HuddleHopHuddleHop is a ride-sharing and carpooling app operated from Iceland. This policy explains what personal data we collect, why we collect it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR) and the Icelandic Data Protection Act No. 90/2018.
We are the data controller for this data. For any question or request, contact us at privacy@huddlehop.org.
Data we collect
- Account and contact details: your name, email address, phone number, account identifiers, sign-in provider, profile photo, saved places, preferences, company membership where applicable, and the version and time of your terms/privacy acceptance.
- Driver verification details: vehicle and licence information, government identity details, permit documents and review history. These are sensitive and are limited to verification and safety purposes.
- Precise location: pickup, stops, destination, saved-place coordinates, and live position while a ride or carpool is active. A driver's location may continue in the background only while the driver is online or sharing an active journey.
- Service content: ride and carpool routes, schedules, fares or cost shares, timestamps, ratings, in-app messages, support requests, disputes, and safety reports.
- Payment data: if card payments are enabled, Stripe collects payment details directly. HuddleHop receives the payment status, amount, and provider identifiers, not the full card number.
- Device and diagnostic data: push tokens, app installation identifiers, crash reports, technical logs, and error context used to deliver notifications, prevent abuse, and keep the app reliable.
Why we use it
We use this data to create and secure accounts, verify drivers, match riders and drivers, route and operate journeys, process payments, deliver support and notifications, investigate safety incidents and abuse, comply with transport, accounting and other legal obligations, and diagnose service failures. Our legal bases are performing our contract with you, compliance with law, our legitimate interests in operating a safe and reliable service, and consent where required.
How long we keep it
We keep account data while your account is active. Precise trip-location fields are scheduled for removal 60 days after a journey ends, and in-app notifications are removed after 90 days. History-free accounts can be deleted directly in the app. If trip, payment, safety, support, or audit records must be retained or reviewed, the app directs you to our privacy/support process so the request can be handled without corrupting another person's records or a legal record. Operational, support, payment, and diagnostic records are kept only as long as needed for those purposes.
Sharing
We share only what is needed with matched riders or drivers and, when you create a trip-share link, with anyone who has that time-limited link. Our service providers include Google Firebase, Google Maps, Google or Apple sign-in, Expo notifications, Stripe when payments are enabled, and OpenStreetMap-based geocoding and routing services. We may disclose data to professional advisers or authorities when legally required or needed to protect safety and rights. Some providers may process data outside the EEA under recognised transfer safeguards. We do not sell personal data, use it for third-party advertising, or track you across other companies' apps and websites.
Your choices and security
Location, photo, camera, and notification access is controlled through your device settings, although disabling a permission may prevent the related feature from working. Public trip sharing is optional and can be ended in the app. Protect your account credentials and contact us if you suspect unauthorised access. No system is completely secure, but we use access controls, server-side authorisation, encryption in transit, and restricted retention to reduce risk.
Your rights
You have the right to access, correct, or request deletion of your data, to object to or restrict certain processing, and to data portability. History-free accounts can be deleted in the app; requests involving retained records are reviewed through privacy@huddlehop.org. You also have the right to complain to the Icelandic Data Protection Authority (Persónuvernd).
HuddleHop is not intended for children who cannot lawfully enter the service agreement in their country.
Contact
Questions about this policy or your data: privacy@huddlehop.org.