Privacy Policy

1. Who we are

TaxiFlow is a service provided by:

2. When TaxiFlow acts as controller and when we act as processor

TaxiFlow generally acts as a data controller when we process personal data for our own business purposes, such as operating our website, handling contact requests, sales, support, billing, security, product administration, and improvement of our own website and administration.

When TaxiFlow provides software, apps, booking systems, dispatch systems, dashboards, or related platform services to taxi companies or other business customers, the transport business decides why and how its passenger, booking, driver and staff records are used and acts as controller for that operational processing. TaxiFlow processes those records on the business’s documented instructions under its Data Processing Agreement. The business handles transport, fares, drivers, passenger privacy information and requests about its rides. TaxiFlow is a separate controller for its own sales, contract, billing and platform-security records.

3. What personal data we may collect

Depending on how our services are used, we may process the following categories of personal data:

• Identity and contact data, such as name, phone number, email address, and business details
• Business proposal and agreement acceptance evidence, including the representative's name, role and email address, acceptance time, accepted text and version, checksums, IP address and browser information
• Account and profile data, such as login details, permissions, roles, settings, and verification status
• Booking and transport data, such as pickup address, destination, booking times, ride notes, fare-related data, and booking history
• Driver and vehicle-related data, such as driver name, status, availability, vehicle information, and location data where relevant features are used
• Communication data, such as support requests, emails, forms, SMS-related operational messages, and correspondence
• Technical data, such as IP address, browser type, device details, logs, session information, and troubleshooting data
• Billing, payment, and transaction-related data where relevant services are used

4. Booking without prior login

TaxiFlow may allow users to place a booking without logging in first. In that case, the user can still submit a booking by providing the information needed to process the ride, such as phone number and booking details.

To manage the booking, communicate ride updates, reduce duplicate records, maintain service continuity, and allow the user to later access booking history, the booking service may automatically create a customer profile or account record linked to the provided phone number and related booking information, even if the user did not complete a traditional sign-up flow in advance.

5. Phone number and OTP access

Where supported, users may later access their bookings, ride history, or related account data by verifying their phone number through a one-time password (OTP) process.

We use phone number verification and OTP-based access to help confirm user identity, protect account access, and reduce unauthorized access to booking information.

6. How we use personal data

For records TaxiFlow controls, we handle enquiries, contracts, billing, support correspondence, platform security and legal obligations.

For passenger, booking, driver, staff and location data controlled by a transport business, TaxiFlow performs only the booking, dispatch, messaging, account access, support, security, backup and deletion functions provided under that business's instructions and Data Processing Agreement. The transport business decides why those operational records are used and handles its passengers and rides. TaxiFlow does not use those records for independent marketing or transport decisions.

7. Legal basis for processing

For our own controller records, we process data where necessary for a business contract, legal obligations, legitimate interests such as platform security, or consent where required. The transport business determines the legal basis for its passenger and driver processing; TaxiFlow carries out that processing under its instructions.

Where consent is required, such as for certain non-essential cookies or optional communications, you may withdraw that consent at any time.

8. How we share personal data

We may share personal data with the following categories of recipients where necessary:

• our customers and their authorized administrators where TaxiFlow is used as a platform for their business
• hosting, infrastructure, cloud, communications, messaging, security, analytics, payment, and technical service providers
• professional advisers, auditors, legal representatives, and public authorities where required by law or necessary to protect rights and safety
• business counterparties in connection with a merger, restructuring, financing, acquisition, or sale of assets where legally permitted

Stripe is used for TaxiFlow’s own setup and subscription billing. Passenger Stripe payments are not covered by this notice.

We do not sell personal data.

9. International data transfers

Some service providers or technical sub-processors may process personal data outside the EU/EEA. Where that happens, we use an applicable transfer mechanism and safeguards in accordance with applicable data protection law.

10. Retention of personal data

We retain personal data only as long as necessary for its purpose. Business agreement and acceptance evidence is kept during the contract and afterward for as long as needed to establish, exercise, or defend legal claims under applicable limitation rules. Accounting records are kept as required by law. Operational personal data that we process for a taxi company is returned or deleted under that customer's data processing agreement and documented instructions. We do not retain booking data merely because invoices must be kept.

Retention periods may vary depending on the type of data involved, such as support records, booking data, customer account records, verification logs, security logs, customer agreements, or accounting records.

11. Security

We use reasonable technical and organizational measures designed to protect personal data, including access controls, permission management, verification flows, logging, monitoring, secure development practices, and system protection measures appropriate to the risks involved.

However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Your rights

Depending on applicable law, you may have the right to request:

• access to your personal data
• correction of inaccurate or incomplete data
• deletion of personal data
• restriction of processing
• objection to certain processing
• data portability where applicable
• withdrawal of consent where processing is based on consent

You may also have the right to lodge a complaint with the relevant supervisory authority.

Where TaxiFlow is the controller, we normally respond to a request to exercise your rights within one month of receipt. Where the law permits an extension because a request is complex or requests are numerous, we may take up to two additional months. We will notify you during the first month and explain the reason for the extension. We forward requests about data controlled by a taxi operator to that operator without undue delay.

13. Account deletion and data deletion requests

Where TaxiFlow supports account or profile access, users may request deletion after verifying access to their account, including by phone number and OTP where applicable.

Because some users may first interact with TaxiFlow by booking without a prior login, deletion requests may still relate to a profile or account record that was automatically created from the first booking and linked to the submitted phone number.

If you want your account or profile deleted, you may request deletion through the app where such functionality is available, or by contacting us at info@taxiflow.io.

For transport-business booking records, we forward or coordinate requests with the responsible business and act on its lawful instructions. For records we control, after validating a request we delete or anonymize personal data that no longer needs to be retained. Certain information may need to be retained for a limited period for legal, security, fraud prevention, accounting, dispute resolution, operational integrity, or regulatory reasons.

14. Cookies and similar technologies

TaxiFlow may use cookies and similar technologies to operate the website, maintain security, remember preferences, analyze usage, and improve the user experience. Please see our Cookie Policy for more information.

15. Children’s privacy

Our services are not intended to knowingly collect personal data from children in violation of applicable law. If you believe that personal data relating to a child has been processed improperly, please contact us so we can investigate.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. The latest version will always be published on this page.

17. Contact