Privacy policy

Who is responsible for your data

The data controller is Coldriver S.A.S, tax ID (RUC) 0993367355001, domiciled at Cdla. IETEL, Mz. 3, Villa 12, Guayaquil, Ecuador. We process your data under the Organic Law on Personal Data Protection (LOPDP) of Ecuador and, where applicable, the General Data Protection Regulation (GDPR/RGPD).

For any privacy matter —access, rectification, erasure, objection or a complaint— write to soporte@berlina.app. We answer within the deadlines the law sets.

Your account data

Name, email address, phone number and date of birth. Your date of birth determines which kind of account you can have: the general one is for people over 18, and between 15 and 18 you can only ride with a Berlina Teen account, which requires signed permission from your legal guardian.

Location

• During the ride, to assign you a driver, plot the route, calculate the fare and activate the safety tools.
• With the app in the background, if you are a driver on shift, to offer you nearby rides and so that, if you press the emergency button, we know where you are. Your phone tells you when this happens and you can revoke it from the system settings.

Ride audio · read this carefully

Berlina records the audio of the whole ride, start to finish, not only when something happens. We do it because audio is the only evidence of what goes on inside a car when one person says something happened and another denies it.

If you do not agree to being recorded, do not use the service. There is no way to ride with Berlina without audio recording.

• You are told at the start of the ride, and recording continues until the ride ends.
• Both parties are recorded: the passenger and the driver. If you are a driver, your whole working day is recorded while you take rides.
• If someone rides with you, that person is recorded too. Tell them.
• Audio is stored encrypted (AES-GCM with a wrapped key). It cannot be played from the admin panel without a logged, audited action.
• It is deleted after 14 days, unless there is a report, a complaint or an open investigation about that ride. In that case it is kept until the case closes.
• We do not use it for advertising, or to train systems, and we do not listen to it unless there is a reported incident or an authority requires it.

Biometric data · special category

To verify that the person travelling or driving is the account holder we take a photograph of your face and compare it with the one on your identity document. Ecuadorian law treats biometric data as a special category, and so:

• For passengers, the authorisation is part of the terms you accept when creating your account (see "Passenger identity verification" in the terms); for drivers it is requested separately before the photo is taken. In both cases the text and the date are recorded.
• The comparison is performed by Amazon Rekognition (Amazon Web Services), which involves an international transfer of that image.
• If you withdraw the authorisation your account is no longer verified: a passenger cannot request rides and a driver cannot drive until she verifies again. It is the guarantee that the person travelling or driving is who she says she is.

Verification documents (drivers only)

National ID or passport, driving licence, SPPAT, vehicle registration, tax ID and photographs of the vehicle.

Third-party data you give us

When you add a trusted contact, you give us the name, phone number and, if you wish, the email of another person who is not a Berlina user.

• We only use them to alert that person if you press the emergency button, if you ask that they be told when a ride starts or ends or —if you are a driver— when you close your shift.
• We do not send them advertising and we do not create an account for them.
• That person has to accept the invitation before receiving anything. Until they accept, no arrival notice and no emergency alert reaches them.
• You can remove a contact at any time from the app, and it is deleted.

Messages, reports and payment data

We keep the ride chat, the reports you make about another person and the blocks.

Payments are processed by Stripe. Berlina does not store full card numbers: only the last four digits and the brand, so you recognise which card you used.

From the business form on the website we keep company, name, email, phone, team size and message, only to answer your request.

What we use them for, and on what legal basis

We do not sell your data. We do not pass it to advertisers or data brokers.

• Running the ride —request, assignment, route, charge—: performance of the contract.
• Driver identity verification: performance of the contract and legitimate interest in safety.
• Facial biometric verification of passengers and drivers: explicit consent, as special category data. Passengers grant it when creating their account and accepting these terms.
• Ride audio recording: legitimate interest in the safety of persons, disclosed at the start of the ride.
• Berlina Teen account (15 to 18): consent of the legal guardian, with the text and the date recorded.
• Alerts to trusted contacts: consent, yours when you add them and theirs when they accept.
• Moderation, reports and blocks: legitimate interest in the safety of the community.
• Support and handling of complaints: performance of the contract.
• Invoicing and tax obligations: legal obligation.

What the other party sees

The driver sees your name, your photo, your rating and the pickup and drop-off points. She does not see your phone number. You see the same about her, plus the plate and the model of the vehicle.

Communication goes through the app chat. We never share phone numbers between passenger and driver.

If you ride with a Berlina Teen account, your legal guardian also sees the ride in progress and receives the arrival notice. They do not see the chat.

