This Policy explains which personal data the Dorohoyu ride-sharing service (the website dorohoyu.com and related services, the "Service") processes, why, on what legal basis, who receives it, how long it is kept, and what rights you have.
It is drafted under the Law of Ukraine "On Personal Data Protection" and Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR") to the extent the GDPR applies to the Service.
1. Who processes your data (controller)
The controller of your personal data:
- Individual entrepreneur (FOP) Bohdan Petrenko.
Contact, including for personal data requests: [email protected].
2. In short
- No money passes through the Service. We do not collect payment data.
- We do not sell personal data and do not use it for advertising.
- We use no advertising cookies and no third-party analytics.
- The other party of a trip sees your phone number only after the booking is confirmed (section 6).
- You can delete your account inside the app; profile data is anonymised immediately (section 9).
3. What data we process
3.1. Account data
- Data
- Email address
- Source
- you enter it at sign-up, or Google provides it when you sign in with Google
- Required?
- yes
- Data
- Password (stored only as a cryptographic hash)
- Source
- you set it via the link in our email
- Required?
- email sign-in only
- Data
- Google account identifier, Google email and its verification flag
- Source
- Google, on sign-in with Google
- Required?
- Google sign-in only
- Data
- Name
- Source
- you enter it, or Google provides it
- Required?
- yes
- Data
- Profile photo
- Source
- you upload it
- Required?
- no
- Data
- Short "about me" text
- Source
- you enter it
- Required?
- no
- Data
- Ride preferences (smoking, pets, music, chattiness); shown alongside your profile, trips, requests and bookings — section 5
- Source
- you choose them
- Required?
- no
- Data
- Interface language, unit system, default pickup radius
- Source
- you choose / defaults
- Required?
- —
- Data
- Notification settings (Telegram, email)
- Source
- you choose them
- Required?
- —
- Data
- Country at sign-up (two-letter code derived from your IP address by Cloudflare; the IP address itself is not stored)
- Source
- automatic
- Required?
- —
- Data
- Acquisition channel (link tag such as
req-shareand the referring site's host) - Source
- automatic, from the
dh_campaigncookie and the link - Required?
- —
- Data
- Account creation date; last visit (stored to the hour, shown to others as "today / this week")
- Source
- automatic
- Required?
- —
- Data
- Fact and version of acceptance of the Terms of Use
- Source
- automatic on acceptance
- Required?
- yes
Data received from Google is used only to create your account and sign you in and is not passed to third parties.
The Service does not collect date of birth: you confirm you are 18 or older with a statement next to the sign-up button.
3.2. Phone number and Telegram
- Phone number in E.164 format and how it was verified (
telegram, or entered manually). - Telegram user ID — if you verified your number or enabled notifications via our Telegram bot
@dorohoyu_bot. The bot accepts a number only from a contact card that Telegram sends on behalf of the account owner. We do not store your Telegram name, username or photo. - Telegram delivery data: a flag that the bot is blocked, and the time of your last message to the bot.
- One-time phone verification tokens (stored hashed, valid 10 minutes).
3.3. Trips, requests, bookings
- Driver's trips: departure and arrival places and points (coordinates the driver sets on the map), intermediate places, date and time, number of seats, luggage allowance per passenger, cost contribution amount, comments and point notes, cancellation reason, route (map line, distance, duration), the "verified passengers only" setting.
- Vehicle: make, model, year, colour, licence plate (optional), fuel type, consumption, number of seats.
- Passenger requests: departure and arrival places and points, date, number of seats, pickup radius, comment, visibility, and what you bring: a pet (none / small / medium / large) and luggage (none / small / medium / large).
- Bookings: who, which trip, from where to where, number of seats, what the passenger brings (pet and luggage, as in a request), a snapshot of the recommended contribution and the declared amount at the time of the request, statuses (requested, confirmed, declined, cancelled, completed, no-show), "the trip happened / did not happen" answers, cancellation reasons.
- Searches: from, to, date, seats, number of results and — if you are signed in — your identifier. IP address and browser data are not stored in the search log.
3.4. Communication, reviews, moderation
- Chat messages between the driver and a passenger of a specific trip, system messages (e.g. "booking confirmed"), read times.
- Reviews: rating 1–5, text, role, "the trip happened" answer, publication date.
- Reports: who reports, whom or what (user, trip, request, booking, message), reason, text, outcome.
- Blocks of another user (who blocked whom).
