GoRage Privacy Policy

Română

Working draft. The fields highlighted in yellow are filled in with the company details, and the text is reviewed by a lawyer before launch.

Effective date: [DATA INTRĂRII ÎN VIGOARE]. Version 1.0.

This policy explains what personal data we process when you use the GoRage app and the related web pages (together, the "Service"), why we process it, how long we keep it, with whom we share it and what rights you have. It applies under Regulation (EU) 2016/679 (GDPR), Romanian Law no. 190/2018, Romanian Law no. 506/2004 and, for users in the United States, the state privacy laws, to the extent they apply.

1. Who we are

The data controller is [DENUMIRE SOCIETATE], registered office at [SEDIU], Trade Register no. [Nr. Reg. Com.], tax ID [CUI] ("GoRage", "we", "us").

Data protection contact: contact@gorage.app
General contact: contact@gorage.app, [TELEFON CONTACT]
Data Protection Officer (DPO): [NUME ȘI CONTACT DPO, if appointed; otherwise the address above applies]

2. Who this applies to and our role

Drivers and Guests — for account data and use of the App, we are the controller.
Business representatives — for business account data and company verification, we are the controller.
Clients of Businesses — for data that a Business manages in GoRage (bookings, clients, cars, Status Pages, including manually entered data), the Business is the controller and we are its processor (section 15).
Data sent to a Business — when you make a booking, send a request or write in chat, the chosen Business receives the necessary data and becomes an independent controller for its own activity (providing the service, invoicing, warranty).

3. What data we process

Data you give us

Account — name or display name, email address or phone number, password (stored only as a salted hash), preferred language, confirmation that you are at least 16.
Cars — plate number, make, model, year, colour, optional VIN, photos.
Bookings, requests and chat — date and time, the chosen Business, description of the problem, photos, messages.
Reviews — rating, text, date and display name.
Favourites and preferences — saved Businesses, notification settings.
Business — company name, CUI, Trade Register number, address, contact person details (name, email, phone, role), documents submitted for verification, map pin, photos, logo, opening hours, prices, description.
Support — the content of messages you send us.

Data collected automatically

Device location — precise location, only while the App is in use and only with your permission.
Technical data — IP address, device type and operating system, App version, notification identifier (push token), sign-in and error logs.
Local storage — the App keeps some data on your device (for example, your session, settings, a Guest's favourites) that is strictly necessary for it to work. We do not use tracking cookies.

Data received from third parties

Apple or Google — when you use Sign in with Apple or Google, we receive your name and email address (with Apple, this may be a private relay address).
Stores and RevenueCat — subscription status, trial period, renewal dates and transaction identifiers, without card data.
Businesses — a Business may enter your data as a client (name, phone, car) and updates the status of the work on your car, which you see on the Status Page.
Public sources — public company data (for example, from ANAF, by CUI) and map data from OpenStreetMap.

We do not collect national identification numbers, bank card data or special categories of data.

4. Purposes, legal bases and retention periods

4.1 Creating and managing your account

Data: account data, preferences.
Legal basis: performance of the contract, Art. 6(1)(b) GDPR.
Retention: while you have an account. After deletion, 14 days for restoration, then permanent deletion within no more than 30 days.

4.2 Sign-in, security and fraud prevention

Data: email or phone, verification codes, IP address, device data, sign-in logs.
Legal basis: performance of the contract and our legitimate interest in protecting accounts and the Service, Art. 6(1)(b) and (f).
Retention: verification codes until they expire (minutes); security logs 90 days, longer only if needed to investigate an incident.

4.3 The map and nearby businesses

Data: precise location (only while in use), search text, the map area shown, IP address (technically passed to map providers).
Legal basis: your consent to location access, given through your phone's permission (Art. 6(1)(a) GDPR and Art. 4(5) of Romanian Law no. 506/2004); performance of the contract for searches.
Retention: we do not store your location history on our servers. Your location is used in real time and may remain temporarily only on your device. Map providers may keep technical logs under their own policies.

4.4 Your cars and favourites

Data: car details, photos, favourites.
Legal basis: performance of the contract, Art. 6(1)(b).
Retention: until you delete them or delete your account.

