Data processing terms

These terms apply when AuroVision Labs LLC (“we”) handles personal data for a business that uses Taxi Foundry (“you”). They are part of the Terms of service and are written to meet Article 28 of the EU and UK General Data Protection Regulation and similar laws.

What this covers

• Subject — running your space: the apps, the staff panel, the website, the servers, storing the data, backups and support
• How long — while your plan runs, plus the 30 days you have to download your data
• What we do — store, organise, show, copy, back up, send and delete data for you, so that your riders, drivers and staff can use your space
• Whose data — your riders, drivers, fleet partners, staff and website visitors
• Kinds of data — names, phone numbers, e-mail addresses, language, photos and documents that drivers upload, vehicle details, pick-up and drop-off places and routes, ratings, messages, payment status and amounts, wallet balances, device and sign-in data, and anything else you decide to put in your space
• Special kinds — none by default. If you turn on options such as recording a trip or checking an identity, you decide the lawful ground and you tell the people concerned

Your instructions

We handle the data only on your documented instructions, which are these terms, your settings and your use of the service. If we think an instruction breaks the law, we tell you. You are responsible for having a lawful ground to collect the data, for telling the people concerned, and for what you choose to put in your space.

Confidentiality

Our people who can reach your data are bound to keep it confidential, can reach it only when their work needs it, and use their own accounts and device keys. What they do is recorded.

Security

We protect your data with measures that fit the risk, including:

• every connection encrypted;
• your space on a server of its own, with its own database, apart from other companies;
• access only by named people with their own keys, a second step for sensitive actions, and a record of what is done;
• secrets kept apart from data;
• daily backups of your server, kept by our hosting company;
• security updates installed every day, and a way back to the previous release if a release fails;
• a way to find and handle incidents.

Our Security page says more.

Other companies we use

• Hetzner Online GmbH — the server that holds your space, and its backups — Germany or Finland (the place chosen when your server is made)
• Cloudflare, Inc. — the network in front of your addresses, protection from attacks and, if you connect your own domain, its DNS — worldwide
• Anthropic — the AI help in your staff panel, only when you use it, and only the text you send to it — the United States

Services you connect yourself, such as your own Stripe account, your own text-message, push, maps or e-mail providers and your app store accounts, are your own processors. You choose them and agree terms with them, and we pass data to them only as you set up.

We tell you at least 30 days before we add or replace a company in this list. If you object for a good reason and we cannot offer another way, you may cancel without penalty for the rest of the term.

Moving data to other countries

Your space runs in the European Union (Germany or Finland). Traffic passes through Cloudflare’s network, which is worldwide. Where data from the European Union, the United Kingdom or Switzerland is reached from, or sent to, a country without an adequate level of protection (by us or by a company in the list above), the standard contractual clauses approved by the European Union (controller to processor) are part of this agreement, together with the United Kingdom’s addendum and the changes Switzerland asks for. The table in section 1 and the lists in sections 4 and 5 describe the data, the security measures and the other companies, as the clauses ask. Where the law does not require those clauses, we use another safeguard it accepts, and we tell you which on request.

Where those clauses apply, you are the data exporter, with the details you gave when you signed up, and we are the data importer, AuroVision Labs LLC. Our registered address is 5830 E 2nd St, Ste 7000, Casper, WY 82609, United States. Our contact for data protection is taxifoundry@gmail.com. We may use the companies in section 5, and we tell you of a change as that section says. The competent supervisory authority is the one that supervises you. The clauses follow the law, and the courts, of Ireland; the United Kingdom’s addendum follows the law, and the courts, of England and Wales, as it requires.

Helping you with people’s requests

Your riders and drivers can ask you to see, correct or delete their data, and the apps and the staff panel have tools for it (for example, a rider or driver can delete their account in the app, with a grace period). If someone asks us directly, we send them to you. We help you answer within a reasonable time.

Breaches

If we learn that personal data in your space was lost, changed, shown or reached without permission, we tell you without undue delay and, where we can, within 48 hours, with what we know: what happened, which data, what we are doing, and what you may need to do. We help you with the notices the law asks you to send.

Impact assessments and authorities

We give you the information you reasonably need for a data protection impact assessment or to talk to an authority. If an authority asks us for your data, we tell you first, unless the law forbids it.

When the service ends

You have 30 days to download your data. After that we shut your space down and keep one last copy of it, in case you come back. We erase that copy within 30 days of your request. Apart from that we keep only what the law requires us to keep, such as invoices; backups disappear on their normal schedule.

Checks and audits

We give you the information that shows we follow these terms: this page, our Security page and reasonable answers to a security questionnaire. If that is not enough, you may check us once a year, with 30 days’ notice, during business hours, at your cost, under confidentiality and without access to other companies’ data.

Responsibility, and which text wins

Our responsibility under these terms is limited as the Terms of service say. For the handling of personal data, if these terms and the Terms of service disagree, these terms win, and where contractual clauses approved by an authority apply, they win over both. The law that applies, and the courts, are those named in the Terms of service, except for the standard contractual clauses, which follow section 6.

Changes

We may update these terms to follow the law or changes in the service, and we tell you as the Terms of service say for changes.