers and email addresses to the people on that ride, and show the driver's IBAN to the passenger, so they can meet and pay;
  • Send service emails and SMS about rides, bookings, verification codes, and unread messages, according to your notification settings.

To meet legal duties (legal obligation)

  • Keep records we are required to keep;
  • Respond to lawful requests from public authorities.

To keep the service safe and reliable (legitimate interests)

  • Prevent fraud and misuse;
  • Protect accounts and look into reports of harmful behaviour;
  • Diagnose faults and keep the site working, including through Sentry error monitoring.

With your consent

  • Load analytics through Google Tag Manager, and only after you accept non-essential cookies. You can withdraw that consent at any time. Withdrawal does not affect processing that has already happened.

We send messages about the service. Notification settings include a "news and offers" preference, but we do not currently send marketing newsletters. We do not sell your personal data.

3. Who receives your data

Other users

  • Other members can see your name, profile photo, ratings, and the ride details you publish. Your licence plate and vehicle documents are not on the public ride listing.
  • After a booking is confirmed, the driver and the confirmed passengers on that ride can see each other's phone number and email. The passenger can also see the driver's IBAN. People on that ride can see the licence plate.

Service providers, acting on our instructions

  • Amazon Web Services (S3): stores photos and uploaded documents;
  • Resend: sends email;
  • Twilio: sends SMS;
  • Google: sign-in, and analytics through Google Tag Manager if you accept cookies;
  • Sentry: error and performance monitoring.

4. Transfers outside the European Economic Area

Some of these providers may process data outside the European Economic Area, including in the United States. Where that happens, we rely on the provider's GDPR transfer tools, such as standard contractual clauses.

5. How long we keep data

We keep account data while your account is active. Cookie lifetimes are listed below.

You can ask us to delete your account by emailing info@caravaan.ee. There is no delete button in the app. When we handle that request we remove your login credentials, profile and cover photos, and uploaded identity and vehicle documents, cancel upcoming rides, and deactivate the account.

Ride records, chat messages, and reviews may be kept for as long as we need them to operate the service or handle a dispute. Deactivating an account does not immediately erase every copy of your name or contact details from those records.

6. Cookies

Essential cookies are always set. They sign you in, remember your language, finish Google sign-in, or store this cookie choice.

  • authorization: short-lived session token. Strictly necessary. HttpOnly.
  • refresh_token: keeps you signed in. Strictly necessary. HttpOnly.
  • callbackUrl: used only to return you to the right page after Google sign-in, then removed. Strictly necessary. HttpOnly.
  • NEXT_LOCALE: remembers the language you chose. About 80 days.
  • localConsent: stores whether you accepted or refused analytics cookies. 12 months.

Analytics cookies are set only if you choose Accept. Google Tag Manager, and the analytics tags configured in that container, load only after you accept. If you refuse, or if you close the notice without choosing, we do not load Google Tag Manager. We do not use advertising cookies.

A share link to Facebook leaves our site only when you choose to open it. We do not embed Facebook scripts on Caravaan pages.

Sentry error monitoring does not use a tracking cookie. It runs so we can fix faults, on the legitimate-interest basis described above.

7. Your rights

You can ask us to:

  • Access your personal data;
  • Correct it;
  • Erase it, within the limits described in the retention section;
  • Restrict processing;
  • Object to processing based on legitimate interests;
  • Receive data you provided in a portable format, where the law gives you that right;
  • Withdraw consent for analytics cookies.

Email info@caravaan.ee. We may need to confirm that the request comes from you before we act.

You can also lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or with the data protection authority in your EU country.

8. Age

Caravaan is for people aged 18 or older. We do not knowingly create accounts for anyone younger.

9. Changes to this notice

If we change this notice in a significant way, we will post the new version on this page. Registered company details will be added here when they exist.

10. Contact

info@caravaan.ee

Feedback