Who we are
VibeFare is a trading name of Syncworx Ltd, 19 Rampart Mill, Dundalk, Co Louth, Ireland. Syncworx Ltd is the controller of your personal data. Our lead supervisory authority is the Data Protection Commission (DPC) in Ireland.
Contact us about privacy at support@vibefare.ie.
This website
This website does not use cookies, analytics or advertising trackers. Our hosting provider keeps standard server logs for security.
What we collect and why
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| Your account and sign-in | Phone number, name, email, language, device and session details | Contract | While you have an account; old sessions deleted after 90 days |
| Booking and trips | Pickup and drop-off, trip events, notes to the driver, the route driven | Contract | Route traces 30 days; trip records 6 years (financial records) |
| Payments, refunds and tips | Card brand and last 4 digits, amounts, refund and dispute records. We never see full card numbers. | Contract and legal obligation | 6 years (Revenue) |
| Driver licensing and compliance | SPSV licence numbers, licence, insurance and vehicle documents, expiry dates, NTA register checks | Legal obligation and contract | While you drive with us, then as required for NTA record keeping |
| Driver identity checks | Stripe Identity outcome and the name and date of birth on your ID. Photos and face data stay with Stripe. | Explicit consent | Name and date of birth cleared 30 days after you stop driving; shift checks 90 days |
| Platform fees and VAT invoices (drivers) | Fee ledger, monthly totals, invoices | Legal obligation | 6 years |
| Trip messages and notifications | Phone or email at send time; our delivery log keeps only a scrambled (hashed) copy | Contract | Delivery log 90 days |
| In-trip chat and masked calls | Chat messages; calls are connected without sharing numbers and are not recorded | Contract | Chat 90 days |
| Support, complaints and lost property | Your messages, attachments, complaint records, lost item details | Contract, legal obligation (NTA complaints), legitimate interest | Complaint records up to 6 years |
| Safety incidents and SOS alerts | What happened, where, and the trip | Vital interests and legitimate interest | 6 years (legal claims) |
| Preventing fraud and abuse | Hashed phone, device and card fingerprints and counts | Legitimate interest | 365 days after last seen |
| Live trip sharing | A share link (we store only a hash of it); the page shows driver first name, car, plate and position | Your request | Link stops 60 minutes after the trip |
| Ratings | Stars, tags and optional comment | Contract and legitimate interest | With the trip; comments removed if you delete your account |
| Marketing (optional) | Your consent choices, per channel | Consent | Until you withdraw it |
| Fixing errors | Error reports with personal details removed | Legitimate interest | 90 days |
Location
- Drivers: we track your position only while you are online in the driver app. Tracking stops when you go offline. Your live position is kept only as the latest point; the route of each trip is kept for 30 days for fare checks and safety.
- Riders: we use your location only while the app is open to set your pickup, or during a trip for safety features. The rider app never tracks you in the background.
- Drivers never see a rider's live location.
Driver identity checks
When you sign up to drive, and sometimes when you start a shift, we ask you to take a photo of your ID and a selfie through Stripe Identity. Stripe compares the two. This is biometric processing, so we only do it with your explicit consent, given in the app before the check starts. We never store the photos or any face data: we keep the result and the name and date of birth read from your ID. If you do not want to use this check, ask us for a manual in-person verification instead.
Payments
Card payments are handled by Stripe. Your full card number never reaches us; we see only the card brand and the last four digits.
Automatic decisions
A driver is automatically suspended from receiving trips when their SPSV driver licence, SPSV vehicle licence or insurance expires. Suspensions for failed identity checks are reviewed by a person. Contact us if you think a decision is wrong.
Who we share data with
Your driver or rider sees what they need for the trip (for example first name, pickup point, car and plate). We share data with emergency services if you raise an SOS that needs it, with the NTA or Gardaí where the law requires it, and with these service providers, who act on our instructions under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Stripe | Card payments, driver payouts (Connect), driver identity checks | Ireland/EU; SCCs for US sub-processing |
| Neon | Main database | EU (Frankfurt) |
| Railway | Application hosting | EU; SCCs |
| Mapbox | Maps, routes, address search | US; SCCs |
| Anthropic | Support assistant, reading driver documents | US; SCCs; not used for training |
| Twilio | Text message codes, masked calls | US/Ireland; BCRs/SCCs |
| Meta (WhatsApp) | Sign-in codes and trip notifications | EU/US; SCCs |
| Resend | US; SCCs | |
| Expo | Push notifications | US; SCCs |
| Sentry | Error monitoring | EU |
| Cloudflare R2 | File storage (driver documents, invoices, data exports) | EU |
Where data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses (SCCs) or equivalent safeguards.
Your rights
You can ask us to:
- give you a copy of your data, including in a portable format;
- correct it (you can change your name and email in the app yourself);
- delete it (see how to delete your account);
- restrict or object to how we use it;
- stop marketing messages (switch them off in the app at any time).
Email support@vibefare.ie. We will confirm who you are before acting and reply within one month. You can also complain to the Data Protection Commission at dataprotection.ie.
Keeping your data safe
Data is encrypted in transit and at rest, staff access is limited by role and every staff action is logged. If a breach puts you at high risk, we will tell you and the DPC without undue delay.
Changes
We will update this notice when our processing changes. The date at the top shows the latest version.