Privacy Policy
Version: 2026-10-15 (v1) — Last updated: 15 October 2026.
1. PURPOSE OF THIS PRIVACY POLICY
VIBES CARPOOL, S.L. (hereinafter, "the provider" or "VIB3S"), through the application called VIB3S (hereinafter, the "application", "platform" or "VIB3S"), aims to offer the End User or consumer (hereinafter, the "User") a safe and trustworthy experience. This Privacy Policy describes what data we process, for what purpose, on what legal basis, for how long, and with which recipients, in accordance with Spanish Organic Law 3/2018 (LOPDGDD) and Regulation (EU) 2016/679 (GDPR).
2. DATA CONTROLLER AND CONTACT DETAILS
All information collected in the application is managed by:
VIBES CARPOOL S.L.
NIF: B22948616
Registered address: Paseo de la Castellana, número 141, planta 19, Edificio Cuzco IV, 28004 Madrid
Contact email: info@vibescarpool.com
Commercial details: Registered in the Commercial Registry of Madrid, sheet number M-866510, entry 1
Social Media Profiles:
LinkedIn - VIBES APP
Instagram - @vib3sapp
For more information you may contact us at info@vibescarpool.com.
3. WHAT DATA WE PROCESS, FOR WHAT PURPOSE AND ON WHAT LEGAL BASIS
This Policy is organised around the data processing activities carried out by VIB3S. For each processing activity we indicate its purpose, the data involved, the legal basis that legitimises it, and the general retention criterion. Exact retention periods are set out in clause 9.
3.1. Registration and User account
| Data | Purpose | Legal basis |
|---|---|---|
| Name, date of birth, profile photo, email address, username | Create and manage the account; check that the User is of legal age and, if the User so chooses, show their age on their profile to build trust between users; enable basic use of the Platform. | Performance of a contract (Art. 6(1)(b) GDPR): this data is necessary to provide the service the User requests upon registering. |
3.2. CAE verification (voluntary)
If the User voluntarily decides to obtain CAE-verified status and participate in the incentives programme described in clause 7 of the Terms and Conditions, we additionally process:
- Full name and surname and DNI/NIE.
- Phone number.
- Geolocation, activated exclusively while a trip registered under the CAE procedure is in progress (never permanently or in the background outside that procedure, and never during normal app use or on international trips unrelated to the CAE programme).
- Vehicle licence plate, if acting as a driver.
- Response to the survey on alternative modes of transport, collected at the end of a trip as a passenger when confirming drop-off, in order to calculate the energy-saving parameter required under CAE regulations (MITECO technical sheets TRA030/TRA040). This response never conditions the incentive received by the user.
| Purpose | Legal basis |
|---|---|
| Preparing and managing the Energy Saving Certificate (CAE) application and the associated incentives programme, including fraud prevention within that programme. | Explicit consent from the User (Art. 6(1)(a) GDPR), given specifically and separately from acceptance of this Policy in general, at the moment the User voluntarily performs the CAE trip procedure. Obtaining CAE-verified status does not, by itself, trigger this processing: it is only activated when the User chooses to participate in a specific trip under that procedure. |
3.3. Trip, booking and chat data
In connection with using the platform to publish or book journeys, VIB3S collects and stores: origin and destination, date, departure time, price and available seats; the history of trips, bookings, requests and cancellations; and reports and incidents. Communication between drivers and passengers takes place exclusively through the platform's internal chat, whose infrastructure is managed by GetStream (Stream.io, Inc.). To enable chat, VIB3S transfers to GetStream: a unique identifier (Firebase UID), full name, profile photo URL and username (@username). The content of messages and the identifiers of the participants in each channel (trip or direct conversation) are stored by GetStream on VIB3S's behalf. Email address, phone number, DNI, licence plate and banking data are not transferred to GetStream.
