1. Who is responsible for your data
The controller of your personal data is Cosmic Threads, Lda. (NIPC
518048373), with registered office at Rua José António Cruz, 112 1º Esq., 4715-343 Braga, Portugal,
which provides the OkCommuter app and website (the "Service"). For any question about your data write to
[email protected].
This policy explains which data we process, why, on which legal basis, who receives it, for how long we keep it
and what your rights are (articles 13 and 14 of the General Data Protection Regulation, "GDPR"). Using the
Service does not mean you consent to anything: where we rely on consent we ask for it separately.
2. Data we collect
2.1 Account
- First name, last name, email, mobile phone number (verified by SMS) and password (stored only as a hash);
- date of birth (to confirm you are 18 or older) and, if you give it, gender;
- if you sign in with Google or Apple: the identifier, name and email they give us;
- the version of the Terms of Service you accepted and when.
2.2 Profile
- Profile photo, if you add one, and whether you use the app as driver or passenger.
- The app does not currently process payments. If you set up a payment account in an earlier version of the
app, that account is held by Stripe (see section 4) and we delete it when you delete your OkCommuter account.
If we enable in-app payments in the future, we will update this policy before collecting any payment data.
2.3 Rides and location
- Origin and destination addresses and their coordinates, dates and times of the rides you offer, request or are matched with, the number of seats and the amounts;
- the addresses you type in the search boxes, and your device location when you use "my location" (only while you use that feature, and only if you allow it on your device).
2.4 Groups and companies
- The groups or companies you belong to (for example through your work email domain or an invitation), your member/employee number if your group uses one, and whether you administer a group.
2.5 Communications
- The messages you exchange in the in-app chat;
- the ratings and comments you give and receive;
- what you send us through the support, suggestion and report forms (including attachments such as photos, videos or documents) and by email;
- the emails of friends you invite.
2.6 Device and technical data
- Device identifier and push notification token;
- IP address, browser or app version and server logs;
3. Why we use your data and on which legal basis
- Creating and managing your account, matching drivers and passengers, the chat, ratings and notifications about your rides — necessary to perform the contract with you (GDPR art. 6(1)(b)). Matching is done automatically by comparing routes, dates and distance; it does not produce legal effects on you and you always decide whether to accept a match.
- Verifying your phone number and your age — contract (art. 6(1)(b)) and our legitimate interest in keeping the community safe (art. 6(1)(f)).
- Groups of client organisations: showing you the rides of your group and giving the organisation the information in section 5 — our and your organisation's legitimate interest in running its mobility programme (art. 6(1)(f)).
- Handling support requests, suggestions, reports of illegal content and complaints, and moderating the Service — contract, legal obligations under the Digital Services Act and consumer law (art. 6(1)(c)) and our legitimate interest in keeping the Service safe (art. 6(1)(f)).
- Preventing fraud and misuse, keeping the Service secure and defending legal claims — legitimate interest (art. 6(1)(f)).
- Service emails (welcome, ride confirmations, rating reminders, changes to the Terms) — contract (art. 6(1)(b)).
- Measuring the use of the website with Google Analytics — your consent (art. 6(1)(a)), see section 10.
- Push notifications — contract, and only if you allow notifications on your device.
Where we rely on legitimate interest you can object at any time (section 8). Giving the account data is required
to sign up; without it we cannot provide the Service.
4. Service providers
We use the following providers. Most act on our behalf as processors, under contract and only following our
instructions; Google and Apple are, for part of their processing, independent controllers under their
own privacy policies.
- Twilio (Twilio Inc., USA) — sending the SMS verification code.
- Zoho (Zoho Corporation) — sending our emails and receiving support emails.
- Google (Google Ireland Ltd.) — Sign in with Google, push notifications (Firebase Cloud Messaging) and, with your consent, Google Analytics on the website.
- Apple (Apple Distribution International Ltd., Ireland) — Sign in with Apple and push notifications on iOS.
- Mapbox (Mapbox, Inc., USA) — maps, address search and route calculation (receives the addresses and coordinates you search for).