Who we share with, and where your data goes

Berlina relies on providers to operate. They process personal data on our behalf, under contract, and some are outside Ecuador, which constitutes an international transfer.

These transfers rely on contractual clauses and on the necessity of performing the service you contract. Beyond that, we only hand data to competent authorities when a rule or an order requires it, and we log every disclosure.

• Amazon Rekognition — comparison of your selfie with the photo on your ID document — United States.
• Amazon Textract — reading the data on your ID card — United States.
• DeepSeek — the AI assistants in the app; it receives your first name and aggregate figures, never documents, locations or chats — China.
• Stripe — payment processing — United States and Ireland.
• Google Maps — maps, routes and navigation — United States.
• Firebase (Google) — notifications to your phone — United States.
• Resend — email delivery — United States.
• Sentry — error logging for the app and the site, without personal data — United States.
• Berlina servers (Contabo) — database, documents, audio and evidence — United States. Documents, audio and evidence are stored encrypted; the server disk does not use full-disk encryption. Backups are kept for 14 days.

How long we keep each thing

The exception that overrides all of them: if there is a report, a complaint, a dispute or an open investigation about a ride, everything related to that ride is not deleted until the case closes. Deleting it would be destroying the evidence of what happened to someone.

• Ride audio: 14 days; under a retention order (open case or legal request), 1 year from the order.
• Ride chat: 90 days.
• Reports between users: 1 year from the moment the case closes.
• Blocks between users: 2 years from the moment the block is lifted; an active block is never deleted.
• Cabin photos, alerts and anomalies of a ride: 1 year.
• Last known location and position trail: 90 days.
• Images of a rejected identity verification: 30 days; only a digest of the ID number is kept.
• "Let me know when you arrive" requests: 180 days or until the notice is sent.
• Codes, links and temporary leftovers (sign-ins, invitations, ride links): 30 days.
• App telemetry and notices: 90 days; recomputable evaluations: 180 days.
• Account and ride data: while the account is active; when you delete it, 30 days to change your mind.
• Payments, settlements, withdrawals and invoices: 7 years, as tax law requires.
• Access and action logs: 1 year; administration team actions, 5 years.
• Backups: 14 days.

Your rights

You can access your data, rectify it, erase it, object to certain processing, ask that it be restricted and ask for it in a portable format. From the app: Profile → Delete my account.

When you delete your account we erase your profile, your photo and your contact details, your location history, your trusted contacts, your saved payment methods and your chat messages, except those in an open case.

What is not erased, and we want you to know before deciding: your saved routes —the recurring rides you created, which contain the addresses you saved, including your home address if you saved it there; if you want them gone, delete them from the app before deleting the account—, the tax records of the rides you paid for, and anything attached to an open case.

If you have a complaint about how we handle your data, you can file it with the Superintendency for Personal Data Protection of Ecuador.

Go to the account deletion page

Minors · Berlina Teen

The general Berlina account is for people over 18. Between 15 and 18 there is a different arrangement, Berlina Teen.

Under 15 no account is possible, in any form. If we find one, we close it and delete its data.

• The account is created by the teenager's legal guardian, not by her.
• That person signs an explicit permission. We store the exact text they accepted and the date, so there is a record of what was consented to and when.
• Without that permission in force, the account cannot confirm a ride. It is not a warning: the system blocks it.
• During the ride, her guardian sees the trip in progress and receives the arrival notice. It is trip tracking, not surveillance: there is no location history outside rides.
• Permission can be revoked at any time. Once revoked, the account can no longer request rides.
• Everything else in this policy applies, including ride audio recording. Whoever signs the permission is consenting to that too, and we say so in the text they sign.

Security

We encrypt ride audio, incident evidence and identity documents (ID cards, selfies, licences). Only the authorised verification and support team can see your documents.

The key that decrypts the evidence lives in the server configuration, separate from the files it protects and out of reach of the application that serves them. We are moving its custody to two people, so that neither can open it alone; until that split is done, we prefer to say it this way rather than promise it.

No system is infallible. If a breach affects your data, we will tell you and notify the authority within the deadlines the LOPDP sets.

Cookies and measurement

This website uses no measurement or advertising cookies. We measure site usage with umami, our own tool, which stores no cookies and no personal data: it counts visits per page, not people. That is why you will not see a cookie notice.

The services behind the site are Resend (delivery of the business form emails), Sentry (error logging, without personal data) and Zoho (corporate email, where what you write to us arrives). The app does not use cookies.

Changes to this policy

If this policy changes substantially we will tell you in the app before the change takes effect, and it will be recorded which version you accepted and when.