Privacy Policy

1. Who is responsible for your data

mytransfers is a transfer operations service for chauffeur and transport companies. It runs on the Base44 platform, which provides our hosting, database, authentication and payment infrastructure.

For the account and billing data of the company that subscribes, the mytransfers team is the data controller. For the operational data a company enters about its transfers, clients, passengers and drivers, that company is the controller and we act only as its processor.

The company that owns a workspace is the first point of contact for the people whose data appears in it.

2. What we collect

• Account data: name, email address, password (stored only as a secure hash by the platform), language and sign-in metadata.
• Workspace data: company details you enter, such as legal name, VAT number, address, phone, logo and numbering prefix.
• Operational data you enter: transfers, routes, dates, passenger counts, client and orderer contact details, partner companies, drivers and vehicles.
• Billing data: plan, amount, currency, invoice period and payment references. Card details are entered directly with Stripe and never reach us.
• Technical data: IP address, browser type, device type and error logs, kept to secure the service and to diagnose faults.

3. Data we process for a company

When a company enters personal data of its own clients, passengers or drivers, we process that data only on its instructions, only to provide the service, and only for as long as its workspace exists. We do not use it for our own purposes, we do not sell it, and we do not disclose it to anyone except the infrastructure providers listed below.

A driver who is invited into a workspace sees only the transfers that workspace assigns to them. Team permissions are set by the company administrator.

If you are a passenger or a client and want to see, correct or delete what a transport company recorded about you, please contact that company. We will support it in answering you.

4. Why we use your data

• To create and secure your account and to give you access to the workspace (performance of a contract).
• To process your subscription, confirm your payment and keep the accounting record (performance of a contract and legal obligation).
• To send sign-in codes, password resets, receipts and essential service notices (performance of a contract).
• To keep the service safe, prevent abuse and fix faults (our legitimate interest in a secure, working service).
• To answer your support requests (our legitimate interest, or your request).

5. Cookies and local storage

We use only what the service needs to work: a session token that keeps you signed in, and a small amount of local browser storage for interface preferences. We do not use advertising cookies and we do not run third-party trackers or profiling pixels on the app's pages.

You can clear this storage from your browser at any time; doing so signs you out.

6. Who we share data with

Each provider is bound to process data only for the purposes we instruct, under its own data processing terms and appropriate security commitments.

• Base44, the platform that hosts the application, database, file storage, authentication and email delivery.
• Stripe, our payment provider, which processes card payments and subscription receipts as an independent controller for payment and anti-fraud purposes.
• Our email provider, for sign-in codes, invitations and essential notices.
• Public authorities, only where we are legally required to respond.

7. Where your data is stored

Our infrastructure providers may process data on servers inside and outside the European Economic Area. Where data leaves the EEA, the transfer relies on the safeguards those providers have in place, such as standard contractual clauses.

8. How long we keep it

• Account and workspace data: while the workspace exists. A workspace that ends its subscription is kept so it can be renewed, and deleted on request.
• Billing records: for as long as tax and accounting law requires.
• Sign-in codes: a few minutes, until they expire.
• Demo trials: erased or anonymised after the trial ends.
• Technical logs: a short period, then deleted or aggregated.

9. How we protect it

Access is protected by authenticated accounts, passwords stored as hashes, role and permission checks in the application, and database rules that keep each company's records inside that company. Files a user uploads are stored privately and reached only through short-lived links. Traffic is encrypted in transit.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the competent authority as required by law.

10. Your rights

Under the GDPR you can ask for access to your personal data, correction of inaccurate data, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. You can also withdraw consent where processing relies on it, without affecting what was done before.

Write to us from the account email address and we will answer within one month. If you are not satisfied with our answer, you may complain to the Hellenic Data Protection Authority or to the supervisory authority in your country of residence.

11. Children

The service is a business tool and is not directed at children. We do not knowingly create accounts for anyone under 18.

12. Changes and contact

We may update this policy as the service develops; the date at the top of the page always shows the current version, and material changes are announced in the workspace or by email.

For any privacy question, or to exercise a right described above, contact us from the account email address and we will reply from the same domain.