Privacy Policy

At TransfersManager, we value and respect your privacy. This Privacy Policy describes how we collect, use, process, and share your personal information through our platform, website, and services.

We collect two types of information: (1) information you provide, and (2) information we collect automatically.

2.1 Information you provide

When you register and use our services, you may provide us with:

Account information: your name, email, password, and other contact information.

Profile information: your company, position, location, and preferences.

Payment data: information about your credit card, billing address, and transaction history.

User-generated content: any information you share in forms, messages, or when interacting with our platform.

2.2 Information collected automatically

When you interact with our services, we automatically collect certain information, including:

Device information: device type, operating system, browser, and settings.

Usage information: how you interact with our services, pages visited, time spent, and actions taken.

Location information: general location based on your IP address or more precise location if you allow it.

Cookies and similar technologies: we use cookies and other technologies to collect information about your activity. See our Cookie Policy for more information.

We use the information collected to:

Provide, maintain, and improve our services.

Process transactions and manage your account.

Send notifications, updates, and service-related communications.

Personalize your experience and offer relevant content and features.

Analyze and improve the security of our services.

Comply with legal obligations and resolve disputes.

We may share your information in the following circumstances:

With service providers who help us operate, improve, or maintain our services.

With business partners, with your consent, to offer you related services.

In response to legal processes or requests from government authorities.

To protect our rights, privacy, security, or property, as well as those of our users or others.

In connection with a corporate transaction, such as a merger, acquisition, or sale of assets.

Depending on your location, you may have certain rights related to your personal information, including:

Accessing your personal information.

Correcting inaccurate or incomplete information.

Deleting your personal information.

Restricting or objecting to the processing of your information.

Requesting data portability.

Withdrawing your consent at any time.

To exercise these rights, contact us through the means provided in the "Contact" section. To delete your account, see the Delete my account page.

We implement technical, administrative, and physical security measures designed to protect your personal information against unauthorized access, destruction, or alteration. However, no system is completely secure, so we cannot guarantee the absolute security of your information.

We may update this Privacy Policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the new Privacy Policy on this page and, where appropriate, by sending you a notification.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at [email protected].

The controller of your personal data is Codelabs Studio S.L., tax ID B88708797, registered office at Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre, Málaga (Spain), registered in the Registro Mercantil de Málaga (Companies Registry of Málaga), sheet MA-198508, entry 1.

For anything concerning this policy or how your data is handled, write to [email protected].

This policy is governed by Regulation (EU) 2016/679 (GDPR) and by Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).

Performance of a contract (Art. 6(1)(b) GDPR): data needed to handle your booking and deliver the transfer, or to maintain your subscription as an operator. Kept for the duration of the relationship.

Legal obligation (Art. 6(1)(c)): billing records are kept for the periods required by Spanish commercial and tax law, generally six years from the last entry.

Legitimate interest (Art. 6(1)(f)): fraud prevention and platform security. You may object to this processing at any time.

Consent (Art. 6(1)(a)): non-essential cookies and marketing messages. You can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

Founding operators program applications: if you fill in the form of that program, we process the data you give us (company, name, job title, area, fleet size, how you take bookings, email, phone, language and preferred channel) to answer your application, and we keep it for as long as the relationship lasts or until you ask for its erasure. If you also tick the optional box for commercial communications, we process that data to send them to you on the channel you choose (Art. 6(1)(a) GDPR and Art. 21 of the Spanish LSSI) and we keep, as proof, the date, language, channel, the exact text you accepted and a truncated IP address. The controller is Codelabs Studio S.L., Málaga (Spain). You can withdraw your consent at any time.

We rely on providers that process data on our behalf under a data processing agreement: Stripe (payment processing), Resend (transactional email), Cloudflare (content delivery and protection), Hetzner Online GmbH (infrastructure hosting, in Germany), Telnyx (masked-number voice calls), Google Firebase (push notifications in the mobile apps) and Mapbox (maps, navigation and route calculation).

Account authentication runs on our own software hosted on our European infrastructure. When you use the voice assistant, the conversation is processed through AgenteUno, a service of the same group. Error tracking for the apps (Sentry/GlitchTip) runs on software hosted on our own infrastructure. The transcription of voice feedback notes is done with our own software (Whisper) hosted on our infrastructure.

