Rutalto Privacy Policy

Version: 2026-10-09

Controller: Alin Negut, Canary Islands, Spain. Contact: alin.negut@gmail.com.

Who this applies to

This policy applies to the Rutalto Android app, the backend API, notifications, messaging, live tracking, and the access-controlled administrator, customer-support, privacy, and safety workflows that support those services.

Eligibility

Rutalto is a service for adults only. You must be at least 18 years old to create an account, offer rides, or book rides.

What we collect

• Account data: Firebase identifiers, display name, email address, phone number, authentication provider, accepted legal versions, and verification timestamps.
• Profile and trust data: profile photo, vehicle details, ratings, reviews, feedback, and safety reports.
• Ride-operation data: origin, destination, departure time, recurring commute settings, seats, fares, bookings, alerts, and trip history.
• Communications data: in-app messages between ride participants and notification history.
• Location data: route inputs and, when you explicitly enable live tracking for an active trip, short-lived live location updates.
• Operational security data: push tokens, server logs, error traces, and anti-abuse records.
• Administrator audit data: operator identity, action type, target reference, case reason, request ID, and outcome. Personal data revealed to an authorized operator is not copied into the audit record.

Authorized administrators may access masked records and, when their role and a documented case require it, reveal limited personal data or perform support, safety, identity, and privacy actions. Access and mutations are audited. The administrator application does not use analytics.

Why we process it

• Contract: to create accounts, match riders and drivers, manage rides, messages, bookings, alerts, and trip completion.
• Legal obligations: to handle complaints, lawful requests, fraud prevention records, and safety incidents.
• Legitimate interests: to secure the platform, debug production issues, prevent abuse, and maintain service quality.
• Consent: optional mobile analytics and optional mobile crash reporting are enabled only after you choose them in the app.

Recipients and processors

Rutalto uses processors including Google Firebase (authentication, messaging, analytics, crash reporting, storage), Google Maps and Places, Google Cloud Run / Cloud SQL / Cloud Storage, and Sentry for backend and Android error monitoring when enabled.

Location and live tracking

We use route origin and destination data to preview journeys and search or publish rides. Live location sharing is optional and feature-scoped: it is only used during an active ride after the user explicitly enables live tracking. Live tracking can be stopped in the app.

Retention

We keep profile, ride, booking, alert, review, and safety data only for as long as required to operate the service, investigate abuse, resolve disputes, and meet legal obligations. Short-lived artifacts such as share links, export bundles, and push-token state are retained for limited operational windows only. Administrator audit events are retained for 180 days, then removed by privacy maintenance. See the Data Processing page for the retention schedule.

Your rights

Where GDPR applies, you can request access, export, rectification, erasure, restriction, and objection using the in-app Privacy & Data section or by contacting alin.negut@gmail.com. You can also change optional telemetry preferences inside the app.

International transfers

Some processors may process data outside Spain or the European Economic Area. Where this occurs, Rutalto relies on the processor's contractual and organizational safeguards for international transfers.

Security

Rutalto uses transport encryption, access-controlled infrastructure, role-based administrator access, identity matching, limited retention, and production-observability scrubbing to reduce exposure of personal data. Administrator responses are not cached, and logs omit personal data, tokens, exact locations, messages, and case notes. No internet service can guarantee absolute security.

Updates

We may update this document when the service or legal obligations change. Material changes will be reflected through a new version and may require renewed in-app acceptance.