Privacy Policy

The data controller is Corvus Reach, the studio operating Vaya. Full legal and registration details are available on request.

Privacy and legal contact: legal@corvusreach.com. App support: info@vaya-taxi.com.

During the current pilot phase the service is operated by Corvus Reach. If operation is transferred to a taxi fleet company in the future, this section will be updated and users will be informed.

Account data: your name, email address (optional if you sign in by phone), phone number, a securely hashed password, your language and text-size preferences, and - optionally for riders, required for drivers - a profile photo you upload.

Sign in with Apple or Google: if you choose one of these, we receive the name and email address the provider shares (with Apple this can be a private relay address) and a provider user id, and we store them as your account details. No password is created for that method.

Trip data: pickup and destination addresses and coordinates, request/start/completion times, passenger count, the fare (the app's estimate, any driver correction, and the final amount), waiting time, payment method, ratings and tips, and the in-trip chat messages between rider and driver.

Location data: riders share pickup and destination locations, and optionally their live position while choosing a pickup point. Drivers on duty share their live position, speed and heading - also while the app is in the background - so trips can be dispatched and riders can see their taxi arrive. Sharing stops when the driver goes off duty. We store only a driver's most recent position; it is cleared when the driver goes off duty. We do not build movement histories.

Saved places: riders can save addresses (such as home) with a label and coordinates. These are visible only to the rider who saved them.

Billing details (optional, riders): a name or company, tax ID (NIF/CIF) and billing address, used only to issue invoices you request.

Fiscal details (licence holders who switch on facturas): legal name, NIF/CIF and fiscal address, printed as the issuer on the facturas Vaya issues in their name, and the date they authorised it. A factura shows them only to the rider it is issued to. Each factura keeps the issuer and customer details as they were when it was issued.

Payment card data: if you save a card, the card itself is held by our payment provider Stripe. We never see or store your card number - we store only Stripe's reference IDs and a display summary (card brand and last four digits).

Driver documents: drivers upload their tarjeta identificativa (the legally required driver ID card) with its expiry date. It is stored privately, is never visible to riders, and is used only to verify the driver may legally drive.

Driver cancellations: if a driver cancels a trip after accepting it, the cancellation is recorded as a strike on the driver and shown to the driver's fleet owner. Riders never see it.

Phone calls to a call centre: if you phone a Vaya call centre, we keep the number you call from (unless you withhold it), the time of the call, and whether it was answered or missed - so the operator can see who is calling and call you back. Calls are not recorded: no audio and no transcript is stored. Legal basis: handling your booking call (Art. 6(1)(b)) and our legitimate interest in returning a missed call (Art. 6(1)(f)).

Technical data: session tokens, push notification tokens (so your phone can receive ride alerts), and - when errors occur - technical error reports with request bodies, cookies and personal identifiers removed before sending. We do not record your screen or your session.

Problem reports and ideas: what you write in Settings > Help, with your account id, the page, the app version and your browser, is sent to our support mailbox so we can answer. Each report gets a reference (VY-...) you can quote.

To provide the service - booking, dispatching, driving and paying for trips, and showing riders and drivers each other's relevant details (name, photo, vehicle, live position during a trip). Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

To meet legal obligations - invoicing and tax record-keeping, and verifying drivers' legal documentation. Legal basis: legal obligation (Art. 6(1)(c)).

To run the fleets' service reliably - recording driver cancellations after acceptance (strikes) for the fleet owner. Legal basis: the contract with the fleet (Art. 6(1)(b)) and our legitimate interest in a reliable service (Art. 6(1)(f)).

To keep the service safe and working - preventing fraud and abuse, rate-limiting, securing accounts (including optional two-factor authentication), and fixing errors through anonymised error reporting. Legal basis: legitimate interest (Art. 6(1)(f)).

With your consent - optional features such as your profile photo, saved places, a saved payment card, push notifications (which you can switch off in your device settings at any time), and analytics cookies on the vaya-taxi.com website. Legal basis: consent (Art. 6(1)(a)), withdrawable at any time.

We do not use your data for advertising, we do not sell it, and we make no automated decisions with legal effect on you.

Your driver sees your name, photo (if set), pickup and destination, and your phone contact for the trip. Your rider sees the driver's name, photo, vehicle and plate, and the taxi's live position during the trip.

Fleet owners see their own fleet's trips, fares and drivers - never other fleets'. Call-centre operators see what they need to book trips for callers. Every view is scoped server-side to the company it belongs to.

