Privacy Policy
Effective 4 October 2026
Who we are
BYBYGO (bybygo.com and the By By Go apps for iPhone and Android) is operated by IPRO INNOVATIONS, S.L., NIF ESB01781012, Carrer Vallvidrera 97, La Floresta, 08198, Spain, which is the controller of your personal data. Contact: support@bybygo.com or info@ipro.cat.
What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account: email, name, sign-in provider (email, Google or Apple) | Create and secure your account, send delivery emails | Contract |
| Trips and requests: routes, dates, item description, reward, pickup and delivery points or addresses, recipient name, phone and email | Match requesters and travelers and carry out deliveries | Contract |
| Identity verification result (not your documents) | Only verified travelers may carry items | Contract, legitimate interest in safety |
| Payment and payout records (amounts, status); card data is handled by Stripe, not us | Take rewards, pay travelers, refunds, accounting | Contract, legal obligation |
| Flight bookings: booking reference, flight, price; passenger details are sent to Duffel and the airline | Book the flight the traveler chooses | Contract |
| Ratings and reviews: stars, tags, text, your reply, reports you make, and our moderation decisions | Build trust between users, prevent abuse, handle reports | Contract, legitimate interest in a safe marketplace |
| Usage data and masked session recordings (form fields are hidden) | Understand and improve the service, find errors | Legitimate interest; consent where required |
| Security signals (bot checks) | Prevent abuse | Legitimate interest |
Location: if you tap "Nearest to me", your device's location is used only in the app or browser to sort offers. It is never sent to or stored on our servers.
Courier location: before taking their first door job, a BYBYGO courier agrees to share their live location. While they hold a job, from taking it until the handoff, the app sends their position (rounded to about 1 metre, at most every 15 seconds; in the BYBYGO Courier app also with the screen locked) so that delivery's sender, traveler and recipient can see where the item is. Couriers can also save a work zone (a point and a radius) to get alerts about jobs nearby. To place jobs on the courier map we look up the coordinates of the door addresses with OpenStreetMap Nominatim; couriers see only an approximate point (about 500 m) until they take a job. We keep only the latest position and delete it as soon as the job is handed over, given back or cancelled. Legal basis: contract.
Push notifications: if you allow them in the iPhone app, we store your device's push token to send you delivery updates and, for couriers, new jobs in your city. We delete a token when Apple reports it as no longer valid or when you delete your account.
Who processes data for us
- Supabase – database, sign-in and server functions (United States).
- Amazon Web Services – website hosting (Frankfurt) and our email server (Frankfurt).
- Stripe – card payments and payouts to travelers; Stripe is an independent controller for its own verification of travelers.
- Duffel and the airline – flight search and tickets; they receive the passenger details needed to issue the ticket.
- Veriff – identity verification of travelers; your documents stay with Veriff.
- Amplitude – product analytics and masked session replay.
- Cloudflare – bot protection (Turnstile) and DNS.
- xAI – the travel assistant at bybygo.com/help: it receives the questions you type there to write the answer. We don't store the conversation; please don't type personal details.
- Google and Apple – if you choose to sign in with them.
Where data is transferred outside the European Economic Area, we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
What other users see
Travelers on the Offers board see the item, route, date and reward, never addresses or contact details. Addresses and the recipient's contact are shown only to the requester and to the traveler who has committed to that delivery. Traveler search shows only a first name and last-name initial.
Ratings and reviews: your average star rating (shown from three reviews), number of reviews and completed deliveries are shown next to your name in BYBYGO, including on a profile page at bybygo.com/people/ that search engines are asked not to index. Review texts, tags and replies are shown only to signed-in users, with the reviewer's first name and last-name initial and the month of the review, never the exact route, date or item. The person you rate cannot see your review until both of you have reviewed or 14 days have passed. Reports are anonymous to the person reported. Ratings of one or two stars and reports are shown to the BYBYGO team in an internal chat so we can follow up.
How long we keep data
Account data is kept until you delete your account. Payment and booking records are kept as long as Spanish tax and accounting law requires, without your name once the account is deleted. Email delivery logs and security logs are kept for a limited time.
Reviews you received stop being shown when you delete your account. Reviews you wrote stay, shown as written by a "Deleted user", because they are part of the other person's rating; you can ask us to remove one. Reports and moderation records are kept for as long as the review exists, without your name once the account is deleted.
Your rights
You can access, correct, delete or export your data, object to or restrict processing, and withdraw consent at any time. Delete your account in the app or on the web under Profile → Delete account, or email us; see bybygo.com/delete-account for the steps and what we keep. You may also complain to the Spanish data protection authority (Agencia Española de Protección de Datos, aepd.es).
Age
BYBYGO is for people aged 18 or over.
Changes
If we change this policy we will update the date above and, for important changes, tell you in the app or by email.