- Stripe (Stripe Payments Europe, Ltd., Ireland) — only for users who set up a payment account in an earlier version of the app: it keeps that account (name, email, address and payment method) until you delete your OkCommuter account, and its own records of any past payments as the law requires.
- DigitalOcean (DigitalOcean, LLC) — hosting: the servers where the Service and its database run are in the Netherlands (EU).
5. Who else can see your data
- Users you are matched with see your first name, photo, rating, the pickup and drop-off points and times of the shared ride, your phone number once the ride is confirmed, and the messages you send them.
- Your organisation: companies and organisations (for example employers) can subscribe to OkCommuter,
under their own contract with us, and have a private group for their members. The organisation only receives
aggregated, anonymised metrics about its group (for example monthly totals of members taking part, rides as
driver and as passenger, and amounts); these never include names, emails, addresses or individual rides, and
months with fewer than 3 members show no figures. To manage who belongs to the group, the group's
administrators can see the member list (name, email, member number if the organisation uses one, and joining
date), but not your rides, messages or ratings. You can ask the group's administrators, or us at
[email protected], to remove you from the group at any time; deleting your account also removes you.
- Authorities and courts, when the law requires it or to protect the life or safety of someone.
- A buyer or successor of our business, if it is sold or merged, under this policy.
We do not sell your personal data or use it for advertising.
6. How long we keep your data
- While your account is open we keep your profile, your rides (addresses, coordinates and dates),
your chat messages and ratings, so that you and the people you rode with can see your history. We do not delete
them automatically while the account is open.
- When you delete your account, we immediately delete or anonymise your profile, phone, email, sign-in
links, device tokens, the chat messages you sent, the addresses and coordinates of your rides, the comments in
ratings and your group memberships. The anonymised records of past rides and the rating scores (without
comments) are kept for statistics.
- Support, report and complaint messages are kept in our support mailbox for 3 years
after the matter is closed, to handle follow-ups and legal claims.
- Server logs are kept for 31 days.
7. Security
We protect your data with encrypted connections (TLS), hashed passwords, access restricted to the people who need
it and regular updates. No system is completely secure; if a breach puts your rights at risk we will tell you and
the CNPD as the law requires.
8. Your rights
Under the GDPR you have the right to:
- access your data and get a copy — in the app (Profile → Security → Download my data) or on the website (Account → Personal data);
- rectify inaccurate data;
- erase your data — delete your account in the app (Profile → Security → Delete account) or on the website;
- data portability — the download is a structured, machine-readable JSON file;
- restrict processing and object to processing based on legitimate interest;
- withdraw consent at any time, without affecting what was done before.
For anything else write to [email protected]; we answer within
one month. You also have the right to lodge a complaint with the Portuguese data protection authority,
Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa,
www.cnpd.pt, or with the authority of the EU
country where you live or work.
9. Age
OkCommuter is only for people aged 18 or over. If we learn that an account belongs to someone younger, we close
it and delete its data. If you think a minor gave us their data, please contact us at
[email protected].
10. Cookies
Our website uses cookies and similar technologies. Cookies we use include:
- Essential cookies — Required for the website to function (e.g., session management, authentication, and remembering your cookie choice). These do not need your consent.
- Analytics cookies — Help us understand how visitors use the website (via Google Analytics), such as pages visited and time spent. These are only set if you accept them in the cookie banner.
When you first visit the website we ask whether you accept analytics cookies; rejecting is
as easy as accepting, and the website works the same either way. You can change your choice
at any time with the Cookies link at the
bottom of every page.
11. International Data Transfers
Our servers are in the European Union (Netherlands). Some providers (for example Twilio and Mapbox, and Google,
Apple, DigitalOcean and Zoho for part of their services) may process data outside the European Economic Area, notably in the United States. In that case the transfer
relies on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework, for
certified companies) or on the Standard Contractual Clauses approved by the Commission. You can ask us for a copy
of the safeguards at [email protected].
12. Changes to This Policy
When we change this policy we update the version and date at the top of this page and, if the changes are
important, we tell you by email or in the app before they apply. Where a change requires your consent we will ask
for it.
13. Contact Us