Privacy Policy
Who we are
Drumo ("Drumo", "the app", "we", "us", "our") is a ride-sharing / carpooling mobile application. In Drumo, drivers announce trips they intend to make (where and when), and riders can browse those trips and request to join. Drivers decide whether to accept a rider. There are no separate "driver" and "rider" accounts; the same person can do both.
This Privacy Policy explains what personal data Drumo collects, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have.
Data controller
- Name: Drumo OOD
- Email: [email protected]
- This policy is published at: https://drumo.net/en/privacy
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.
Summary (the short version)
- We collect only what the app needs to work: your account/profile, your location while you use the map, photos you choose to upload, your chat messages, and a push-notification token.
- All collected data is stored on our production machines.
- We do not sell your data.
- We do not share it with advertisers, data brokers, or analytics companies.
- We do not use it for marketing or profiling.
- We don't hand your data to anyone to use for their own purposes. The app relies on a few technology providers (Apple/Google location services, Google Maps, Firebase, Twilio, and our host Fly.io), but only so each can do its specific job, such as resolving your location, drawing the map, delivering a notification, or sending the verification SMS.
- We delete trip information after 12 months.
What data we collect, why, and our legal basis
We collect the following categories of personal data. We collect each category only for the purpose described, and only the data needed for that purpose.
3.1 Account & profile data
- What: your mobile phone number (used to create and verify your account), your display name, and your profile photo, if you choose to add one.
- Why: to create and secure your account, identify you to other users in trips and chat, and prevent abuse.
- How we verify you: we send a one-time verification code by SMS to your phone number. SMS delivery is handled by our messaging provider (see §5).
- Legal basis: performance of a contract (providing the service you signed up for), GDPR Art. 6(1)(b).
3.2 Location data (precise and approximate)
- What: your device location, both precise (GPS-level) and approximate, while you are using the app.
- Why: to show your position on the map, to let drivers set a trip's origin and destination, to show nearby and relevant trips, and to help riders and drivers coordinate pick-up points.
- Foreground only: the app requests location only while it is open and in use. It does not track your location in the background.
- Legal basis: performance of a contract, GDPR Art. 6(1)(b). Access to the device's location sensors additionally requires the operating-system permission you grant (and can revoke) on your device.
3.3 Photos & camera
- What: a photo you select from your photo library or capture with your camera, used as your profile picture. You crop it in the app before uploading.
- Why: to set your profile picture, so other trip members can recognise you.
- What we do not do: we access the camera and photo library only when you actively choose to add or change your profile picture. We do not scan, browse, or upload any other photos.
- Legal basis: consent (you choose to upload a picture; you can remove it at any time), GDPR Art. 6(1)(a), together with performance of a contract.
3.4 Chat message content
- What: the content of messages you send and receive in the in-app chat with other members of a trip.
- Why: to let riders and accepted members of a trip communicate to arrange the ride.
- Moderation: messages may be reviewed in response to an abuse/safety report so we can keep the service safe and act on objectionable content.
- Legal basis: performance of a contract, GDPR Art. 6(1)(b); and our legitimate interest in keeping the service safe, GDPR Art. 6(1)(f).
3.5 Push notification & device tokens
- What: a push-notification token issued for your device by Firebase Cloud Messaging (FCM).
- Why: to deliver notifications to you (for example, when a driver accepts your request, or you receive a new chat message).
- Legal basis: performance of a contract, GDPR Art. 6(1)(b). You can turn off notifications in your device settings at any time.
3.6 Device & diagnostic data (bug reports)
- What: when a problem or bug report is generated, we attach basic technical information: your device model, operating-system version, and the app version/build number.
- Why: to diagnose and fix problems and keep the app working correctly.
- Legal basis: our legitimate interest in maintaining and improving the reliability of the service, GDPR Art. 6(1)(f).
3.7 Trip data
- What: trips you create or join: origin, destination, time, and trip membership (which users are part of the trip).
- Why: this is the core function of the app: announcing, finding, and joining rides.
- Retention: trip information is deleted after 12 months (see §7).
- Legal basis: performance of a contract, GDPR Art. 6(1)(b).