4.5 Bookings and repair requests

Data: name, phone, car details, description, photos, the chosen Business or area, date, time, status.
Legal basis: performance of the contract, Art. 6(1)(b). The data is sent to the Businesses you choose.
Retention: the history stays in your account while you have one. Unanswered requests expire after 30 days and are deleted 90 days after expiry. Copies received by Businesses are kept under their own policies.

4.6 Chat

Data: messages, photos, date and time, participants.
Legal basis: performance of the contract, Art. 6(1)(b).
Retention: while the conversation is available in the account of at least one participant, but no longer than 24 months from the last message. [TO BE CONFIRMED]

4.7 Status Page

Data: plate number, make and model, client's name, status and list of works.
Legal basis: performance of our contract with you, Art. 6(1)(b). The page is visible only in your Driver account, in real time, not through a public link. The Business updates the status as controller, for its own business.
Retention: together with the booking, in your account history (section 4.5). The underlying data remains in the Business's account as described in section 15.

4.8 Reviews

Data: rating, text, display name, date, the Business reviewed.
Legal basis: performance of the contract (publication at your request) and our legitimate interest in ensuring reviews are authentic and lawful, Art. 6(1)(b) and (f).
Retention: while the review is published. When you delete your account, your reviews are deleted.

4.9 Push notifications

Data: push token, notification preferences.
Legal basis: your consent, given through your phone's permission, to receive notifications; performance of the contract for the content of notifications about bookings, requests and messages.
Retention: until you turn notifications off, sign out, uninstall the App or the token expires.

4.10 Business accounts and verification of Locations

Data: company data, contact person details, verification documents, public ANAF data, public profile.
Legal basis: performance of the contract with the Business; for the contact person, the legitimate interest of the company and of GoRage in communicating; the legitimate interest in preventing fraud and protecting Drivers by verifying companies, Art. 6(1)(b) and (f).
Retention: the public profile is deleted with the account. Verification records are kept for the life of the account plus 3 years (the general limitation period, Art. 2517 of the Romanian Civil Code).

4.11 Subscriptions

Data: the pack chosen, status, trial and renewal dates, transaction identifiers, country or currency, the RevenueCat user identifier. We do not receive card data.
Legal basis: performance of the contract and legal accounting obligations, Art. 6(1)(b) and (c).
Retention: for the duration of the subscription. Accounting records are kept for 5 years, counted from 1 July of the year following the end of the financial year (Art. 25 of Romanian Accounting Law no. 82/1991), and annual financial statements for 10 years.

4.12 Support, complaints and requests about your rights

Data: contact details, the content of the request, attachments, our replies.
Legal basis: performance of the contract, legal obligations (GDPR, consumer protection) and our legitimate interest in defending our rights, Art. 6(1)(b), (c) and (f).
Retention: 3 years after the request is closed.

4.13 Content moderation and reports

Data: reported content, name and email of the person reporting, the decision, the statement of reasons, identifiers of the accounts involved.
Legal basis: the legal obligation under Regulation (EU) 2022/2065 (Digital Services Act) and our legitimate interest in preventing abuse, Art. 6(1)(c) and (f).
Retention: 3 years from the decision. Records of a suspension, for its duration.

4.14 Service messages

Data: email, phone, push token, message content.
Legal basis: performance of the contract and legal obligations (for example, notifying changes to the Terms), Art. 6(1)(b) and (c).
Retention: sending logs for 12 months.

4.15 Marketing

Data: email or phone, preferences.
Legal basis: only your consent, Art. 6(1)(a), which you can withdraw at any time.
Retention: until you withdraw consent. Proof of consent and withdrawal is kept for 3 years.

4.16 Legal obligations and defending our rights

Data: the data relevant to a legal obligation, an authority's request or a dispute.
Legal basis: legal obligation and our legitimate interest in establishing, exercising or defending legal claims, Art. 6(1)(c) and (f).
Retention: as long as required by law or, for disputes, until they are finally resolved.

