Fairgo
Last updated: 18 August 2026
This policy covers the Fairgo: Book a Ride and Fairgo Driver iOS apps and this website. It explains what data the apps handle and which companies receive it. If something here is unclear, ask us — the contact details are at the bottom.
Who is responsible for your data
The data controller decides why and how your data is used, and is the party you exercise your rights against. Send a rights request, a question or a data-protection complaint to hugomoriceau@icloud.com; that address reaches the controller and a person answers it.
The controller's registration details are not settled yet, and we would rather show you the gap than fill it with something plausible:
TODO-OWNER — legal entity: registered name, legal form, registered address, company / commercial-register number, and VAT number if there is one.
TODO-OWNER — if that entity is established outside the EU/EEA, the name and address of its Article 27 EU representative; and, Morocco being a live market, the CNDP declaration receipt number issued under Law 09-08.
TODO-OWNER — whether the size and structure of that entity require a designated Data Protection Officer (GDPR Art. 37). If one is appointed, their contact details go here.
What we collect
- Account details. Your name, your phone number and your email. Signing in with a one-time code verifies your phone number, which is also what lets your driver or rider reach you during a trip. If you use Sign in with Apple and choose to hide your address, we only ever receive Apple's private relay address.
- Location. Riders: your location when you open the app, to work out which market you are in and to set your pickup. Drivers: your location while you are online, so riders can follow the vehicle and so we can offer you nearby trips. Drivers' location is not collected while offline.
- Trip information. Pickup, destination, route, fare and trip history.
- Documents (drivers only). Licence, identity and any documents your market requires, used solely to verify you may drive.
- Photos. Only the ones you choose to attach — a profile picture or a document. We do not browse your library.
- Diagnostics. Crash and error reports, so we can fix faults.
Why we are allowed to use it
Under the GDPR every use of your data needs a legal basis. This is ours, purpose by purpose. Where local law gives you an equivalent right — Morocco's Law 09-08, for example — the same table describes the purpose and the recipients.
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Creating and running your account | Name, email (or Apple's private relay address), device push token | Performance of a contract — Art. 6(1)(b) |
| Working out which market you are in, and whether Fairgo is allowed to operate there | Your approximate location at launch | Performance of a contract — Art. 6(1)(b) |
| Matching a ride, setting the pickup, and letting the rider follow the car | Rider pickup and destination; driver location while online | Performance of a contract — Art. 6(1)(b) |
| Checking a driver may lawfully carry passengers | Licence, identity and the documents the market requires | Legal obligation — Art. 6(1)(c); and performance of a contract — Art. 6(1)(b) |
| Charging the 1% technology fee and keeping the records tax law requires | Completed trips, fares, fee and payment records | Legal obligation — Art. 6(1)(c) |
| Safety: the verification PIN, ratings, and acting on reported incidents | Trip records, ratings, reports you send us | Legitimate interests — Art. 6(1)(f): keeping riders and drivers safe from each other |
| Fixing faults | Crash and error reports | Legitimate interests — Art. 6(1)(f): keeping the app working |
| Marketing messages | Email address | Consent — Art. 6(1)(a). Off unless you switch it on, and withdrawable at any time. |
| Answering a message you send through the contact form | Everything in the form, plus the technical data listed below | Consent — Art. 6(1)(a), given by sending the form |
Who else receives your data
We name every one of them. This list is part of the policy, not a summary of it.
| Who | What they receive | Why |
|---|---|---|
| Stripe | Payment details and amounts | To take card payments and pay drivers. Fairgo never sees your full card number and never holds your money. |
| Apple | Sign in with Apple identifiers; push notification tokens and message content | To sign you in and to deliver ride notifications. |
| CARTO | Your device's IP address and the map area you are viewing | To draw the map. CARTO serves the map tiles. |
| OpenStreetMap Foundation (Nominatim) | Addresses you type when searching, and your IP address | To turn an address into coordinates and back. |
| OSRM (project-osrm.org) | Pickup and drop-off coordinates | To calculate the driving route and estimated time. |
| Telegram | Everything you put in the contact form — your name, your email address and your message — together with your IP address, your browser's user-agent string, the page you wrote from and your language setting | Contact-form messages are delivered to a Telegram channel we monitor. That channel is public: anyone can read it without a Telegram account, so please do not send anything through the form you would not put on a public page. Email us instead at hugomoriceau@icloud.com if your message is private. |
| Contabo (Germany) | Everything above, as our hosting provider | Our servers and database run there. |
| Apple Maps / Google Maps | The destination address, only when you tap "navigate" | To hand the trip to your navigation app of choice. |
Between a matched rider and driver we share only what the trip needs: the driver's first name, vehicle and plate; the rider's pickup point and first name.
Where your data goes
The database and the servers that run Fairgo are in Germany, inside the EU, at Contabo. Your trip and account data lives there.
Contabo aside, these recipients can be reached outside the EU/EEA, so sending them data is an international transfer:
- Stripe — card payments and driver payouts.
- Apple — Sign in with Apple, and push notifications through APNs.
- CARTO — the map tiles the apps draw.
- OpenStreetMap Foundation (Nominatim) — turning a typed address into coordinates and back.
- OSRM — calculating the driving route and the estimated time.
- Telegram — delivering what you write in this site's contact form.
Each of those transfers takes place under that provider's own data-processing agreement.
TODO-OWNER — for each recipient in that list, the transfer mechanism that actually applies: an adequacy decision, the EU–US Data Privacy Framework, or the Commission's Standard Contractual Clauses. Name it here. Do not state a mechanism you have not checked in the signed agreement.
TODO-OWNER — Morocco is a live market, and a transfer of personal data out of Morocco needs CNDP authorisation under Law 09-08. Confirm what has been filed and say so here.
What we never do
- We do not sell your personal data.
- We do not track you across other companies' apps or websites.
- We do not use your data for third-party advertising. There is no advertising SDK in either app.
How long we keep it
| What | How long |
|---|---|
| Detailed location trace of a completed trip (the metre-by-metre path) | 90 days after the trip, then deleted automatically by a scheduled job. |
| Account details (name, email, push tokens, saved places) | While your account is open. Deleting your account removes them. |
| In-trip messages, crash reports, saved places, scheduled rides | Deleted when you delete your account. |
| Driver documents (licence, identity, insurance) | While the account is active, and afterwards for as long as transport law in that market requires the operator to be able to show a driver was checked. TODO-OWNER: the exact period, once the entity's country of establishment is fixed. |
| Trip and invoice records (the ones tax law requires) | Kept after account deletion, detached from your name: the profile row is anonymised and the financial record survives, because it has to. TODO-OWNER: the statutory period — commonly 10 years in France and Germany — for the entity's own jurisdiction. |
Your rights
You can access, correct, export or delete your data, object to processing based on our legitimate interests, ask us to restrict processing, and withdraw any consent you have given. Deleting your account is built into both apps — Account → Delete account. It erases your personal data and anonymises what is attached to records the law makes us keep, such as invoices; those records stay, but they stop pointing at you. If you prefer, email us and we will do it for you.
You can also complain to a data-protection authority: in the EU, the supervisory authority of the country you live or work in; in Morocco, the CNDP. We would rather you told us first, but it is your right either way.
Children
Fairgo is not for anyone under 16 and we do not knowingly collect their data.
Changes
If this policy changes materially we will say so in the apps. The date at the top always reflects the current version.
Contact
Questions, requests, or a data-protection complaint: hugomoriceau@icloud.com.