Privacy Policy

1. Who controls your data

SharedRideBG is the data controller for the personal data described in this policy. For any privacy question or request, use the Contact page.

SharedRideBG is operated by MBDEV LLC, registered at [registered address], Bulgaria, EIK (company registration number) [EIK number] — the same entity described in our Terms & Conditions.

2. What we collect

• Account data: name, email address, phone number.
• Verification data: confirmation that your email and phone were successfully verified.
• Trip data: routes you search, offer, or book; dates, times, and seat counts.
• Vehicle data (drivers): make, model, year, colour, and body type of vehicles you add to your profile.
• Messages: content you send other users through in-app chat.
• Ratings: ratings and reviews you give or receive after a trip.
• Technical data: basic device/browser information and app preferences (e.g. language, theme), some of which is stored only in your browser's local storage rather than sent to us.
• Location data: if you use live location sharing during a trip, your device's location while sharing is active — visible to other people on that trip and, where relevant, to admins reviewing a safety escalation.

3. How we use it

To create and secure your account (authentication is handled by our infrastructure provider, Supabase); to match riders with drivers on the same route; to show other users the information needed to trust and complete a trip (your name, rating, and — if you're driving — your vehicle); to send you trip-related notifications; and to keep the platform safe by acting on reports of misuse.

4. Legal basis (EU/GDPR)

Bulgaria is in the EU, so we process your data under the General Data Protection Regulation. Our legal bases are: performance of a contract (running your account and matching trips), your consent (e.g. optional profile details), and our legitimate interest in keeping the platform safe and functioning.

5. Who we share it with

Other users see what's needed to complete a trip together: your name, rating, and vehicle details if you're driving — never your raw email or phone number, which stay private to the platform and, where relevant, to Supabase as our authentication and data-hosting processor. We do not sell your data to third parties or use it for advertising.

We also use Netlify to host our website. No third-party SMS provider is currently connected to the platform — phone-number verification by text message is not yet active. If we add SMS verification in the future, this policy will be updated to name the provider before it processes any data.

Our hosting providers (Supabase and Netlify) may store or process data on servers located outside Bulgaria, including potentially outside the European Economic Area. Where that happens, we rely on the safeguards those providers offer for international data transfers (such as standard contractual clauses) to keep your data protected to an equivalent standard.

6. How long we keep it

We keep account and trip data for as long as your account is active, plus a reasonable period afterward to resolve disputes or meet legal obligations. You can request earlier deletion (see Section 7).

Trip history and in-app chat messages are kept as part of your account for as long as it remains active. If you delete your account, we anonymise your personal details — including your messages — rather than deleting the underlying trip and booking records outright, where those records are still needed for another user's own trip history (for example, a completed trip a rider shared with you). Emergency-contact details and device push registrations are deleted outright.

7. Your rights

Under GDPR you have the right to access the personal data we hold about you, correct it if it's wrong, request deletion, request a portable copy, object to certain processing, and withdraw consent at any time. To exercise any of these, contact us via the Contact page. We'll respond within a reasonable time.

You also have the right to lodge a complaint with Bulgaria's data-protection supervisory authority, the Commission for Personal Data Protection (Комисия за защита на личните данни, kzld.government.bg), or with the supervisory authority in your own EU country of residence.

8. Cookies & local storage

We use your browser's local storage (not third-party tracking cookies) to remember things like your session, language choice, and theme preference. This data stays on your device.

9. Security

Authentication and data storage are handled through Supabase, which provides encryption in transit and industry-standard access controls. No online service can guarantee absolute security, but we take reasonable, standard measures to protect your data.

10. Children

SharedRideBG is not intended for anyone under 18. We do not knowingly collect data from minors.

11. Changes to this policy

We may update this policy as the platform changes. Material changes will be flagged in the app.