- Moderation data: date and reason of an account ban, moderator notes, a flag of possible re-registration after deletion (see 3.6).
- In-app notifications ("bell"): event type, related trip or booking, the other party's name.
3.5. Emails we send
Delivery log: recipient address, email template (sign-up confirmation, password reset, booking notification), provider, provider message ID, delivery status, time. Sign-up requests (address, token hash, language, channel tag) and password reset tokens (hash).
3.6. Fingerprints of deleted accounts
When an account is deleted, we keep one-way cryptographic fingerprints (HMAC-SHA256) of the phone number (only one verified via Telegram or SMS), the Telegram ID and the Google ID. A fingerprint cannot be turned back into the number or ID; it can only be compared with a new one. The purpose is to prevent "laundering" bad reviews by re-registering. A match only flags the new account for moderator review; there is no automatic ban. Fingerprints are kept for 12 months after account deletion (section 8).
3.7. Technical data
- Cookies and browser storage — section 10.
- Site health funnel: anonymous events "page rendered", "sign-in started", "sign-in succeeded/failed", "trip list/card viewed", "form opened", "form error", with a random browser-tab key, a device class (not the full User-Agent), country, language, build number and time rounded to the hour. These records are not linked to an account and no IP address is stored. Collection is disabled if your browser sends Global Privacy Control or Do Not Track.
- IP address is processed transiently: for rate limiting (protection against password guessing and spam) — in counters lasting from minutes to an hour — and in web server and Cloudflare logs.
- Error reports (planned, Sentry): technical error description, page address, browser type, account identifier.
We do not process special categories of data (health, religion etc.), biometric data, identity documents or payment card data. Please do not include them in profile texts, chat or reviews.
4. Purposes and legal bases
- Purpose
- Sign-up, sign-in, account management
- Data
- 3.1, 3.5
- Basis (Ukrainian Law, Art. 11)
- conclusion and performance of a transaction
- Basis (GDPR Art. 6(1))
- (b) contract
- Purpose
- Publishing trips and requests, search, booking, chat, number exchange after confirmation
- Data
- 3.1–3.4
- Basis (Ukrainian Law, Art. 11)
- performance of a transaction
- Basis (GDPR Art. 6(1))
- (b) contract
- Purpose
- Phone verification via Telegram; notifications via Telegram, in-app and email
- Data
- 3.2, 3.4, 3.5
- Basis (Ukrainian Law, Art. 11)
- performance of a transaction
- Basis (GDPR Art. 6(1))
- (b) contract
- Purpose
- Reviews and ratings
- Data
- 3.4
- Basis (Ukrainian Law, Art. 11)
- performance of a transaction; legitimate interest
- Basis (GDPR Art. 6(1))
- (b) contract; (f) legitimate interest — trust between members
- Purpose
- Security, fighting fraud, spam and re-registration of banned users, moderation, handling reports
- Data
- 3.2, 3.4, 3.6, 3.7
- Basis (Ukrainian Law, Art. 11)
- legitimate interest of the controller
- Basis (GDPR Art. 6(1))
- (f) legitimate interest — safety of members and the Service
- Purpose
- Measuring demand per direction, share of empty search results, technical funnel, acquisition channels
- Data
- 3.1 (country, channel), 3.3 (search), 3.7 (funnel)
- Basis (Ukrainian Law, Art. 11)
- legitimate interest
- Basis (GDPR Art. 6(1))
- (f) legitimate interest — improving and keeping the Service stable
- Purpose
- Error reporting (planned)
- Data
- 3.7
- Basis (Ukrainian Law, Art. 11)
- legitimate interest
- Basis (GDPR Art. 6(1))
- (f) legitimate interest — keeping the Service working
- Purpose
- Keeping proof of acceptance of the Terms, answering lawful requests of public authorities, tax obligations
- Data
- 3.1, 3.3
- Basis (Ukrainian Law, Art. 11)
- legal obligation
- Basis (GDPR Art. 6(1))
- (c) legal obligation
- Purpose
- Answering your support requests
- Data
- correspondence
- Basis (Ukrainian Law, Art. 11)
- performance of a transaction; legitimate interest
- Basis (GDPR Art. 6(1))
- (b), (f)
Where we rely on legitimate interest, you may object (section 11). We do not make automated decisions producing legal effects for you (Art. 22 GDPR): an account ban is always applied by a human moderator.