5. Device permissions

Location — only "while using the app". We do not use your location in the background. Without permission, you can search manually.
Camera and photos — only when you choose to add a photo. Photos may contain metadata, such as the place where they were taken. [We automatically remove this metadata on upload.] [TO BE CONFIRMED]
Notifications — only with your consent.

You can change these permissions at any time in your phone settings.

6. What is visible to others

Public — reviews (with your display name), Business profiles and verified Locations.
The Business you choose — the data you send it through bookings, requests and chat.

7. Who we share data with

We do not sell personal data, we do not show ads and we do not track you across other apps or websites. We share data only with:

The Businesses you choose — independent controllers for their own activity.
Cloud infrastructure and database — Supabase Inc., in the Ireland (EU) region, as processor.
Maps, search and routing — OpenFreeMap (map tiles with OpenStreetMap data), Photon (komoot GmbH, Germany), Nominatim (OpenStreetMap Foundation), Overpass API, OSRM (routing) and, later, possibly Google Maps Platform (Google). They receive directly from your device your IP address and the area, coordinates or search text, and may keep technical logs under their own policies.
Vehicle model list — NHTSA vPIC (U.S. Government). We do not send personal data, but the service may see your device's IP address.
Navigation and messaging — Apple Maps, Google Maps, Waze and WhatsApp, only when you choose to open them. They are independent controllers.
Apple and Google — sign-in, Store payments, delivery of push notifications (Apple Push Notification service, Firebase Cloud Messaging).
[Expo Push Service — 650 Industries, Inc., USA, if used for notifications] — processor.
RevenueCat, Inc. (USA) — subscription management, processor.
Email and SMS — Resend, for verification, password reset and service messages, processor.
ANAF — we query public company data by CUI, without sending any Driver data.
Advisers — accountants, lawyers, auditors bound by confidentiality.
Authorities — when the law requires it or to defend our rights.
Successors — in the event of a merger, acquisition or sale of the Service, with prior notice to you.

The up-to-date list of processors is available on request at contact@gorage.app.

8. Transfers outside the European Economic Area

We store the main data in the European Union. Some providers (for example Apple, Google, RevenueCat, Expo, NHTSA) are located in the United States or may access the data from there. In those cases, transfers rely on:

The EU–U.S. Data Privacy Framework, for certified recipients. The adequacy decision is in force: the EU General Court dismissed the action for annulment on 3 September 2025, and an appeal is pending before the Court of Justice of the EU. If the situation changes, we will use other safeguards;
Standard contractual clauses adopted by the European Commission, with supplementary measures where needed;
Adequacy decisions for other countries, for example the United Kingdom, whose adequacy decision was renewed by the European Commission in December 2025.

You can request a copy of the safeguards applied at contact@gorage.app.

9. Deleting your account and data

Delete your account in the App: Account → Account details → "Delete account", then type DELETE. You can also request deletion without the App, at gorage.app/delete-account or at contact@gorage.app.
The account is deactivated immediately. You can restore it by signing in within 14 days. After that, we permanently delete the account data (profile, cars, favourites, bookings, chat, reviews and, for Businesses, client data) within no more than 30 days.
Backups are automatically overwritten within 35 days.
We keep only data the law requires us to keep (for example, accounting records), company verification records and data needed to defend a legal claim, for the periods in section 4.
If you signed in with Sign in with Apple, on deletion we also revoke GoRage's access to your Apple account.
Please note: deleting your account does not cancel your App Store or Google Play subscription. Cancel it separately from your Store account.

10. Data security

Passwords are stored only as salted hashes. We cannot read them.
Data is encrypted in transit (TLS). Access is restricted by database-level rules, so each Business sees only its own data, and our staff have access only when necessary.
We use backups, monitoring and security updates.
We do not receive or store card data. Payments are processed by Apple or Google.
In the event of a personal data breach, we notify ANSPDCP within 72 hours where the law requires it, and we inform you without delay if there is a high risk to you.

No system is perfectly secure. Use a unique password and tell us immediately if you notice anything suspicious.

