This policy explains what personal data Vinda collects when you use the app and the vinda.pt website, what we use it for, who we share it with, and your rights under the General Data Protection Regulation (GDPR).
1. Who is responsible for your data
The data controller is Vielacontece Unipessoal LDA, NIF 518092119, registered at Rua dos Cabrais 1, 9555-015 Candelária, São Miguel, Azores.
For any privacy question, write to ajuda@vinda.pt.
2. What data we collect
We only collect what Vinda needs to work:
- Email (to sign in with a one-time code; we don’t use passwords).
- Name.
- Phone number, if you choose to add it.
- Bio and travel preferences (for example music, chatting, pets).
- Car make, colour and number of seats (drivers).
- Rides published and booked, with times and routes.
- Messages sent inside the app.
- Ratings given and received.
- Payment method type. Card details are handled by Stripe and are never stored by Vinda.
- IBAN, for driver payouts.
- Device push-notification token.
- App language and notification settings.
3. Why we use your data, and on what legal basis
- To provide the service: create your account, publish and book rides, enable messages and ratings. Legal basis: performance of a contract.
- Payments and fraud prevention. Legal basis: legal obligation and legitimate interest.
- Notifications about bookings, messages and reminders. Legal basis: consent, which you can withdraw at any time in the app settings.
- News by email. Legal basis: consent, which you can withdraw from any email.
We don’t sell your data and we don’t use it for personalised advertising.
4. Who processes data for us
We use providers that process data on our behalf, under contracts that require them to protect it:
- Supabase: database and sign-in. Servers in London, UK, which has an EU adequacy decision.
- Resend: sign-in emails. European Union (Ireland).
- Stripe: payment processing.
- Expo, Apple and Google: push notifications.
5. What other users see
Other users see your first name, your profile, your rating, your car and ride details.
We never show your email, phone or IBAN to other users.
6. Transfers outside the EU
Some providers may process data outside the European Economic Area. In those cases, transfers rely on adequacy decisions or on standard contractual clauses approved by the European Commission.
7. How long we keep data
We keep your data while your account is active.
You can delete your account at any time in the app (Profile → Account → Delete account). Your data is then deleted, except what the law requires us to keep, such as payment records, for the applicable legal period.
8. Your rights
Under the GDPR, you have the right to:
- Access your data.
- Correct inaccurate data.
- Delete your data.
- Receive your data in a portable format.
- Object to certain processing.
- Withdraw consent at any time, without affecting processing already done.
To exercise these rights, write to ajuda@vinda.pt. We reply within one month at most.
You also have the right to complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
10. Minimum age
You must be at least 18 to drive and 16 to ride as a passenger.
11. Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections and restricted access.
12. Changes to this policy
If we change this policy in a significant way, we’ll tell you in the app or by email before the changes take effect.
13. Contact
Vielacontece Unipessoal LDA · NIF 518092119 · Rua dos Cabrais 1, 9555-015 Candelária, São Miguel, Azores · ajuda@vinda.pt