| Purpose | Legal basis |
|---|---|
| Managing the publication and booking of trips; enabling communication between Users to coordinate the journey; managing incidents and disputes (clause 12 of the Terms and Conditions). | Performance of a contract (Art. 6(1)(b) GDPR). |
| Preventing and detecting fraud or misuse of the Platform (for example, repeated cancellation patterns). | VIB3S's legitimate interest (Art. 6(1)(f) GDPR), balanced against the User's rights. |
3.4. Ratings and reviews
After a trip, users may give each other ratings (1–5 stars) and written reviews, which form part of the user's public profile.
| Purpose | Legal basis |
|---|---|
| Managing the community reputation system. | Performance of a contract, as a feature of the contracted service (Art. 6(1)(b) GDPR). |
3.5. Payment data
When the user pays for a seat, their card or payment method data is handled entirely by Stripe, our payment processor. VIB3S does not store or have access to card numbers or security codes. For drivers who wish to receive payments, Stripe may request additional identity-verification documentation (KYC) and bank details, processed directly by Stripe under its own privacy policy.
| Purpose | Legal basis |
|---|---|
| Processing payment of the trip amount and the service fee; managing charges, refunds and payment fraud prevention. | Performance of a contract (Art. 6(1)(b) GDPR); payment fraud prevention is additionally based on the legitimate interest of VIB3S and Stripe (Art. 6(1)(f) GDPR). |
| Issuing invoices for VIB3S's service fee, via its e-invoicing platform. | Compliance with a legal obligation (Art. 6(1)(c) GDPR): tax and invoicing regulations. |
3.6. Contacting VIB3S
When the User contacts VIB3S through the app's comments and suggestions form, or via info@vibescarpool.com, we process the data provided in order to respond to the query.
| Purpose | Legal basis |
|---|---|
| Handling queries, complaints and suggestions. | Performance of a contract, where the query relates to the contracted service; VIB3S's legitimate interest in properly assisting its Users in all other cases. |
3.7. Automatically collected app usage data
The application automatically collects certain data during use, in order to ensure proper functioning, improve the user experience and maintain service security:
- Usage and interaction data: actions performed within the app, session duration, technical identifiers generated by Mixpanel or Adjust.
- Device technical data: model, operating system, app version, language, time zone, error logs (Crashlytics).
- Location data (only while the app is in use and with the user's authorisation): precise location only when the user activates features that require it, such as indicating origin/destination or verifying presence at a specific point. The app does not use background location or track the user while the app is closed or inactive, except for the specific and separate CAE procedure described in clause 3.2, which is the only exception to this general rule.
- Connection data: IP address and network type, for security and service-operation purposes.
- Gallery access (with prior consent): only if the user chooses to upload a profile photo; no other images or metadata are collected.
- Push notifications: device identifier, provided the user has agreed to receive them.
| Purpose | Legal basis |
|---|---|
| Product analytics (Mixpanel), install attribution (Adjust), error detection (Crashlytics), security and service operation, sending notifications. | VIB3S's legitimate interest in maintaining, improving and securing the app (Art. 6(1)(f) GDPR); advertising tracking, on the consent given through the iOS tracking permission (clause 11.1). For analytics on the website (not the app), this processing additionally requires the User's consent under cookie regulations — see the Cookie Policy. |
3.8. Marketing and commercial prospecting
We will only process your data for advertising or commercial prospecting purposes where the User has given express and specific consent. You will never receive commercial communications from VIB3S or third parties without such prior consent.
| Purpose | Legal basis |
|---|---|
| Sending commercial communications and own advertising. | Consent (Art. 6(1)(a) GDPR), revocable at any time. |
3.9. Aggregated reports to collaborating third parties
| Purpose | Legal basis |
|---|---|
| Preparing reports, statistics and dashboards for universities, companies or collaborating entities, using only aggregated and anonymised data that does not allow users to be identified. | VIB3S's legitimate interest (Art. 6(1)(f) GDPR). As the information is aggregated and anonymised, no User can be identified from it. |
4. SHARING INFORMATION WITH THIRD PARTIES
Beyond what is set out in clause 3, VIB3S will not share Users' data with third parties unrelated to providing the service, except where legally required or with entities acting as Processors on VIB3S's behalf, with whom the corresponding data-processing agreement under Art. 28 GDPR is in place. The main processors and recipients are:
- Google Firebase (application infrastructure, authentication, notifications and error logging). More information: https://policies.google.com/privacy.