5. What other users and visitors see
- Anyone, including guests and search engines: your name, photo, rating and published reviews, number of trips, approximate time since last visit (on the public profile and on a driver's trip cards). For trips and requests: places, date, points rounded to about 1 km, seats, contribution amount; for trips — the driver's preferences and luggage allowance; for requests — the passenger's preferences and what they bring (pet, luggage). The same appears on the link preview image in messengers and social networks; they cache that image and may keep showing it for up to about 30 days after the request or account is deleted. A request's comment is not shown to guests.
- Signed-in members: the same; the name and photo of a request's author are visible only to drivers with a verified number, others see "Passenger" with a rating and preferences.
- The driver of a trip: for every request and booking — the passenger's preferences and what they bring.
- The other party of a confirmed booking: exact pickup and drop-off coordinates, the vehicle's licence plate and the phone number under the rules of section 6.
6. Phone number exchange
After a booking is confirmed, the other party receives your phone number:
- the driver's number is shown to the passenger of the confirmed booking;
- the passenger's number is shown only to a driver with a verified number;
- a manually entered number (not verified via Telegram) is never shown to anyone — contact goes through the chat.
Passing your number to the counterparty of your arrangement is part of performing the contract (Art. 6(1)(b) GDPR) and does not require separate consent. Until a booking is confirmed, the Service automatically rejects phone-like numbers, links and usernames in chat, comments and cancellation reasons.
7. Recipients
We share data only with providers the Service cannot work without, and only to the extent their function requires.
- Recipient
- netcup GmbH (Germany)
- Role
- processor (Art. 28 GDPR data processing agreement signed 8 Oct 2026)
- What it receives
- all Service data: database and file server
- Where
- data centre in Vienna, Austria
- Transfer basis outside the EEA
- — (EU)
- Recipient
- Cloudflare, Inc. (USA) and affiliates
- Role
- processor
- What it receives
- all traffic to the Service (IP address, request headers), cached profile photos, forwarding of email to support@ and hello@, encrypted database and file backups (Cloudflare R2)
- Where
- global network; backups — storage with EU jurisdiction
- Transfer basis outside the EEA
- EU–US Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCC)
- Recipient
- Telegram (Telegram Messenger Inc. / Telegram FZ-LLC)
- Role
- independent operator of its own platform; we send notification content via the Bot API
- What it receives
- your Telegram ID, notification texts (the other party's name, places, trip date and time)
- Where
- outside the EEA
- Transfer basis outside the EEA
- you initiate the bot connection yourself; Art. 49(1)(b) GDPR — performance of a contract
- Recipient
- Resend (Plus Five Five, Inc., USA)
- Role
- processor — primary email provider
- What it receives
- email address, email content
- Where
- USA
- Transfer basis outside the EEA
- SCC / DPF
- Recipient
- Brevo SAS (France)
- Role
- processor — backup email provider
- What it receives
- email address, email content
- Where
- EU
- Transfer basis outside the EEA
- —
- Recipient
- Google (Google Ireland Ltd / Google LLC)
- Role
- independent controller for Google sign-in; processor for the support mailbox
- What it receives
- on sign-in — the data you allowed Google to share; emails you send to support@ (forwarded to a Gmail mailbox, so Google receives this correspondence)
- Where
- EU / USA
- Transfer basis outside the EEA
- DPF / SCC
- Recipient
- HeiGIT gGmbH (OpenRouteService, Heidelberg, Germany)
- Role
- processor
- What it receives
- only trip point coordinates for route building, without the user's name or ID
- Where
- EU
- Transfer basis outside the EEA
- —
- Recipient
- OpenFreeMap
- Role
- map tile provider
- What it receives
- your browser loads map images directly: IP address and the map area you view
- Where
- —
- Transfer basis outside the EEA
- —
- Recipient
- Sentry (Functional Software, Inc., USA) — planned
- Role
- processor
- What it receives
- error reports (section 3.7)
- Where
- —
- Transfer basis outside the EEA
- SCC / DPF
Data may also be disclosed:
- to other users — as described in sections 5 and 6;
- to public authorities — only on a legal basis and to the extent the law requires;
- to a successor — if the Service is transferred to another person, with prior notice to you.
The Service's server is located in the EU (Austria). The operator is located in Ukraine; the operator's access to the data from Ukraine is a transfer outside the EEA. Ukraine has no European Commission adequacy decision.
