Data controller
Stopingo, 173 rue de Courcelles, 75017 Paris, France.
Data protection contact: dpo@stopingo.com
Data collected
- Identity and account: name, phone, email, and verified identity document.
- Geolocation: pick-up and drop-off points, and tracking of a trip under way. Sensitive data, processed only as far as the service requires.
- Payment: funds are held by our licensed provider; your card numbers are never stored by the platform.
- Usage: trips, reviews, and service communications.
Why, and on what basis
To provide the journey-sharing service (performance of the contract), to ensure safety and trust (legitimate interest), and to meet our legal obligations (identity verification, tax). Your data is neither sold nor rented.
For how long
Transient data (sessions, message threads, trip context, notifications) expires and is deleted automatically, category by category. Identity and billing data is kept for as long as legal obligations require, then deleted or anonymised.
Who has access
Only the processors strictly necessary to the service, each limited to its purpose: the authorised payment provider (collection, identity verification), the infrastructure host, the communication providers (SMS, email), mapping and geocoding, and technical observability. For a relay journey, sharing is limited to the leg concerned.
Your data is neither sold nor rented: none of these recipients receives it for advertising purposes. And the money you pay is never ours. The licensed provider is the sole holder of the funds, which stay segregated from the platform's own accounts.
Where it is stored
With our infrastructure host, with data residency by jurisdiction: the data of French users is hosted in the European Union. For a relay journey, each driver only sees the leg that concerns them.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability. To exercise them, write to dpo@stopingo.com. You may also lodge a complaint with the competent supervisory authority (in France, the CNIL, www.cnil.fr).
Changes to this policy
This policy is versioned, like the terms and conditions: when its content changes, the new version is presented to you and your acceptance is recorded. Changes required by law may take effect as soon as they are published.
Cookies and local storage
Only two things depend on your consent on this site: audience measurement and error reporting. Until you have answered, neither happens. Nothing is sent, nothing is written to your device on that account. Everything else is written only when you make the corresponding choice (changing language or theme, signing in) and serves only to hold that choice or your session.
| Name | What it does | Lifetime |
|---|---|---|
| Consent | Keeps your answer to the banner. That is what stops us asking again on every page. | 6 months |
| Audience measurement subject to your choice | A random number, specific to this device: it tells a new visit from a return. It exists only if you accepted audience measurement, and disappears as soon as you withdraw it. | 13 months |
| Language | Keeps the language you chose. | 1 year |
| Theme | Keeps the theme you chose (light, dark). | 1 year |
| Map theme | Keeps the map theme you chose. | Until your browser clears it |
| Text size | Keeps the text size you chose. | 1 year |
| Role | Keeps the role you open on: passenger or driver. | 1 year |
| Invitation | Remembers that your invitation link was accepted, so you are not asked again. | Lifetime of the invitation (30 days at most) |
| Session | Keeps you signed in. | Lifetime of your session |
| Return after sign-in | Remembers which screen to bring you back to after signing in. | The tab (cleared as soon as it is used) |
| Google sign-in | Secures the Google sign-in (protection against forged requests). | The sign-in itself |
Two screens inside the app call an outside provider, for the one thing you asked them for: the payment screen loads the licensed payment provider’s script, which may set its own fraud-prevention cookies; the map loads its basemap and fonts from the hosts listed in our legal notice. Neither is there to follow you. The error report, for its part, only goes to our monitoring provider if you accepted it, and until you do, that provider’s address is not even allowed by the page’s security policy: it is your browser that refuses the connection, not only our code.
You can change your mind whenever you like: withdrawing takes exactly one click, just like granting.