- Google LLC, when the User registers directly through their Google account.
- Apple Inc., when the User registers directly through their Apple account, and as the App Store distributor: https://www.apple.com/es/privacy/.
- Stripe, Inc., as the platform's payment processor (passenger payment data and driver payout accounts via Stripe Connect): https://stripe.com/privacy.
- GetStream (Stream.io, Inc.), as the provider of the real-time chat infrastructure, as described in clause 3.3: https://getstream.io/legal/privacy-policy/.
- Amazon Web Services, Inc. (Amazon SES), as the transactional email provider (e.g. booking confirmations): https://aws.amazon.com/privacy/.
- Mixpanel, Inc., as the product analytics provider in the app and the booking widget (clause 11.2).
- Adjust, as the provider of app install attribution and marketing campaign measurement, as described in clause 11.1.
- Meta Platforms, Inc. and LinkedIn Corporation, in connection with our corporate social media profiles (clause 10) and, in Meta's case, the website advertising analytics described in the Cookie Policy and the Meta SDK integrated in the app (clause 11.1).
The User is informed that the above providers may carry out international data transfers outside the European Economic Area. VIB3S only transfers data to providers offering adequate safeguards under Chapter V GDPR, in particular through their participation in the EU-US Data Privacy Framework (in force since July 2023) and/or through Standard Contractual Clauses approved by the European Commission. VIB3S is aware that this Data Privacy Framework is currently subject to judicial review proceedings before the courts of the European Union; should its validity be affected, VIB3S will promptly adopt the corresponding alternative safeguards and update this Policy accordingly.
5. AGE OF MAJORITY
To be a User of our application you must be at least 18 years old and have the corresponding legal capacity. VIB3S does not knowingly collect data from minors. If we detect that a minor's data has been processed without appropriate consent, we will delete such information immediately and take the necessary steps to prevent future incidents.
6. EXERCISING YOUR RIGHTS
The LOPDGDD and the GDPR grant the User a number of rights regarding the processing of their data. You may withdraw consent given and exercise your rights of Access, Rectification, Erasure, Objection, Portability, Restriction of processing and not to be subject to automated individual decisions, via email at info@vibescarpool.com or by post to: Paseo de la Castellana, número 141, planta 19, Edificio Cuzco IV, 28004 Madrid, Spain, proving your identity and expressly stating the right you wish to exercise.
- Access — Find out what personal data of yours is being processed, its purpose, origin and possible transfer to third parties.
- Rectification — Amend your personal data where inaccurate or incomplete.
- Erasure — Request deletion of your data once it is no longer needed for the purpose for which it was collected, or on another legal ground.
- Objection — Object to the processing of your data in cases such as advertising and commercial prospecting, or where processing is based on VIB3S's legitimate interest.
- Portability — Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller, where technically feasible.
- Restriction of processing — Request that your data only be stored, without further processing, in the cases provided for by law (for example, while a challenge to its accuracy is resolved).
- Not to be subject to automated individual decisions — The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or significantly affects you. As clarified in clause 8, VIB3S does not currently make decisions of this kind regarding account suspension or content moderation, which are always reviewed by a human.
You also have the right to lodge a complaint with the competent supervisory authority if you consider that the processing of your data infringes data protection law; in Spain, with the Spanish Data Protection Agency (AEPD), www.aepd.es, calle Jorge Juan, 6, 28001, Madrid.
7. LEGAL BASIS FOR PROCESSING: SUMMARY
As detailed for each specific processing activity in clause 3, VIB3S does not base all of its processing on the User's consent. The legal bases used are as follows, depending on the processing activity concerned:
- Performance of a contract (Art. 6(1)(b) GDPR): registration, managing trips and bookings, chat, ratings, payment processing.
