Privacy
Taxista is an app that gives a taxi driver a page. This notice covers the driver’s page at taxista.app and the driver app. It is written to be read, not to cover us.
Taxista is for adults. Drivers must be 18 or over to use the driver app.
If you scanned a driver’s card
- You do not create an account. Your phone gets an anonymous session that lives on this device only.
- When you ask for a ride we store the pickup and drop-off you chose, the first name you typed, how many of you there are, and the request itself. The driver sees exactly that, and nothing else about you.
- Your location is read only when you are on the page, only to place the pickup pin and, if you choose, to send the driver where you are. It is never stored as a trail.
- Destinations you have asked for are kept against your anonymous session so they are one tap next time. Clearing the site’s data on your phone ends that session; a new scan starts a fresh one.
- If you let the page send you notifications, we keep the address your browser gives us for them, so a message from your driver can reach you. Turning notifications off in the browser ends it.
- When something on the page fails, we keep a short note of the fault: what failed, the page’s version and the browser’s name and version. It carries no location, message or name, and is deleted after 30 days.
- When you first ask for a ride or send a message, we record the version of the terms you agreed to, and when.
- There are no analytics, advertising or tracking scripts on the page. The map tiles are served from our own storage on Cloudflare, which sees the request but not who you are. Address search and routing run on our own server, rented from Hetzner in Germany: it receives the words you search for and the points of the route, answers, and does not keep them. Card payment is not switched on yet; once it is, the one outside script will be Stripe’s, loaded only when you choose to pay by card.
- The map is drawn from OpenStreetMap data, © OpenStreetMap contributors; every map carries that credit, and the licences page lists the rest.
Messages between you and your driver
Messages between a family and their driver are stored so that both of you can see them. They are not end-to-end encrypted, because the service has to read them to translate them and to act on a report. We keep them for two years after your last trip with that driver, then delete them. A phone number you share is sent to the driver only when you tap to share it, and a driver’s number reaches a family only when he sends it to them.
Blocking and reports
- A driver can block a family’s session from his app. We keep that he blocked it and when, so that session can no longer ask him for a ride or message him, until he unblocks it. The block is deleted with his account.
- A driver can report a family from his app. We keep the report (who made it, about which session, and a line of up to 500 characters if he wrote one) for 180 days, and we read reports every day.
- A family can report a problem from the page’s message thread. That opens an email to team@taxista.app with the ride’s reference; we keep the email as long as it takes to deal with it.
Card payments
Card payment in the page is not switched on yet, and what follows applies only once it is. Card payments go straight to the driver through Stripe. Taxista never sees your card number and never holds the money. Stripe’s payment script loads only when you choose to pay by card. We keep the amount, the card brand and the last four digits with the trip for two years after your last trip, then delete them.
If you are a driver
- You sign in with Google. We keep the email address of that Google account, to know it is you and to answer a deletion request, and your name, photo, car, plate, town and tariff so your page can show them.
- You agree to the terms in the app before set-up finishes; we record the version and when.
- If you install the app from another driver’s invitation, Google Play passes the invitation’s code to the app, so it knows who invited you. The app reads nothing else from the install.
- When a request arrives, your position is sent once to our routing server to work out how far away you are. It is used for that answer and not kept.
- While you are on a job, your position is sent to the one passenger who asked for that ride, every few seconds, and discarded as the next one arrives. We keep the start and end of each trip, not the route you drove.
- Taxista opens Google Maps for directions with Google’s public directions link, only when you tap. It never reads, presses, closes or watches Google Maps, its notifications or any other app.
- For the request ring, the app keeps a push token from Google Firebase Cloud Messaging and a Firebase installation id. A photo you attach to feedback is kept with that feedback, and deleted with your account.
- Backup drivers you name are other Taxista drivers who agreed on their own phone. We keep who is on your list and in what order, so a request can go to them. A backup sees that request, not your guest list.
- The driver app sends crash reports to Google Firebase Crashlytics: the phone model, the app version and where the app failed, never your jobs or your guests. A short log of the app’s own state (whether location and notifications are allowed, when it last reported) is kept for three days to fix faults.
- Taxista Pro is sold through Google Play, which takes the payment; we never see your card. We keep the order, its state and its dates so your Pro months are right. If Pro ends, your backup drivers, your places and your prices are kept, switched off.
Where it lives and who sees it
Data is stored with Supabase in the European Union and the pages are served through Firebase Hosting. The companies that handle data for us are Supabase, Google Firebase, Cloudflare (the map tiles), Hetzner (our routing and address-search server, in Germany) and Stripe (card payments, once switched on). Supabase and Hetzner keep data in the European Union, which the UK recognises as adequate. Google (Firebase, sign-in and Play), Cloudflare and Stripe may process data outside the UK and the EU, under their standard contractual safeguards. Nobody at Taxista reads requests or messages except to fix a fault or act on a report, and nothing is sold or shared with advertisers.
The marketing site may keep an email or WhatsApp number you typed so we can write once, the day the app opens where you are. We keep it until you ask us to delete it, or 24 months after we last wrote to you, whichever comes first. Visit counts, if switched on, are a daily total per path and language — no IP, no fingerprint.
Why we process your data
We process a request, a trip and its messages because they are needed to provide the service you asked for (performance of the contract: the terms). We process fault notes, crash reports, blocks and reports in our legitimate interest in a service that works and is safe. Your location on the page and browser notifications are used only with your consent, which you can withdraw in the browser at any time. We keep what a law requires us to keep.
Your choices
A driver can delete their account in the app (Settings, Delete account), which deletes it at once, or on the delete-account page without the app, using the Google email they signed in with; that page lists what is deleted. A family known only through that driver is deleted with the account, and every message between them goes too. Deleting your account does not cancel a Google Play subscription: cancel your Taxista Pro subscription in Google Play first. Ask us to delete an anonymous guest session at team@taxista.app. An anonymous session that never asked a driver for a ride is deleted sixty days after it was made; one that did is deleted two years after its last trip.
Your rights
You can ask us to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a structured, commonly used format, by writing to team@taxista.app. If you think we have not answered as we should, you can complain to the Spanish data protection authority (aepd.es) if you live in Spain, to your own country’s authority, or to the UK’s (ICO).