Captain Bob
Privacy policy
- Who processes your data
- What wecollect
- Why, and in what capacity
- Who has access to it
- Where they are housed
- How long
- Closing your account
- Backups
- Cookies and audience measurement
- Your rights
- Security
- Amendments
1. Who processes your data
The data controller is CAPTAIN BOB SAS, 6 place Wilson, 31000 Toulouse, France.
If you have any questions about your data, please write to contact@captain-bob.com.
2. What we collect
What you tell us
- Your first and last name, email address and, if desired, your phone number.
- Your home address, which we convert into geographical coordinates to offer you activities near you.
- Your profile picture, the description you write, the languages you speak, and your favorite activities.
- If you offer carpooling: your vehicle’s nickname, make, model, colour and licence plate, as well as its photo.
- If you choose to fill in one: an emergency contact — their name and a way to reach them. This person doesn’t have an account with us; we only use them when they need something related to an activity, and they disappear with your account.
What is born from your use
- The experiences and carpools you post, your reservations, the messages exchanged with other members and the reviews you leave.
- Your location, when you allow it, to view activities around you. It is used for the screen you are viewing and is not kept in history.
- Your notification preferences and app language.
If you pay for an outing - We keep the amount, the service fee, the currency, the status of the payment and its dates, as well as the reference numbers assigned by Stripe. These references allow the transaction to be found at Stripe in the event of a complaint or refund; they do not contain any bank details.
- If you receive payments
- To be paid for your outings, you open an account with Stripe from the app. Your identity, date of birth, address and bank details are requested by Stripe, on its own pages, and are transmitted directly to it: we do not see them. We only keep the ID of the account that Stripe assigns to you, and two indications: if you have completed your registration, and if Stripe authorizes you to receive transfers.
If you’re signing in with Google or Apple
We receive an account ID and your email address from these services. With Apple, you can choose to hide your address, and we receive a relay address, and we never know yours.
What we never see
We do not ask for ID, driver’s license, or proof of address, and we do not collect dates of birth or gender.
Your bank details do not reach us. When you pay for an exit, your card number is entered in the window of our service provider Stripe and transmitted directly to them: we never have access to it and we do not store it.
3. Why, and in what capacity?
| What we do | On what basis |
|---|---|
| Create and maintain your account, publish your ads, manage your reservations, allow you to exchange with other members | Performance of the contract between us |
| Send you messages related to your activities: confirmation, cancellation, reminder | Performance of the contract |
| View activities near you from your location | Your consent, which you give to your phone’s operating system and can withdraw at any time |
| Reviewing a report and moderating behaviour that violates our terms | Our legitimate interest in protecting members |
| Measuring the audience of our site | Your consent to the organizer |
| Collect payment for a reservation and pay your share to the organizer | Performance of the contract between us |
| Keep the accounting record of these operations | A legal obligation |
4. Who has access to it?
We do not sell any data. We use the following service providers, each for a specific task:
| Provider | Why | Where |
|---|---|---|
| IONOS | Hosting the application, database and site | France |
| SparkPost | Sending emails | European Union |
| Google — Maps and Places | Maps and address search | United States |
| Google — Firebase | Notifications on your phone | United States |
| Google and Apple | Login to your account, if you choose | United States |
| Vercel | Hosting our admin tool | United States |
| Google Analytics | Site audience measurement, with your consent | United States |
| Stripe | Collecting payments and disbursing to organizers | Ireland, United States |
Transfers to the US are based on the European Commission’s Standard Contractual Clauses and, for relevant companies, their certification under the EU-US Data Protection Framework.
We may also disclose data to a judicial or administrative authority where we are required to do so by law.
5. Where are they staying?
Your account, announcements, bookings and messages are stored on a server located in France, at IONOS.
6. How long?
| Data | Duration |
|---|---|
| Your account information | As long as your account exists. They are deleted as soon as it is closed. |
| An inactive account | Three years after your last login, we will notify you; if you do not respond, the account will be closed and the data deleted. |
| Your bookings | Five years, during which time a claim remains possible between the parties. |
| A report | Three years from his treatment. |
| Backups | Three weeks, by automatic rotation. |
| Payment details for a booking | Ten years from the transaction: the law requires us to keep the accounting documents for this period. After the closure of your account, they are no longer linked to your identity. |
7. Closing your account?
You can close your account from the app, in Profile › Settings. The closure is immediate and does not require any action with us.
What is deleted on the spot
Your name, email address, phone number, password, home address and geographic coordinates, photograph, including the files themselves, description, languages, favourite activities, emergency contact, licence plate and vehicle photo, and the text of your messages, notices and reports.
What remains, and why
- Your past bookings, because they are also a record of what the other party has experienced, and because a claim remains possible for five years.
- Past experiences and carpooling that you have organized, because other people have participated in them and their history should not be interrupted.
- The numerical scores of the reviews you have left, because they are part of the reputation of the person being evaluated. The written comment is deleted.
The amount, date and references of the payments you have made or received, because the law requires us to keep the accounting records for ten years. Like the rest, they refer to an emptied account, which no longer designates anyone.
None of this remains attached to your identity: these elements refer to an emptied account, which no longer designates anyone.
Your upcoming activities are cancelled and registrants are notified.
8. Backups
Our database is backed up every night, so that it can be restored in the event of an incident. A deleted piece of data therefore remains in these archives for about three weeks, before disappearing with their automatic rotation.
If we were to revert a backup, we would reapply the deletions requested since the date of the backup.
9. Cookies and audience measurement
The mobile application does not deposit any cookies and does not contain any advertising or statistical trackers.
Our site uses Google Analytics to measure its traffic. These cookies are only placed after your acceptance, and you can refuse or withdraw it at any time without limiting your browsing.
10. Your rights
You have the right to access your data, rectify, erase, limit processing, object to your data, and portability.
The simplest thing is that most of these rights can be exercised directly in the application. You can change your information at any time, and close your account without writing to us.
For the rest, write to contact@captain-bob.com. We respond within one month. We may ask you to prove your identity if we have serious doubts about the person making the request.
If you believe that your rights are not being respected, you can refer the matter to the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, 75007 Paris, or file a complaint on cnil.fr.
11. Security
Exchanges between the application and our servers are encrypted. Passwords are never stored in plain text: we only keep a fingerprint of them, which does not allow them to be retrieved. Access to the database is restricted to people who need it.
No system is infallible. In the event of a data breach that could pose a risk to your rights, we will inform the CNIL within 72 hours and, when the risk is high, inform you directly.
12. Amendments
We may change this policy, including when the service changes. The current version date can be found at the bottom of this page. If there are any material changes, we will notify you in the app or by email.
CAPTAIN BOB SAS · 6 place Wilson, 31000 Toulouse · contact@captain-bob.com