- Compliance with a legal obligation (Art. 6(1)(c) GDPR): invoicing and retention of tax and accounting data.
- VIB3S's legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, app security, in-app product analytics, handling non-contractual queries, aggregated and anonymised reporting.
- Explicit consent (Art. 6(1)(a) GDPR): participation in the CAE programme and transfer of energy savings; advertising and commercial prospecting; non-essential cookies and technologies on the website (see the Cookie Policy).
The User warrants that the personal data provided to VIB3S is accurate and undertakes to inform us of any change to it. Where processing is based on consent, it is always revocable, without retroactive effect, using the means indicated in clause 2.
8. AUTOMATION AND HUMAN OVERSIGHT
Decisions on account suspension, content removal or dispute resolution described in the Terms and Conditions (clauses 8.3, 11 and 12.1) are made by a human team at VIB3S, not on a purely automated basis. VIB3S may use auxiliary technical tools (for example, automatically flagging repeated cancellation patterns) to identify cases requiring review, but these tools do not by themselves make decisions with legal effects on the User: the final decision always rests with a human, and may be reviewed through the right of appeal set out in clause 11 of the Terms and Conditions.
9. DATA RETENTION PERIOD
Personal data is retained for as long as necessary to fulfil the purpose for which it was collected, and thereafter, where applicable, for the following periods:
- Account and profile data: for as long as the account remains active. See clause 9.1 regarding deletion.
- Data arising from the contractual relationship (trips, bookings, ratings): for the life of the account and, after its closure, for the limitation period applicable to any civil claims that might arise (generally 5 years under Article 1964 of the Spanish Civil Code), unless an incident or claim is ongoing, in which case data is retained until its final resolution.
- Invoicing, payment and accounting data: in accordance with applicable tax and commercial law (generally 4 years under Article 66 of the General Tax Law, and 6 years under Article 30 of the Commercial Code).
- CAE programme data: for the period required under CAE System regulations for verification and control by the National Coordinator, and thereafter for the limitation period applicable to administrative liability under that system.
- Analytics data and technical logs: generally up to 26 months from collection, unless retained in aggregated and anonymised form, in which case no specific retention period applies.
9.1. Account deletion
When the User requests deletion of their account, VIB3S deletes or anonymises, without undue delay, the data that does not need to be retained for another reason — in particular the public name, profile photo, message history accessible to the User, and contact data not required for legal purposes. However, VIB3S will retain, for the periods indicated in clause 9, only the data that it is legally required to keep, in particular data arising from tax and accounting obligations (invoices, payment data), data needed to manage ongoing claims or incidents, and any other data that must be retained under applicable law.
10. SOCIAL MEDIA
We have a corporate profile on LinkedIn, TikTok and Meta (Instagram). Under data protection law, we are the controller for the data arising from the existence of these profiles and from the User's interaction with them (for example, following the profile or engaging with its content).
We will use these social networks to share news or information related to the services we provide. There is no corporate link between these platforms and VIB3S: by accessing them, the User also accepts the privacy policy and terms of use of the relevant social network, and VIB3S is not responsible for any data processing carried out by those platforms outside the strict relationship described in this clause.
11. ANALYTICS AND TRACKING TECHNOLOGIES: APP AND WEBSITE
VIB3S uses different analytics technologies on the mobile application and on the corporate website, described separately below. For the specific detail of website cookies and consent management, see the Cookie Policy.
11.1. Mobile application
The mobile application does not use cookies, but does use the following analytics and monitoring technologies:
- Firebase Crashlytics: error detection and reporting to improve app stability.
- Mixpanel: usage events, conversion funnels, retention, user segmentation, sessions and activity, device technical data, and approximate geographic data (country or region, without identifying exact location).
