Privacy policy
1. Controller
The organisation named below determines the purposes and means of processing personal information on this website.
Flexi-FahrtAm Roten Baum 9
90518 Altdorf bei Nürnberg
DE
info@flexi-fahrt.de
2. Visiting the website
When you visit the website, the hosting provider processes connection data required to deliver it, particularly the IP address, time, requested resource, referrer, browser and operating-system information. Processing supports secure and stable operation. Log data is retained only for as long as operation, security or legal obligations require.
3. Transport requests and contact
When you submit a transport request, we process the contact, route, schedule and cargo information you provide to assess the request, prepare a quote and communicate with you. The legal basis is taking steps before entering into a contract or performing a contract. Required fields are necessary to process the request.
4. FlexiFahrt mobile app (iOS and Android)
In the native FlexiFahrt app we additionally process: (a) email address and display name for sign-in via one-time email code (OTP), with no lasting password stored in the app; (b) session and refresh tokens encrypted in on-device SecureStore for the active sign-in only; (c) optional Expo push tokens and device platform after explicit consent, to deliver ride status notifications; (d) optional precise location for driver accounts only during an active tour and only after consent — the latest location point is deleted on logout and purged within 24 hours; (e) recorded consent timestamps for push and location plus acceptance of privacy policy and terms. You can withdraw push and location consent in app settings and export or delete your account in the app. Legal bases are contract performance (Art. 6(1)(b) GDPR) and consent (Art. 6(1)(a) GDPR) for optional features.
5. Live routes and Google Maps
When you expressly start a live route calculation, the pickup and destination addresses are sent server-side to Google Maps Platform to calculate distance, driving time and traffic conditions. An embedded map or opening navigation then establishes a direct connection to Google; route, IP address, device and referrer information may be processed. We do not cache the route response server-side for later reuse. Processing supports handling your request or performing the transport order. Google processes data under its own terms and privacy information; the required safeguards apply to transfers to third countries.
6. Recipients and service providers
Where configured and required for operation or request handling, Vercel may process information for hosting, Web Analytics and Speed Insights; Sanity for content management; Formspree or Resend for form and email delivery; Supabase for authentication and protected operational data; Expo for app builds and push delivery; and Vercel KV or Upstash for portal and request data. Information is shared only to the extent required. Transfers outside the European Economic Area use the safeguards required by law.
7. Cookies and local storage
The website uses technically necessary browser storage for language choice, sessions, and offline display of public pages. New transport requests are not stored offline. Legacy queue entries from preview versions are deleted after no more than 24 hours. The mobile app stores session tokens and consent state on-device; operational data is loaded online from the server and is not kept as offline demo data. Optional audience measurement is used only when configured. You can clear browser data in your browser settings and remove app data by signing out or deleting your account.
8. Retention
Personal information is deleted when its purpose ends and no statutory retention or evidence obligations require continued storage. Driver locations are deleted on sign-out and purged within 24 hours. Push tokens are removed on sign-out, withdrawal or account deletion. The specific period depends on the request, contractual relationship and applicable legal obligations.
9. Your rights
Subject to the General Data Protection Regulation, you may have rights of access, rectification, erasure, restriction, portability and objection. In the mobile app you can export your data and delete your account under Profile. You may also complain to a data-protection supervisory authority. Consent can be withdrawn at any time for the future.
10. Security and updates
We use appropriate technical and organisational measures to protect personal information. This policy is updated when features, service providers or legal requirements change.