8. Retention
- Data
- Profile data (name, email, phone, photo, about text, preferences, password, sign-in methods)
- Period
- while the account exists; on deletion — anonymised immediately (section 9)
- Data
- Profile photo after replacement, removal or account deletion
- Period
- the file is deleted immediately; a copy in Cloudflare's cache may still be served for up to 1 day
- Data
- Pending sign-up requests and password reset tokens
- Period
- 30 days after use or expiry (the link itself is valid 2 hours for sign-up and 1 hour for password reset)
- Data
- Sent email log
- Period
- 90 days from sending
- Data
- Search log
- Period
- 26 weeks; on account deletion the link to you is removed immediately
- Data
- Site health funnel (section 3.7)
- Period
- 120 days
- Data
- Telegram phone verification tokens
- Period
- valid 10 minutes; deleted about 1 day after expiry
- Data
- Telegram delivery markers (no personal data)
- Period
- 7 days
- Data
- Fingerprints of deleted accounts (section 3.6)
- Period
- 12 months after account deletion
- Data
- Trips, requests, bookings, reviews
- Period
- while the account exists; after deletion they remain without your name (section 9) with no time limit
- Data
- Chat messages
- Period
- 12 months from the trip date
- Data
- In-app notifications
- Period
- 12 months from creation
- Data
- Reports
- Period
- 3 years after the report is closed
- Data
- Proof of acceptance of the Terms, ban reason
- Period
- for the limitation period after account deletion
- Data
- Session cookie
- Period
- up to 180 days or until sign-out
- Data
- Database and file backups
- Period
- 7 days, or up to 14 days if automatic deletion fails (daily copies and the database copy taken before each application update). Data from backups is restored into the live database only for disaster recovery
- Data
- Web server and container logs
- Period
- —
- Data
- Error reports (planned)
- Period
- —
These periods are enforced by automated clean-up jobs that run daily.
9. Account deletion
You can delete your account in profile settings. Deletion is irreversible and immediate, with no cooling-off period:
- name, email, phone, password, photo (the file is deleted), about text, preferences and last-visit time are erased; sign-in methods (Google, Telegram link), sessions, tokens and your in-app notifications are deleted; your vehicles' licence plates are erased;
- future trips are cancelled; active bookings and requests are cancelled; the other party is notified;
- your texts visible to others are erased: trip comments and point notes, request comments, your cancellation reasons;
- sign-up requests and the log of emails addressed to you are deleted;
- searches are unlinked from you.
What remains (without your name — others see "Deleted user"):
- the history of trips and bookings that involved other people;
- reviews you wrote and reviews about you, as well as ratings and trip counters — they are part of other members' history;
- chat messages — they remain with the other participant until the period in section 8 ends (12 months from the trip date);
- reports filed by you or about you — until the period in section 8 ends;
- the fingerprints from section 3.6 (12 months), proof of acceptance of the Terms, the ban reason (if any), aggregated acquisition channel and sign-up country.
If your account is banned, it cannot be deleted in the app; send a request to [email protected].
11. Your rights
Under Art. 8 of the Law of Ukraine "On Personal Data Protection" and Arts. 15–22 GDPR you have the right to:
- know which of your data we process and get a copy (access);
- correct inaccurate data — most profile fields you can change yourself;
- have data erased — via account deletion or on request;
- restrict processing;
- receive the data you provided in a structured, machine-readable format (portability) — on request, in JSON format;
- object to processing based on legitimate interest;
- withdraw consent where processing is based on consent, without affecting the lawfulness of prior processing;
- lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU — the supervisory authority of your habitual residence, place of work or place of the alleged infringement.
Send requests to [email protected] from the email linked to your account. We reply and, where needed, provide the data within one month (extendable under Art. 12(3) GDPR). To protect your data we may ask you to confirm your identity.
12. Children
The Service is intended for persons aged 18 or over. We do not knowingly collect children's data. If you believe a child has created an account, let us know and we will delete it.
13. Security
We use: encrypted connections (HTTPS); passwords and tokens stored only as hashes; the session token in an encrypted cookie inaccessible to page scripts; rate limiting of sign-in attempts; key-only server access; restricted inbound network access; encrypted backups; removal of metadata (including geotags) from uploaded photos. If a personal data breach creates a risk to you, we will notify the supervisory authority and you within the statutory deadlines.
14. Changes to this Policy
We may change this Policy. We will announce material changes in the app and/or by email at least 14 days before they take effect. Previous versions are available on request at [email protected].
15. Contacts
FOP Bohdan Petrenko. Personal data and support: [email protected]