- Adjust: attribution of app installs and marketing campaigns. It is only activated if the User grants the iOS cross-app tracking permission (ATT); otherwise Adjust is not activated.
- Meta SDK and advertising measurement (Meta, Google Ads, TikTok and LinkedIn): measuring the effectiveness of advertising campaigns promoting the app on those platforms. On iOS, they are only activated after the User grants the cross-app tracking permission (ATT).
Product analytics (Mixpanel) and error logging (Crashlytics) are based on VIB3S's legitimate interest in maintaining, improving, securing and promoting the app (Art. 6(1)(f) GDPR). Install attribution (Adjust), tracking for advertising purposes and the use of the advertising identifier are based on the consent the User gives through the iOS tracking permission (ATT), which can be withdrawn at any time in the device settings. On Android, the User can reset or delete their advertising ID in the device settings.
11.2. Website (vib3s.app and associated domains)
The website uses only Google Analytics 4 (GA4) and Meta Pixel as non-essential tracking technologies, and both are loaded only after obtaining the User's consent through the cookie banner, as described in detail in the Cookie Policy. Neither GA4 nor Meta Pixel is activated on the website unless and until the User has given or withheld consent.
Booking widget on organisers' websites: some event organisers embed the VIB3S booking widget on their own website. Within that widget, VIB3S uses Mixpanel to measure its use (views and interactions), on the same legal basis as the app analytics.
12. DATA PROTECTION OFFICER (DPO)
VIB3S has assessed the criteria in Article 37(1) GDPR and has concluded that it is not required to appoint a Data Protection Officer, as its core activity does not consist of regular and systematic monitoring of data subjects on a large scale or large-scale processing of special categories of data. For any data protection matter you can write to info@vibescarpool.com. VIB3S will review this assessment if its processing activities change.
13. SECURITY MEASURES
VIB3S maintains the data protection security levels required by the LOPDGDD and the GDPR, and has put in place the technical and organisational means available to it to prevent the loss, misuse, alteration, unauthorised access to, and theft of data provided through the application.
The User understands and accepts that no internet security measure is absolutely impregnable, and undertakes to take reasonable steps to protect their own access credentials. VIB3S will not be liable for incidents arising from the User's failure to meet their own security obligations, nor for those caused by third parties unrelated to VIB3S in cases of accident or force majeure.
14. CHANGES AND UPDATES
This Policy may be reviewed or updated. We recommend the User check it periodically. We will notify you of significant changes through a notice on the application or platform itself, and where a change affects a purpose that requires consent, we will request it again specifically before applying that change; mere acceptance of this Policy does not amount to generic consent for future purposes not described in the version in force at any given time.
15. INTEGRATION WITH OTHER LEGAL TEXTS
This Privacy Policy is complemented by the Legal Notice, the Terms and Conditions, the Cookie Policy and any other applicable legal texts.
VERSION HISTORY
| Version | Date | Main changes |
|---|---|---|
| 2026-10-15.v1 | 2026-10-15 | Cl. 3.1: date of birth at registration and age shown on the profile only if the User so chooses. Cl. 3.7, 4 and 11.1: the app does not use Firebase Analytics or GA4; it is described when Mixpanel, Adjust and the Meta SDK are activated (Adjust and Meta only with the iOS ATT permission). Cl. 11.2: booking widget on organisers' websites. Cl. 12: outcome of the DPO assessment. |
| 2026-10-03.v1 | 2026-10-03 | Accuracy fix in clause 4: added Adjust to the consolidated processor list (already described in cl. 11.1) and removed the Invopop mention in clauses 3.5 and 4, as that billing platform is not yet operational. |
| 2026-09-18.v1 | 2026-09-18 | Full restructuring by processing/purpose/legal basis (cl. 3), removed the equation of any data provision with consent (cl. 7), concrete retention periods and account-deletion policy (cl. 9), app/website split for analytics (cl. 11), clarification on automation (cl. 8), and note on the DPO (cl. 12). |
| June 2026 | — | Previous (historical) version. |