How we use your data
We use the data described above only to:
- create, secure, and operate your account;
- show the map and your location, and let you create, find, and join trips;
- enable chat between members of a trip;
- send you push notifications related to your trips and messages;
- keep the service safe (handle abuse/safety reports and moderate content);
- diagnose and fix technical problems.
We do not use your data for advertising, marketing, profiling, or automated decision-making that produces legal or similarly significant effects.
Third-party services and who can access your data
All collected data is stored on the production machines we operate. We do not sell your data, and we do not share it with advertisers, data brokers, or analytics providers. We do not hand your data to anyone to use for their own purposes.
The app does, however, depend on a few technology providers to work. With these providers it is not a matter of us distributing your data for them to use. Instead, either the provider supplies information to the app, or a single piece of data necessarily passes through the provider so it can perform one specific function:
| Provider | What it does | Data involved |
|---|---|---|
| Apple / Google device location services | Your device's operating system (Apple on iOS, Google on Android) works out your location from GPS, Wi-Fi and mobile signals and provides it to the app. This happens on your device. | Your location |
| Google Maps Platform | To draw the map, convert between coordinates and place names (geocoding), and calculate routes and directions, the app sends the relevant coordinates to Google and receives the result back. | The coordinates you view or route between while using the map |
| Firebase Cloud Messaging (Google) | Delivers our push notifications to your device. | Push / device token |
| Twilio | Sends the one-time SMS verification code; to deliver it, your phone number is passed to Twilio. | Your phone number |
| Fly.io | Hosts our servers. All app data lives on the production machines we rent from Fly.io and run our application on. | All data stored by the app |
Each provider receives only the specific data needed to perform the function above. We do not give them your data for advertising or to build profiles of you. How each provider then handles the data it receives is governed by its own privacy policy: Google, Apple, Twilio, Fly.io.
We may also disclose data if we are legally required to do so (for example, in response to a lawful request from a competent authority), or to protect the rights, safety, and security of our users and the service.
Other Drumo users see only what is necessary for the service to work: your display name, profile photo (if you set one), and the trip and chat information you share with members of a trip.
International transfers
Some of our service providers (e.g. Google, Apple, Twilio and Fly.io) are based outside the European Economic Area (EEA) and may process data in countries outside the EEA. Where this happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses and/or an adequacy decision (e.g. the EU–US Data Privacy Framework).
How long we keep your data
- Trip information is deleted after 12 months.
- Account and profile data (phone number, name, profile photo) is kept for as long as your account exists. When you delete your account, we delete this data, except where we are required by law to retain certain information for a defined period.
- Chat messages are kept for as long as needed for the related trip and our safety obligations, and are removed in line with trip retention.
- Push tokens are removed when they become invalid or when you uninstall the app or disable notifications.
- Diagnostic/bug-report data is kept only as long as needed to investigate and fix the relevant problem.
How we protect your data
We use technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS) between the app and our servers, restricted access to our servers, and secure storage of sensitive values on your device. No method of transmission or storage is completely secure, but we work to protect your data using industry-standard practices.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict or object to certain processing;
- data portability: receive your data in a structured, machine-readable format;
- withdraw consent at any time, where processing is based on consent (this does not affect processing done before withdrawal).
You can exercise these rights by contacting us at [email protected]. You can also delete your profile photo, turn off notifications, and revoke location, camera, and photo permissions directly in your device settings at any time.
You have the right to lodge a complaint with the Bulgarian supervisory authority:
Commission for Personal Data Protection (CPDP)2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
Website: https://www.cpdp.bg
Email: [email protected]
Children
Drumo is not intended for children. You must be at least 18 years old (or the age of majority in your country) to create an account and use the service. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us at [email protected] and we will delete it.
Device permissions
Drumo asks for the following permissions on your device, and you can grant or revoke each of them at any time in your device's settings:
- Location: to show your position and nearby/relevant trips (foreground use only).
- Camera: to take a profile photo (only when you choose to).
- Photos / Photo library: to pick a profile photo (only when you choose to).
- Notifications: to deliver push notifications about your trips and messages.
If you revoke a permission, the related feature may stop working, but the rest of the app will continue to function.
Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top and publish the new version at https://drumo.net/en/privacy. Significant changes may also be communicated in the app.
Contact
If you have any questions about this Privacy Policy or your personal data, contact us at [email protected].