Draft for legal review, not yet in force. Written against the GDPR (EU/EEA, including Norway). Text in [square brackets] is a placeholder or a question for the reviewer. The site's /privacy page shows this file, including this note, until it is approved.
Open questions for the reviewer:
- The controller's legal name, address, organisation number and contact email.
- Whether a data protection officer is required (probably not at this scale).
- The hosting provider for the web app (not chosen yet) and the Supabase region.
- Each processor's transfer mechanism (EU–US Data Privacy Framework or standard contractual clauses) and that a data processing agreement is signed with each.
- Anthropic's retention period for API inputs under the commercial terms in force, and whether zero data retention should be requested for receipt images.
- How long billing records must be kept under the bookkeeping law that applies.
- Whether ride receipts can reveal special-category data (for example, a trip to a hospital) and whether the consent wording covers that.
Last updated: 27 October 2026 (draft)
Who we are
taxidata.co is run by [controller's legal name, address, organisation number]. We decide how and why your personal data is used, so we are the controller. Contact us about privacy at [privacy contact email].
What we collect, why, and on what legal basis
Your account
To sign in, you give us your email address. We send you a one-time sign-in link and keep the address, the time you signed up and your sign-in sessions. We use these to give you the services you sign up for. Legal basis: contract (GDPR Article 6(1)(b)).
We set one cookie, the sign-in session cookie, which the site needs to know you are signed in. We use no analytics, advertising or tracking cookies.
Email alerts
If you turn on alerts (Pro plan), we keep the markets and event types you chose and a record of each alert we send you, so you never get the same alert twice. Legal basis: contract. Every alert has a link to turn alerts off.
Ride receipts (rider panel)
If you share a ride receipt on the rider panel, we collect:
- the receipt image you upload, which may show your name, pickup and drop-off places, times, and the last digits of a payment card;
- the city and, if you pick one, the operator you choose;
- the consent text you agreed to, its version and the time you agreed.
An automated service (Anthropic's Claude) reads from the image only the fare, currency, distance, ride time, wait time, operator and ride date, and whether it is a robotaxi receipt. We do not extract or keep names, addresses, places or card details.
We keep the image in private storage that only you and our processing job can read. We also keep a fingerprint of the image (a SHA-256 hash, from which the image cannot be rebuilt) so the same receipt is not counted twice. It is deleted as soon as it has been read, normally within a day, and never kept longer than 7 days, even if it could not be read. The values read from it are kept with your report until you delete the report or your account.
We publish rider-panel figures only as averages over at least 30 different riders for one city, operator and month. No single report, and nothing that identifies you, is ever published.
Legal basis: your consent (GDPR Article 6(1)(a)). You can withdraw it at any time by deleting your report on the rider panel page; this deletes the report and, if it is still stored, the image. Withdrawing does not affect use before you withdrew, and averages already published stay, since they contain no personal data.
Payments (Pro plan)
Payments are handled by Stripe. We never see or store your full card details. We keep your Stripe customer and subscription IDs, your plan, its status and renewal date, so we know which features you have paid for. Legal basis: contract, and our legal duty to keep accounting records (GDPR Article 6(1)(c)).
API keys (Pro plan)
If you create an API key, we keep its name, a one-way hash of the key and its first characters, when it was created and last used, and how many requests it made that day. We cannot recover the key itself. Legal basis: contract.
Security and operations
Our hosting and database providers log technical data such as IP addresses and request times, to keep the service secure and working. Legal basis: our legitimate interest in running a secure service (GDPR Article 6(1)(f)). [Reviewer: confirm the log retention of the chosen providers.]
Who processes your data for us
We use these processors, each bound by a data processing agreement:
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and private storage of receipt images | [region] |
| Anthropic | Reading the values from receipt images (Claude API) | United States |
| Stripe | Payments and the billing portal | United States and EU |
| Resend | Sending alert emails [and sign-in emails, if set up that way] | United States |
| [Hosting provider] | Running the website | [region] |
Stripe also acts as an independent controller for some purposes, such as fraud prevention and its own legal duties; see Stripe's privacy policy.
We do not sell your personal data or share it with advertisers.
Transfers outside the EU/EEA
Some processors are in the United States. Transfers rely on [the EU–US Data Privacy Framework / the European Commission's standard contractual clauses] for each processor.
How long we keep it
| Data | Kept for |
|---|---|
| Receipt images | Until read, at most 7 days |
| Values read from receipts, consent | Until you delete the report or your account |
| Account and alert settings | Until you delete your account |
| Alert delivery records | Until you delete your account |
| Billing records | [N] years after the year of payment, as bookkeeping law requires |
| API keys and their usage counts | Until you delete your account (revoked keys are kept, disabled) |
Your rights
You have the right to access your data, have it corrected, have it deleted, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. To use these rights, or to delete your account, email [privacy contact email]. We reply within one month.
You can also complain to a data protection authority, for example where you live or work, or [Datatilsynet, the Norwegian Data Protection Authority, if the controller is established in Norway].
Automated decisions
We make no decisions about you by automated means that have legal or similarly significant effects. The automated reading of receipts only extracts the ride values; a receipt that cannot be read is simply not used.
Children
The site is not meant for children under 16, and we do not knowingly collect their data.
Changes
We will post changes here with a new date. If a change affects what you consented to, we will ask for your consent again.