International transfers: Stripe, Cloudflare, Telnyx, Google Firebase and Mapbox may process data outside the European Economic Area. Those transfers rely on the Standard Contractual Clauses approved by the European Commission and on the supplementary measures those providers document. Database and application hosting remain within the European Union.

Cerebras Systems Inc. (processor, headquartered in Sunnyvale, California, United States) processes the text of conversations with Tamara, the AgenteUno voice and chat assistant, to generate its replies. That text may contain the personal data you mention during the conversation (for example your name, phone number, email or trip details). The transfer to the United States relies on the European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) incorporated in its data processing addendum, available at https://www.cerebras.ai/dpa.

Google LLC (Google) acts as a processor in two uses: (1) Tamara's voice, which runs on Gemini Live and receives the audio of the conversation in order to understand it and reply; and (2) the analysis of the transcript of voice feedback notes and the extraction of contact details from demo requests, which we do with Gemini on Google Vertex AI, in a European Union region, through our language-model gateway. Google LLC is listed as a participant in the EU-U.S. Data Privacy Framework and its data processing addendum incorporates Standard Contractual Clauses (https://cloud.google.com/terms/data-processing-addendum) for transfers outside the European Economic Area.

Anthropic PBC (processor, United States) processes text with the Claude model in the website builder, the support assistant and, as an alternative provider, in chat message translation, reading of booking emails, feedback analysis and extraction of contact details from demo requests. That text may contain personal data of passengers and operators. The transfer to the United States relies on the European Commission Standard Contractual Clauses (Implementing Decision (EU) 2021/914) incorporated in its data processing addendum, available at https://www.anthropic.com/legal/data-processing-addendum.

We do not sell your personal data and we do not share it with third parties for advertising purposes.

In addition to the rights described in section 5, you may lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, if you believe your data is not being handled lawfully.

Before going to the AEPD you can contact us at [email protected]: we will try to resolve any issue directly and as quickly as we can.

This section describes the data processed by our iOS and Android apps TM Conductor (drivers) and TM Pasajero (passengers). It supplements the rest of this policy; the data controller is the one named in section 9.

13.1 TM Conductor (driver app)

Precise location. While you have an active assigned service, the app collects your precise location, including in the background with the screen off. We send it to our servers and it is shown to dispatch and to that service's passenger. Collection stops when the service ends. iOS shows the blue location indicator while the app uses it. Outside an active service we do not collect your location continuously. If you use the SOS button or share your location in chat, a one-off location is sent.

Camera and photos. For your profile photo, driver and vehicle documents, and QR code scanning.

Microphone. For in-app voice calls with dispatch and passengers. They are set up through our own WebRTC/TURN relay. Calls using a masked phone number are placed through Telnyx, which acts as a processor.

Chat messages with dispatch and with the passengers of your services.

Push token and device data. We use a push notification token (Firebase Cloud Messaging, by Google) and the device model and operating system version to deliver notifications and handle support requests.

Face ID / Touch ID. Biometric authentication is processed on your device only. We never receive biometric data.

Maps and navigation. Navigation uses maps from Mapbox, which receives the route coordinates and its SDK telemetry.

13.2 TM Pasajero (passenger app)

Precise location. Only while you are using the app and during your trip, to show you on the map, help the driver find you ("I'm here" button) and share your position with the assigned driver. We do not collect it in the background.

Saved addresses, profile photo and support attachments that you choose to add.

Microphone. For in-app calls with your driver.

Chat messages with your driver.

Push token (Firebase Cloud Messaging, by Google) to send you notifications about your booking.

Card payments. Processed by Stripe. Card details go directly to Stripe and we do not store them.

Error diagnostics. When enabled, we send crash reports to an error tracking service (Sentry/GlitchTip) hosted on our own infrastructure, without advertising identifiers.

Routes and address search. To calculate routes we use Mapbox and our own routing servers, and for address search we send the text you type.

13.3 Common to both apps

We do not track you across apps or third-party websites, we do not use the advertising identifier (IDFA) and we do not sell your data.

You can request deletion of your account from within each app (Profile > Delete my account) or by emailing [email protected]. For drivers, the request is reviewed manually because of tax and transport-record obligations; the data concerned is kept only for the periods set out in section 10.