Privacy policy

Last updated: 29 October 2026

This is a translation provided for convenience. If it differs from the Spanish text, the Spanish text prevails.

Who is behind Compamo

Compamo is a service provided by a self-employed professional, who is also the controller of personal data.

Item	Details
Owner	Ignacio Bausa Edo
Tax ID (NIF)	29213467V
Address	Calle Cofrentes, 1, 46010 Valencia, Spain
Contact	info@compamo.com, and in the app under Help
Data protection officer	None appointed; privacy questions are answered at the contact email
Supervisory authority	Spanish Data Protection Agency (aepd.es)

What data we process and why

Compamo only processes the data the service uses, for these purposes and on these legal bases.

Email, first name, language

Purpose: Signing in with a code by email (no passwords), notifications in your language
Legal basis: Performance of the contract (art. 6.1.b GDPR)
Who sees it: You and the team

Average rating and number of ratings

Purpose: So others know who they travel with
Legal basis: Contract
Who sees it: Users of the platform

Verification result, surname, date of birth, sex on the ID

Purpose: Everyone verified, legal age (18), women-only rides
Legal basis: Contract and legitimate interest in safety; the biometric part, explicit consent (see next section)
Who sees it: Only the team roles that review identities; the sex is shown to no one

Car: make, model, colour, seats and plate

Purpose: Recognising the car at pickup
Legal basis: Contract
Who sees it: Make, model and colour, public; plate, only people who book and the people they share the trip with

Rides and bookings: route, stops, times, seats, amounts

Purpose: Providing the service
Legal basis: Contract
Who sees it: The driver and passengers of the ride

Payments: amounts, refunds, driver payouts

Purpose: Charging, refunding and paying drivers
Legal basis: Contract and accounting and tax obligations (including DAC7)
Who sees it: You and the team. Card and bank details are handled by Stripe; Compamo never sees them

Location during the trip

Purpose: Starting and ending the trip on its own, showing the car to the passenger, safety
Legal basis: Contract and legitimate interest in safety
Who sees it: The other person on the trip; whoever you choose with the share link

Chat messages

Purpose: So drivers and passengers can organise
Legal basis: Contract; moderation, legitimate interest in safety
Who sees it: The participants; the team if someone reports

Ratings and comments

Purpose: Trust between users
Legal basis: Contract
Who sees it: Public on the profile

Reports, sanctions and appeals

Purpose: Safety and compliance with the Digital Services Act
Legal basis: Legal obligation (DSA) and legitimate interest
Who sees it: The person concerned gets the reasons; the reporter, only the outcome

Conversations with the Help assistant

Purpose: Answering questions and handling requests; handing over to the team
Legal basis: Contract
Who sees it: You, and the team if the case is handed over

Phone identifier for notifications

Purpose: Sending notifications
Legal basis: Contract
Who sees it: No one

Technical errors

Purpose: Fixing faults
Legal basis: Legitimate interest
Who sees it: The technical team; only with the account identifier, never name, email or location

Log of team activity and of consents

Purpose: Showing what was done and what was agreed to
Legal basis: Legal obligation (accountability)
Who sees it: The team

Data	Purpose	Legal basis	Who sees it
Email, first name, language	Signing in with a code by email (no passwords), notifications in your language	Performance of the contract (art. 6.1.b GDPR)	You and the team
Average rating and number of ratings	So others know who they travel with	Contract	Users of the platform
Verification result, surname, date of birth, sex on the ID	Everyone verified, legal age (18), women-only rides	Contract and legitimate interest in safety; the biometric part, explicit consent (see next section)	Only the team roles that review identities; the sex is shown to no one
Car: make, model, colour, seats and plate	Recognising the car at pickup	Contract	Make, model and colour, public; plate, only people who book and the people they share the trip with
Rides and bookings: route, stops, times, seats, amounts	Providing the service	Contract	The driver and passengers of the ride
Payments: amounts, refunds, driver payouts	Charging, refunding and paying drivers	Contract and accounting and tax obligations (including DAC7)	You and the team. Card and bank details are handled by Stripe; Compamo never sees them
Location during the trip	Starting and ending the trip on its own, showing the car to the passenger, safety	Contract and legitimate interest in safety	The other person on the trip; whoever you choose with the share link
Chat messages	So drivers and passengers can organise	Contract; moderation, legitimate interest in safety	The participants; the team if someone reports
Ratings and comments	Trust between users	Contract	Public on the profile
Reports, sanctions and appeals	Safety and compliance with the Digital Services Act	Legal obligation (DSA) and legitimate interest	The person concerned gets the reasons; the reporter, only the outcome
Conversations with the Help assistant	Answering questions and handling requests; handing over to the team	Contract	You, and the team if the case is handed over
Phone identifier for notifications	Sending notifications	Contract	No one
Technical errors	Fixing faults	Legitimate interest	The technical team; only with the account identifier, never name, email or location
Log of team activity and of consents	Showing what was done and what was agreed to	Legal obligation (accountability)	The team

