App Privacy Policy

1. Who We Are

Qruuze is a UK-based cost-sharing carpooling platform operated by Qruuze Ltd — the data controller for all personal data processed in connection with the Qruuze application.

2. What Data We Collect and Why

We only collect personal data that is necessary for Qruuze to function safely and effectively.

3. Location Data — A Closer Look

Location data is used in the following specific and limited ways:

• •When you search for a Ride or post a Ride as a Host, your device's location may be used to help suggest relevant routes and nearby journeys. This is a one-time lookup at the point of your search.
• •When a Host presses the "I've Arrived" button, a single location snapshot is taken from the Host's device to verify they are within the required proximity of the pickup point.
• •When a Passenger presses the "I'm At My Pickup" button, a single location snapshot is taken to verify they are within 500 metres of their agreed pickup point. This is stored alongside the booking record for dispute resolution purposes.
• •During an active journey (ride status "in progress"), the Host's device broadcasts their GPS location approximately every 5 seconds. This is stored as a rolling history of location points for Passenger live tracking and no-show dispute resolution. Live location broadcasting stops automatically when the journey ends.
• •When a Passenger opens the Live Tracking map during an active journey, their location is shared with the Host every 5 seconds for the duration that the map is open. This location is not stored beyond the active session.
• •Pickup and drop-off coordinates entered during booking are stored as part of the journey record for fare calculation and dispute resolution purposes.
• •If a Passenger reports a no-show dispute, both the Passenger's and Host's location data at the time of the report are recorded as part of the dispute record and retained until the dispute is resolved.

We use Mapbox to calculate the route distance between agreed pickup and drop-off points. Mapbox calculates the predicted road distance between two fixed points — it does not independently track the vehicle's actual movement along the road.

On iOS and Android, Hosts are asked for background location permission at the point of account setup. If a Host grants "Always On" (iOS) or "Allow all the time" (Android) location permission, GPS broadcasting continues when the app is in the background or the device is locked, for the duration of the active journey only. If a Host grants "While Using" permission only, broadcasting will only occur while the app is open.

4. Special Category Data — Gender

Gender is collected as a mandatory field at the point of account registration and constitutes special category personal data under Article 9 of UK GDPR. We process this data only on the basis of your explicit consent given at registration.

If you wish to withdraw your consent and request removal of your gender data from our records, please contact us at support@qruuze.co.uk. Please note that removal of your gender data will remove your access to the Women-Only Rides feature but will not affect any other aspect of your Qruuze account.

5. Vehicle Photos and Identity Verification

5.1 Vehicle Photos

Vehicle photographs uploaded by Hosts are displayed only to Passengers who have a confirmed booking with that Host, allowing them to visually identify the correct vehicle before boarding. Vehicle photographs are retained for as long as the Host's account remains active and are permanently deleted upon account closure.

5.2 Identity Verification

Qruuze conducts identity verification of all Hosts directly, without the use of a third-party verification provider. We collect and review a photograph of the Host's valid UK driving licence and vehicle registration details. This data is processed by authorised Qruuze staff only and is permanently deleted upon account closure.

6. Payments and Financial Data

All payments on Qruuze are processed by Stripe, a PCI DSS-compliant payment service provider. Qruuze does not store your full card number, CVV, or bank account details on our own servers.

We retain transactional data (amount paid, booking reference, date, outcome) for 7 years to comply with HMRC financial record-keeping requirements.

By using the payment features of the app, you also agree to Stripe's Privacy Policy, available at stripe.com/gb/privacy.

7. Who We Share Your Data With

7.1 Other Qruuze Users

When a booking is confirmed, limited profile information is shared between the Host and Passenger to facilitate the journey: first name, profile photograph, vehicle details (Host only), journey rating, and agreed pickup/drop-off locations. We do not share your full name, email address, phone number, or payment details with other users.

7.2 Service Providers

We share data with trusted third-party service providers, all bound by data processing agreements:

• •Stripe — payment processing, refunds, and Host payouts via Stripe Connect
• •Mapbox — route distance calculation and journey time estimates
• •Supabase — secure cloud database hosting and backend infrastructure
• •Resend — transactional email delivery (booking confirmations, refund notices, account notifications)
• •Sentry — automatic crash and error reporting (device model, OS version, app state at time of error only)
• •Vonage (Nexmo) — phone number verification via one-time passcode (OTP). Your phone number is transmitted to Vonage solely for the purpose of sending the verification code and is not retained by Vonage beyond delivery.
• •Firebase (Google) — push notification delivery via Firebase Cloud Messaging (FCM). Device push tokens are shared with Firebase for the purpose of delivering in-app notifications. Firebase does not have access to the content of notifications or any personal journey data.
• •Transistor Software (react-native-background-geolocation) — native GPS background tracking library used on the Host's device during active rides. This library processes location data natively on-device only and does not transmit data to Transistor Software's servers.

7.3 Legal and Regulatory Obligations

We may disclose your personal data to law enforcement agencies, regulatory bodies (including the ICO), or courts where we are legally required to do so, or where we reasonably believe disclosure is necessary to prevent crime or protect public safety.

7.4 Business Transfers

If Qruuze Ltd is involved in a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you before your data is transferred and becomes subject to a different privacy policy.

8. Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, or as required by law.

9a. Your Rights Under UK GDPR

You can exercise any of these rights by contacting us at support@qruuze.co.uk. We will respond within one calendar month.

9b. How to Delete Your Account

You can request the complete deletion of your Qruuze account and associated personal data at any time.

To delete your account:

• •Send an email to support@qruuze.co.uk from the email address registered to your Qruuze account.
• •Include the subject line "Account Deletion Request".

Upon receiving your request, we will initiate the deletion process. As outlined in Section 8 (Data Retention), your profile data will be deleted immediately upon account closure, while certain financial and journey records may be retained temporarily to comply with legal obligations.

10. Push Notifications

Qruuze uses push notifications to keep you informed about important events relating to your account and bookings. These include booking confirmations, journey reminders, payment notifications, rating alerts, and account status updates.

To send push notifications, we store a device push token associated with your account. You can disable push notifications at any time through your device settings.

11. Data Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. These include:

• •Encryption of data in transit using TLS (Transport Layer Security)
• •Encryption of sensitive data at rest
• •Access controls limiting data access to authorised Qruuze personnel only
• •Secure, PCI DSS-compliant payment processing via Stripe — we never store raw card data
• •Row-level security policies applied to our Supabase database infrastructure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours as required by UK GDPR, and we will notify you without undue delay where the breach poses a high risk to you.

12. International Data Transfers

Qruuze is a UK-based service and we aim to keep your data within the UK and the European Economic Area (EEA) wherever possible. However, some of our third-party service providers, including Stripe, Mapbox, Supabase, Resend, and Sentry, may process data on servers located outside the UK and EEA.

Where such transfers occur, we ensure that appropriate safeguards are in place in accordance with UK GDPR, including reliance on the UK International Data Transfer Agreement (IDTA) or an adequacy decision by the UK Government.

13. Children's Privacy

Qruuze is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe that a person under 18 has registered on Qruuze, please contact us immediately at support@qruuze.co.uk and we will take prompt action to delete the relevant data and close the account.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Where we make material changes, we will notify you via the app or by email before the change takes effect. Your continued use of the app after any change takes effect constitutes your acceptance of the updated Policy.