1. Introduction
AVA ("we", "us", "our") is a Swiss designated-driver mobile application that connects riders who cannot drive (for reasons such as alcohol consumption) with drivers who drive the rider's own car. This Privacy Policy explains what personal data we collect, why, how we store it, and your rights under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).
2. Data we collect
When you sign up (via Google OAuth):
- Full name (as provided by your Google account)
- Email address
- Profile picture URL (public URL served by Google)
When you use the app as a rider:
- Pickup and destination locations (address text + GPS coordinates) for the rides you request
- Ride history (dates, distances, statuses, fare amounts)
- Ratings you give to drivers
When you use the app as a driver:
- Real-time GPS location (only while you are marked "online" in-app)
- Car model and license plate (provided by you)
- Ride history and earnings
- Ratings you give to riders
Automatically collected:
- Language preference (stored locally on your device)
- Country selection
- Session token (stored locally on your device; never transmitted except to our backend)
We do NOT collect:
- Payment card data (donations are made directly through your own banking app via QR code; we never see your card or IBAN details)
- Passwords (we only use Google OAuth)
- Photos, contacts, calendar, or files from your device
- Advertising IDs
- Any biometric information
3. How we use your data
- To provide the service: match riders with drivers, calculate distance-based fares, display ride history, enable ratings.
- To communicate with you: send transactional emails (e.g. ride confirmations). No marketing without your explicit opt-in.
- To improve the app: aggregate usage statistics (anonymized).
- To comply with legal obligations: retain records required by Swiss law (accounting, anti-fraud).
We do NOT sell your personal data to third parties, ever.
4. Legal basis (GDPR)
- Contract performance (Art. 6(1)(b) GDPR): providing you the service you signed up for.
- Legitimate interest (Art. 6(1)(f) GDPR): security, fraud prevention, app improvement.
- Legal obligation (Art. 6(1)(c) GDPR): tax and accounting records.
5. Data retention
- Account data: retained while your account is active, deleted 30 days after you request account deletion.
- Ride history: retained for 10 years as required by Swiss accounting law (Code of Obligations Art. 958f).
- Session tokens: expire after 7 days of inactivity.
- Anonymized aggregate statistics: retained indefinitely.
6. Data sharing
We share data only with:
- Google LLC — for OAuth authentication only. Google receives no data about your rides.
- MongoDB Atlas — our database provider (data stored in EU region).
- Emergent Agent (hosting) — our application infrastructure provider. Powered by emergent . Cel ce Observă
- Swiss / EU tax authorities — only if legally required.
- Law enforcement — only in response to a valid legal request.
We do NOT share data with advertising networks, data brokers, or social media platforms.
7. Data storage & security
- All data is stored on servers located in the European Union (Ireland/Frankfurt).
- All connections use TLS 1.2+ encryption in transit.
- Passwords are not stored (we use Google OAuth).
- Access to production data is limited to the platform owner and requires 2FA.
8. Your rights (GDPR / FADP)
- Access — request a copy of all data we hold about you.
- Correction — request correction of inaccurate data.
- Deletion — request account deletion (right to be forgotten).
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — for any processing based on consent.
To exercise these rights, email bogdan.tanase.ch@gmail.com. We respond within 30 days.
You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch
9. Children
AVA is not intended for children under the age of 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us to delete it immediately.
10. International transfers
If your data is transferred outside Switzerland/EEA (rare), it will be protected by adequate safeguards such as EU Standard Contractual Clauses.
11. Payment information
Donations to AVA are made directly from your banking app to the platform's Swiss IBAN via QR code. AVA never sees your card details, does not process card payments, and does not store any payment credentials.
The rider–driver cash payment (90% of the fare) happens entirely off-platform between the two individuals. AVA does not process, hold, or track this cash payment.
12. Location data
- Riders: location is used only when actively booking a ride, to show pickup/destination on the map. Not tracked in the background.
- Drivers: location is transmitted only when you toggle "online". Turn off the online switch to stop location transmission immediately.
- Historical location data older than 90 days is anonymized.
13. Changes to this policy
If we materially change this policy, we will notify you in the app and via email at least 30 days before changes take effect.
14. Contact
For any privacy question or request:
- Email: bogdan.tanase.ch@gmail.com
- Postal: Bogdan Tanase — Zürich, Switzerland (correspondence via email)