11. Your rights

Under the GDPR, you have the right:

to access your data and receive a copy;
to have inaccurate data rectified;
to have your data erased ("right to be forgotten");
to restrict processing;
to data portability, in a structured, commonly used format;
to object to processing based on legitimate interest and, at any time, to direct marketing;
to withdraw your consent at any time, without affecting earlier processing;
not to be subject to a decision based solely on automated processing that produces legal effects concerning you.

Send your request to contact@gorage.app or use the settings in the App. We reply free of charge within one month, which may be extended by two further months for complex requests, in which case we will tell you. We may ask for information to confirm your identity.

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, postal code 010336, anspdcp@dataprotection.ro, www.dataprotection.ro, or with the data protection authority of the country where you live or work.

12. Automated decisions

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Verification of a Business may include an automated check of the company's public data, always followed by a human review. The order of results on the map follows the criteria described in the Terms and is not based on profiling you.

13. Children

The Service is not intended for persons under 16 and we do not knowingly collect data from children under 13. If we learn that we have received such data, we delete it. If you are a parent and believe your child has given us data, write to us at contact@gorage.app.

14. Messages and marketing

You receive service messages (verification, password reset, booking confirmations, changes to the Terms) as part of the contract.
We send marketing messages only with your consent. Every marketing email contains an unsubscribe option and our postal address, and unsubscribe requests are processed within 10 business days at the latest.
You can turn off push notifications at any time in your phone or App settings.

15. Data processed on behalf of Businesses

When a Business manages its clients' data in GoRage, the Business is the controller and is responsible for the legal basis and for informing its clients. We process this data only on its instructions and under the data processing agreement in the Terms (Art. 28 GDPR).

If you are a client of a Business and want to exercise your rights, contact the Business. If you contact us, we forward your request to the Business and help it respond.

The data is kept while the Business has an account. If the subscription expires but the account remains, we keep the data for 12 months so the Business can resume, then delete it after prior notice. When the Business account is deleted, the data is deleted as described in section 9.

16. Your rights in the United States

This section applies to residents of California and other U.S. states with privacy laws, to the extent those laws apply to us.

Categories of data

In the last 12 months we collected the following categories of data, from the sources and for the purposes described in sections 3 and 4, kept as set out in section 4:

Identifiers — name, email, phone, account and device identifiers, IP address.
Customer records — account and car data.
Commercial information — bookings, requests, subscription history.
Electronic activity — interactions with the App, technical logs.
Geolocation — precise location, only while in use, not stored on our servers.
Audio-visual information — uploaded photos.
Professional information — data of Business representatives.
Sensitive personal information — account log-in credentials and precise location, used only to provide the Service you request, not to infer characteristics about you.

We disclosed these categories, for business purposes, only to the service providers and contractors listed in section 7.

No sale or sharing

We do not sell or "share" personal information (including for cross-context behavioural advertising) and have not done so in the last 12 months. We do not sell or share the personal information of consumers under 16. On our web pages, we honour the Global Privacy Control signal as a valid opt-out request, even though we do not carry out such activities.

Your rights

Depending on the state where you live, you have the right to know what data we process and to access it, to request its correction and deletion, to receive a portable copy, to opt out of sale, sharing or targeted advertising, and not to be discriminated against for exercising your rights. We do not use sensitive data for purposes that would trigger the right to limit its use.

Send your request to contact@gorage.app with the subject "US Privacy Request". We verify your identity using your account details. You can also act through an authorised agent, with proof of authorisation. We reply within 45 days, with a possible extension of a further 45 days, in which case we will tell you. If we deny your request, you can appeal by replying to our message. If you are still not satisfied after the appeal, you can contact your state's Attorney General.

Children under 13

The Service is not directed to children under 13 and we do not knowingly collect their data, in line with the Children's Online Privacy Protection Act (COPPA).

17. Users in other countries

We apply the same protections to all users, regardless of country. If the law of your country gives you additional rights, write to us and we will respect them.

18. Changes to this policy

We may update this policy. We will notify you in the App and, for important changes, by email before they apply. If a change requires your consent, we will ask for it.

19. Contact

For any question about your data: contact@gorage.app. Postal address: [DENUMIRE SOCIETATE], [SEDIU].