We use a small number of providers to run Vaya, each bound by data processing terms: Railway (hosting of the app, its database and the vaya-taxi.com website), Stripe (card payments), Apple (push notifications on iPhone, maps, and Sign in with Apple), Google (push notifications on Android through Firebase, Sign in with Google, and - only if you accept analytics cookies on vaya-taxi.com - Google Analytics), Sentry (error monitoring, EU data region), Resend (transactional email and, if you join the waitlist, update emails), Cloudflare (storage of driver documents), and Twilio (the call centres' phone line, and sign-in codes sent to your phone by SMS).

Where a provider processes data outside the EU/EEA, transfers rest on the European Commission's Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

Your account and its data: for as long as the account exists. Riders and drivers can delete their account in Settings at any time; deletion removes the account and personal details, while trip and invoice records that must be kept for legal reasons are retained without more personal data than the law requires.

Trip, fare and invoice records: up to 6 years, per Spanish commercial and tax record-keeping rules (Código de Comercio Art. 30; Ley General Tributaria).

Call-centre phone records (the caller's number, time, answered or missed): 12 months, then deleted automatically.

Website analytics (only if you accepted them): the data of each visit stays 2 months in Google Analytics, then it is deleted automatically; after that only anonymous totals remain.

Driver live position: only the most recent fix, cleared when the driver goes off duty. Sign-in sessions: up to 30 days (web) or 90 days (app refresh tokens), and you can sign out anywhere at any time.

Under the GDPR and the Spanish LOPDGDD you can ask for access to your data, correction, deletion, portability, restriction of processing, and you can object to processing based on legitimate interest. Most of this you can do directly in the app: edit your details, change email, phone or password, remove your card, and delete your account (riders and drivers) in Settings.

For anything else, write to legal@corvusreach.com. We answer within one month. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es).

The Vaya app on the web (app.vaya-taxi.com) uses only technical cookies: your session (signing you in), your language, and your text-size preference. Strictly necessary cookies need no consent (LSSI-CE Art. 22.2).

The public website vaya-taxi.com also uses Google Analytics, but only if you accept it in the cookie banner. It tells us how many people visit, which pages they read and roughly where they come from, so we can improve the site. It sets two cookies: _ga and _ga_<id>, each for up to 2 years. Google Analytics does not store your IP address, Google signals and ad personalisation are switched off, and the data is never used for advertising. Legal basis: your consent (GDPR Art. 6(1)(a); LSSI-CE Art. 22.2). If you reject it, nothing is loaded from Google.

Your choice is saved in your browser for 12 months (vaya-consent), so we don't ask on every page. You can change it at any time with Cookie settings at the bottom of every page; withdrawing your consent removes the analytics cookies.

The mobile apps store the equivalent settings on your device, plus your sign-in tokens. The optional Face ID / Touch ID lock runs entirely on your device and is never sent to our servers.

Connections are encrypted (HTTPS/TLS). Passwords are stored only as salted hashes. Card data lives at Stripe, not with us. Driver documents are stored in private storage, never publicly reachable. Access to data is scoped by role and company, security-relevant actions carry two-factor authentication for drivers, owners and operators, and error reports are scrubbed of personal data before leaving the app.

If a breach ever puts your rights at risk, we will notify the AEPD within 72 hours and inform affected users without undue delay (GDPR Art. 33/34).

Vaya is not directed at children. You must be at least 14 years old (the Spanish digital consent age, LOPDGDD Art. 7) to create an account.

If this policy changes in a way that matters, we will say so in the app or by email before the change takes effect. The date below always shows the current version.

On vaya-taxi.com you can ask us to tell you when Vaya opens. We store your email address, what you told us you are (rider, driver, licence holder or dispatch), your postal code if you gave it, your language, the page you signed up on, and the date and wording of the consent you gave.

We use it only to send you news about Vaya - the launch, and when Vaya reaches your area. Legal basis: your consent (GDPR Art. 6(1)(a); LSSI-CE Art. 21). Nothing is sent until you confirm your address from the email we send you (double opt-in).

Update emails are sent through Resend. We do not track whether you open them or which links you click.

Every update has an unsubscribe link, and the confirmation email has a link to remove your address. You can also write to legal@corvusreach.com. We keep your details until you unsubscribe or ask us to delete them; unconfirmed requests are removed.