Privacy Policy

GETCARTEL is a service for drivers: anonymous contact through the QR code on your windscreen, a map of road events marked by users themselves, a navigator, and roadside assistance requests. This privacy policy describes what data we collect, how we use it, who we share it with, and what rights you have regarding your personal information.

Data we collect

We only collect data necessary for the service to function:

• Phone number — Required for registration and authentication via a one-time OTP code.
• Name — Optional. You provide it in your profile so other participants can identify you.
• Vehicle data — Make, model, color, and license plate number — required for generating QR codes.
• Chat messages — Text content of conversations between drivers and people who scan the QR code.
• Location data — Device coordinates. The app asks for them while the map is open and while navigation is running. They are needed to show you on the map, build a route, find the nearest fuel stations, charging points, and parking, and to pass the coordinates to a partner when you request roadside assistance. The permission can be withdrawn in your device settings at any time — without it the map and navigation work only in part.
• Map markers and comments — The event type, coordinates, time, and the text of the comment you wrote, along with your messages in the event chat.
• Routes and saved places — The start and end points of the routes you build, their distance and duration, and the places you saved: home, work, favourites. The trace of the trip itself and your current position are not stored on the server. Route history can be cleared in the app.
• Roadside assistance requests — The coordinates of the location, the description of the problem, the vehicle details, and the contact phone number you gave in the request.
• Push notification token — A technical device identifier used to deliver push notifications.
• Payment data — The service is free at the moment: there are no paid features and we collect no payment data. Should they appear, payments will be processed natively by the Apple App Store and Google Play, and only transaction identifiers and amounts would stay with us — card details never reach us.
• Language preference — The selected interface language (Romanian, Russian, or English).
• Technical security metadata — For anonymous QR conversations, we may store conversation-level technical identifiers and network context, including IP address, proxy chain, user agent, UI language, time zone, and a first-party browser identifier, to prevent abuse, investigate incidents, and comply with legal obligations.

What other people see

The markers you place on the map and the comments on them are visible to every user of the service — together with their coordinates and the time they were created. In the event chat, the name from your profile is shown next to your message.

Do not put anything on the map you would not want to be public: your home address, your license plate, other people's photographs or contact details. A marker can be deleted in the app, but until then anyone could have seen and saved it.

A marker disappears from the map on its own once its time is up — see "Data retention".

Anonymous users

People who scan the QR code and write to the driver do not need to register and generally are not required to provide directly identifying personal data. Each anonymous user is assigned a random technical identifier, and for QR conversations we also store limited conversation-level technical metadata for security, abuse prevention, and incident investigation purposes. Optionally, the anonymous user may provide a name, but this is not required.

How we use your data

• Providing the service: authentication, vehicle management, message delivery.
• Showing the map, the events near you, and your own markers.
• Building routes and finding the nearest fuel stations, charging points, and parking.
• Passing your request to the partner who will come out to you.
• Sending push notifications about new messages and events.
• Processing payments and purchases, should paid features appear.
• Ensuring security, preventing abuse, investigating incidents, and complying with legal obligations.
• Improving service quality and fixing errors.

Data sharing with third parties

We share your data only with service providers necessary for the application to function:

• SMS provider — Phone number — for delivering authentication OTP codes.
• Expo (Push Notifications) — Push notification token and notification content — for delivering messages to your device.
• Roadside assistance partners — The coordinates of the location, the description of the problem, the vehicle details, and your contact — only on your own request and only to the provider you chose, so that they can reach you.
• Apple App Store / Google Play — Transaction identifiers and purchase state — should paid features appear. At the moment we send nothing there.
• Sentry (Error monitoring) — Technical error reports without personal data — for detecting and fixing issues.

The map background, address search, and route building all run on our own servers: coordinates do not go to Google, Apple, or any other external mapping service.

We do not share your location data with third parties for advertising or analytics. The single exception is the roadside assistance request described above.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

Data retention

We retain your data for as long as your account is active. When you delete your account, account data is removed under our deletion flows. For anonymous QR conversations, highly sensitive raw technical identifiers such as raw IP and raw user agent are kept for a limited period and then anonymized; derived correlation fields may be retained longer when needed for security and incident investigation. Authentication tokens expire automatically and are deleted upon expiration.

Events on the map live for a limited time and are then hidden: a report of an accident for 2 hours, of roadworks for 24 hours, and other types for 12 hours. After that the marker is no longer shown on the map.

Route history is capped at the most recent entries and can be cleared in the app. Saved places are kept until you delete them yourself.

Data security

We use standard technical measures to protect data: data transmission over HTTPS, JWT-based authentication, hashing of refresh tokens, encryption of selected sensitive technical identifiers, redaction of raw identifiers from logs, and server access control. However, no method of internet transmission can be guaranteed 100% secure.

Your rights

You have the following rights regarding your personal data:

• The right to access personal data we hold about you.
• The right to correct inaccurate or incomplete data.
• The right to delete your account and the data associated with it.
• The right to request a copy of your data.
• The right to withdraw consent for data processing, including location access.
• The right to lodge a complaint with the supervisory authority.

To exercise your rights, contact us at the address below.

How to delete your account

Supervisory authority

If you believe we are handling your data wrongly, write to us first and we will look into it. You also have the right to lodge a complaint with the supervisory authority: in the Republic of Moldova this is the National Center for Personal Data Protection.

Legal bases for processing

We process your data on the following bases (GDPR Article 6):

• Performance of a contract — running the service: authentication, vehicles, conversations, the map, routes, and roadside assistance requests.
• Consent — push notifications and location access; you can withdraw it in your device settings at any time.
• Legitimate interest — security, abuse prevention, incident investigation.
• Legal obligation — retaining certain records to the extent and for the period the law requires, and responding to lawful requests from the competent authorities.

Where the data is stored

Data is stored on servers in Helsinki, Finland (European Union). The map, address search, and routing servers run there too. Processing takes place within the European Economic Area; we do not transfer personal data to countries without a European Commission adequacy decision unless the safeguards required by law are in place.

A copy of your data

The app has a "Download my data" button under Profile: it produces a JSON file with everything we hold about you. It excludes credentials (their hashes are not your personal data) and other people’s identifiers, including the other side of an anonymous conversation.

Cookies

We use a single technical cookie (i18n_locale) to save your interface language preference. For anonymous QR conversations, we may also store a first-party technical browser identifier in localStorage for session continuity and abuse prevention. We do not use tracking, analytics, or advertising cookies.

Children

The service is not intended for persons under 16 years of age. We do not knowingly collect data from children. If we learn that data has been collected from a minor, we will delete it immediately.

Changes to this policy

We may update this policy periodically. The updated version will be published on this page with a new effective date. Continued use of the service after changes constitutes acceptance of the new version.

Applicable law

This privacy policy is governed by the laws of the Republic of Moldova. Any disputes shall be resolved in accordance with the applicable laws of the Republic of Moldova.

Contact

For any questions regarding data privacy, you can reach us at:

[email protected]