Privacy Policy

ShareWay SIA ("ShareWay", "we") processes personal data of individuals using the ShareWay platform (mobile app, website and related services) in Latvia, Estonia and Lithuania. ShareWay is the data controller within the meaning of the EU General Data Protection Regulation (EU) 2016/679 ("GDPR") and processes personal data in accordance with it.

Account and profile data: first and last name, email address, phone number, home/address information (if provided), profile photo (if uploaded). Device biometrics: The app may support device-level biometric authentication (fingerprint or Face ID) to confirm app login, provided by the user's device operating system. ShareWay never receives, processes, or stores this biometric data.

To become a driver, a user must complete identity verification performed by Stripe (Stripe Identity / Stripe Connect). This involves a photo of a government-issued identity document, a selfie image automatically compared against the document photo, and verification status. This processing is based on the driver's explicit consent, obtained during registration before verification begins.

Vehicle make and model, colour, technical inspection information, and vehicle photographs.

GPS data (only with user permission), location during an active ride, and proximity data when searching for nearby rides or events.

Payments are processed via Stripe and Stripe Connect (for driver payouts). ShareWay does not store full card details, but receives payment status and transaction information.

In-app chat messages between users relating to a specific ride and call metadata (if the calling feature is used).

ShareWay logs usage events (ride history, feature usage, achievements/badges) directly into its own Supabase database. This is first-party processing by ShareWay — data is not sent to or shared with separate third-party analytics vendors.

Data is used to: operate the platform and enable account creation/login, connect passengers and drivers, process payments and payouts, perform identity verification and maintain platform safety, improve user experience and platform functionality, provide customer support and resolve disputes, prevent fraud and abuse, show nearby rides and events, and comply with legal and accounting obligations.

Performance of a contract – to provide platform services (Art. 6(1)(b) GDPR). Legal obligation – for tax and financial compliance (Art. 6(1)(c) GDPR). Explicit consent – for GPS location data, marketing communications, and driver biometric identity verification (Art. 6(1)(a) and Art. 9(2)(a) GDPR). Legitimate interests – for platform security and fraud prevention (Art. 6(1)(f) GDPR).

ShareWay discloses personal data only to: Supabase Inc. (user authentication, database, file storage in EU - Frankfurt, Germany), Mapbox Inc. (mapping and route-display functionality; location data sent for this purpose; Mapbox may use anonymised location data for its own purposes), Stripe (payment processing, driver payouts, identity verification), Other users (name and profile information, vehicle information for drivers, location during active ride), and Law enforcement and supervisory authorities where required by applicable law.

Account data – retained while the account remains active. Ride history – 3 (three) years, for tax and accounting compliance. Chat messages – 3 (three) years after completion of the relevant ride, for safety and dispute-resolution purposes. Identity verification data – retained by Stripe in accordance with Stripe's own policies and applicable regulatory retention periods.

GPS data is used only with the user's permission — to display nearby rides and events, and during active rides (for drivers) for safety and coordination purposes. Users may withdraw location permission at any time via their device settings.

Users have the right to: access their data, correct inaccurate data, request erasure of their data, restrict processing, object to processing based on legitimate interests, receive their data in a portable format, and withdraw previously given consent. ShareWay will respond to a user request within one month of receipt, as required by Article 12 GDPR.

If a user believes their data is being processed in breach of GDPR, they may lodge a complaint with: Latvia: Data State Inspectorate, Elijas iela 17, Rīga, LV-1050, www.dvi.gov.lv. Estonia: Estonian Data Protection Inspectorate, www.aki.ee. Lithuania: State Data Protection Inspectorate (VDAI), www.vdai.lrv.lt.

Users may request account deletion via the app's "Delete Account" function or by emailing info@shareway.lv. Deletion requests are reviewed and completed within 30 (thirty) days. Certain information may be retained longer where required by law (e.g. the accounting retention periods described in Section 6).

ShareWay applies reasonable technical and organisational security measures (including encryption in transit and at rest, provided via the Supabase infrastructure) to protect data against unauthorised access, loss, or misuse.

The ShareWay platform is intended only for individuals who are at least 18 years old. The platform is not intended for use by children in any form, and ShareWay does not knowingly process children's personal data. If ShareWay becomes aware that an account belongs to a person under 18, the account will be deleted without delay.

ShareWay may send ride notifications, safety alerts, and news/marketing messages where the user has given consent. Users may opt out of marketing messages at any time.

The platform may display ShareWay's own sponsored content, promoted events, or recommendations. ShareWay does not use third-party advertising networks or third-party tracking tools for advertising purposes. Any personalisation is based solely on usage data collected directly by ShareWay.

ShareWay currently does not offer a push notification feature. If this feature is introduced in the future, this Privacy Policy will be updated before launch to name the provider used and the data processed.

ShareWay currently does not collect or process crash/diagnostic data through any third-party crash-reporting tool.

The Supabase database infrastructure hosting ShareWay's user data is located within the European Union (Frankfurt, Germany). ShareWay has entered into a data processing agreement with Supabase that includes Standard Contractual Clauses (SCCs) as safeguards. Mapbox and Stripe process core data outside the European Economic Area (in the US). For these transfers, ShareWay relies on Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework where applicable.

ShareWay may update this Privacy Policy. Users will be notified of material changes in the app or by email at least 14 days before the changes take effect.

ShareWay SIA, Registration No. 40203741796, Zentenes iela 28–20, Rīga, LV-1069, Latvia. Email: info@shareway.lv.

This Privacy Policy is prepared in Latvian and translated into English for convenience. In the event of any discrepancy, the Latvian version shall prevail.