Identity verification and biometric data

Everyone verifies their identity once, with their ID and a selfie, through Didit, our verification provider. Comparing faces uses biometric data, so it only happens with your explicit consent (art. 9.2.a GDPR), which the app asks for before starting and which is recorded with the date and the version of the text you agreed to.

What Didit does on Compamo's behalf: reads your ID and checks it is genuine, checks that a real person is in front of the camera and compares your face with the one on the ID.
Duplicate accounts: so that nobody who was banned comes back with another account, Didit compares your face with those of people already verified. For that it keeps a biometric template: a mathematical representation of the face, not a photo.
What Compamo receives: only the result, your first name, your surname, your date of birth and the sex shown on the ID. Compamo never receives your selfie, the photo of your ID, its number or the template. If you have not given your first name, we use the one on the ID so the people you travel with know what to call you.
What they are used for: the date of birth, to check you are 18 or over; the sex on the ID, only for women-only rides. They are shown to no one.
Retention: Didit deletes the images within 90 days, and the template when you delete your account or withdraw your consent (after 10 years at the latest).
Withdrawing consent: at any time, from Help or at the contact email. We will ask Didit to delete your biometric data; your account will no longer be verified and you will not be able to offer or book rides.
Human review: if the automatic check rejects you and you think it is a mistake, write to us from Help and a person will review it.

Location during the trip

Compamo only uses your location while a trip you take part in is under way, and deletes it after 30 days. If a safety alert goes off or you press the emergency button, the position at that moment is kept with the alert, which is deleted 2 years after it is closed.

When: from 30 minutes before your pickup until 60 minutes after the expected arrival (up to 3 more hours if the trip is still going). As a passenger, sharing stops as soon as you reach your stop. Outside that time the app does not send your location, and you can stop sharing it whenever you want.
Why: so the trip starts and ends only when you travel together, the passenger sees the car arriving and the driver sees who is waiting at the pickup, and for your safety: if the car strays far from the route or stops for too long, the app asks "Everything OK?" and alerts the safety team if nobody answers.
Who sees it: the other person on the trip, only during that time; the people you share the trip with through its link, until you cancel it; and the safety team if there is an alert or you press the emergency button.
Fake locations: the app detects simulated locations and does not use them to move the trip forward.
Maps: the app draws the trip map with Apple Maps on iPhone and Google Maps on Android, which receive the map areas shown, as with any map app; Compamo does not give them your account. On Android, Google's Privacy Policy applies. The map on the shared-trip page is OpenStreetMap and comes through Compamo's servers, so whoever looks at it does not connect to any map provider.

Automatic moderation and artificial intelligence

Compamo uses artificial intelligence in two places, and in neither does it make decisions that significantly affect you on its own: sanctions are always decided by a person.

Messages and comments: before they are delivered, they are checked automatically, first with rules and, in doubtful cases, with an AI model (Claude, by Anthropic). Contact details before the booking is paid, payments outside Compamo and harassment are blocked. A blocked message is not delivered and its writer sees why. If you think it is a mistake, write to us from Help and a person will review it.
Help assistant: it is an AI (Claude, by Anthropic), and it always says so. It can look up your trips and your account status and hand you over to a person on the team when you ask or when the case needs it. It can suggest cancelling a booking, but the booking is only cancelled if you press the confirmation button.
What Anthropic receives: the text of the messages being checked and the conversation with the assistant, with the details of your trips it needs. Anthropic does not use them to train its models.
Identity verification: if it rejects you, you can ask for a person to review it (previous section).

