Privacy Policy

Last updated: [TO COMPLETE: date]

This policy explains how [TO COMPLETE: legal entity name] (hereinafter "Vuyoh") collects, uses and protects your personal data when you use the Vuyoh mobile application (hereinafter the "App") or visit this website.

1. Data controller

The data controller is [TO COMPLETE: legal entity + form], with registered office at [TO COMPLETE: full address].

For any question regarding your personal data, please contact our data protection officer at [TO COMPLETE: DPO email, e.g. privacy@yutrav.com].

2. Data we collect

2.1 User account

• Email address, first name, last name (required at signup)
• Phone number (optional, used for verification and inter-user contact)
• Profile picture (optional)
• Preferred language, units and currency
• Third-party sign-in identifiers (Google, Apple) if you choose those methods

2.2 Identity verification (KYC)

To publish a trip as a carrier, you must verify your identity. This step requires:

• A photograph of both sides of an official ID document (national ID card, passport or driver's license)
• Three guided selfies (front, left, right) for biometric matching

These documents are encrypted in transit and at rest. Face detection and text recognition on the ID document run locally on your device (Google ML Kit on-device) — no image is sent to any third party before your final validation.

2.3 Transactions

• Published trips (cities, dates, capacity, price)
• Delivery requests (parcel, weight, description, addresses)
• Proposals exchanged, counter-offers, delivery status
• Payment and withdrawal history
• Bank account details for payouts (carriers only) — processed through our payment provider

2.4 Communications

• Messages exchanged in the in-app chat
• Photos shared in conversations (parcel, delivery proof)
• Reviews posted after a delivery

2.5 Technical data

• Device identifier, operating system, App version
• Push notification token (FCM / APNs), to alert you of important events
• IP address and server access logs (security and diagnostics)

2.6 Location and contacts

The App does not use real-time GPS location. It offers address autocomplete via the Google Places API: what you type is sent to Google to return suggestions.

The recipient picker on the secure payment screen may, with your explicit permission, read a contact from your address book to prefill their name and phone number. This read is one-off: Vuyoh keeps no copy of your address book.

3. Purposes

• Create and manage your account
• Allow you to publish, search and accept trips and requests
• Verify your identity to prevent fraud
• Collect payments and disburse earnings through our payment provider
• Notify you of important events (new proposal, payment received, message)
• Ensure security, prevent abuse and comply with legal obligations
• Improve our services (aggregated and anonymised statistics)

4. Legal bases (GDPR)

• Performance of a contract — account management, matching, payment
• Legal obligations — identity verification (KYC), invoice retention, AML
• Consent — push notifications, optional marketing communications
• Legitimate interest — security, fraud prevention, service improvement

5. Recipients and processors

Your data is accessible to authorised Vuyoh staff. It may be shared with our processors strictly as needed to deliver the service:

• Amazon Web Services (hosting, database, file storage, Cognito authentication) — region us-east-1 (United States)
• Stripe, Inc. (payment processing and payouts) — United States
• Google LLC (Firebase Cloud Messaging for notifications, Google Places for autocomplete, optional Google Sign-In) — United States
• Apple Inc. (optional Sign In with Apple, APNs for iOS notifications) — United States

Transfers outside the European Union are governed by the European Commission's Standard Contractual Clauses (SCCs) and, where applicable, by the Data Privacy Framework.

6. Retention

• Active account: as long as your account exists
• Inactive account: [TO COMPLETE: e.g. 3 years after last login]
• KYC documents: 5 years after account closure (AML obligation)
• Transaction history and invoices: 10 years (accounting obligation)
• Technical logs: 12 months maximum

7. Security

All communications between the App, this website and our servers are encrypted with TLS 1.2 or higher. Passwords are never stored in clear text — authentication is delegated to AWS Cognito. Local tokens and secrets are encrypted using Keychain (iOS) and Android Keystore.

8. Your rights

Under the GDPR, you have the following rights over your data:

• Right of access and to obtain a copy
• Right of rectification
• Right to erasure ("right to be forgotten")
• Right to restriction of processing
• Right to object
• Right to data portability
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority (in France: the CNIL, www.cnil.fr)

To exercise these rights, write to [TO COMPLETE: DPO email]. We will respond within one month at most.

9. Cookies and trackers

This site (www.yutrav.com) sets no cookies or advertising trackers. The mobile App does not use cookies either: it communicates directly with our servers via authenticated HTTPS requests.

10. Minors

Vuyoh is reserved for adults (18 years and older). If we learn that an account was created by a minor, we will delete it without delay.

11. Changes

We may amend this policy to reflect legal or functional changes. The last-updated date appears at the top of this page. Material changes will be notified in the App.

12. Contact

For any question, contact us at contact@yutrav.com.