Providers that process data on Compamo's behalf

Compamo does not sell or share your data. These providers process it only to provide the service, under a data processing agreement.

Supabase

Purpose: Database and sign-in with an email code
Data: All account and platform data
Where: Servers in Paris (EU)

Vercel

Purpose: Servers for the app and the team panel
Data: Requests to the platform, in transit
Where: Servers in Paris (EU)

Didit Identity Spain, S.L.

Purpose: Identity verification
Data: ID, selfie and biometric template
Where: European Union

Stripe Payments Europe, Ltd.

Purpose: Payments, refunds and driver payouts, and the checks the law requires of people who get paid
Data: Payment and bank details, which Compamo does not see
Where: Ireland (EU), with transfers to the US

Anthropic

Purpose: Moderation and the Help assistant
Data: Checked texts and Help conversations
Where: United States

Google (Google Maps Platform)

Purpose: Searching for places, calculating routes and, on Android, the trip map
Data: What you type when searching for a place, the stops of the ride and the map areas shown
Where: United States

Resend

Purpose: Sending the emails with the sign-in code
Data: Your email
Where: Ireland (EU)

Expo, Apple and Google

Purpose: Delivering notifications to the phone
Data: Phone identifier and notification text
Where: United States

Sentry

Purpose: Recording errors in the app and the API
Data: Account identifier and technical data
Where: Germany (EU)

Provider	Purpose	Data	Where
Supabase	Database and sign-in with an email code	All account and platform data	Servers in Paris (EU)
Vercel	Servers for the app and the team panel	Requests to the platform, in transit	Servers in Paris (EU)
Didit Identity Spain, S.L.	Identity verification	ID, selfie and biometric template	European Union
Stripe Payments Europe, Ltd.	Payments, refunds and driver payouts, and the checks the law requires of people who get paid	Payment and bank details, which Compamo does not see	Ireland (EU), with transfers to the US
Anthropic	Moderation and the Help assistant	Checked texts and Help conversations	United States
Google (Google Maps Platform)	Searching for places, calculating routes and, on Android, the trip map	What you type when searching for a place, the stops of the ride and the map areas shown	United States
Resend	Sending the emails with the sign-in code	Your email	Ireland (EU)
Expo, Apple and Google	Delivering notifications to the phone	Phone identifier and notification text	United States
Sentry	Recording errors in the app and the API	Account identifier and technical data	Germany (EU)

When a provider processes data outside the European Economic Area, it relies on the European Commission's standard contractual clauses or, if it has signed up to it, the EU-US Data Privacy Framework.

How long data is kept

Each piece of data is deleted as soon as it is no longer needed; the periods are applied automatically.

Data	How long
Location during the trip	30 days
Chat messages	1 year from the conversation's last message
Help conversations	1 year from when they are closed
In-app notifications	1 year
Technical errors	Up to 90 days
Verification images (at Didit)	90 days at most
Biometric template (at Didit)	Until you delete your account or withdraw your consent, 10 years at most
Account, profile and identity data	Until you delete your account
Reports, safety alerts, sanctions and appeals	2 years from when they are closed
Bookings, payments, refunds and the record of consents	6 years, for accounting and tax obligations and to be able to defend claims

When you delete your account, your profile, identity data, cars, locations, Help conversations and notifications are deleted, and we ask Didit to delete your biometric data. Your ratings and chat messages remain without your name, and of the cars used on past rides only the make, model and colour remain. What the law requires us to keep (bookings and payments) is kept separately from your identity until its period ends.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability free of charge at any time, and withdraw any consent you have given.

Deleting your account: in the app, under Profile, "Delete my account". You first need to cancel any upcoming rides and bookings and, if you drive, to have been paid for past rides. If you no longer have the app, write to the contact email from your account's address (how).
Correcting your data: your name and language, in Profile. The details from your ID can only be corrected with a new verification; ask for one from Help.
Everything else (a copy of your data, objecting to or restricting processing): write to us from Help or at the contact email. We answer within one month at the latest.
Complaints: if you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Age: Compamo is only for people aged 18 or over.
Changes: we will let you know in the app before any significant change to this policy takes effect.