Legal documents
Privacy notice
This first version explains the data we use to operate the platform, who receives it and the choices available to you. Some contractual and organisational details are still under review.
Last updated: 14 September 2026
This page is a provisional information structure awaiting legal review. It is not yet the final text governing the service.
1. Controller and contacts
The controller is Francesco Loddo, Via Fiume 32, Reggio Calabria, VAT/tax code LDDFNC85M10H224E.
For privacy questions or to exercise your rights, email [email protected]. We will publish the details of a DPO here if one is formally appointed.
2. Who this applies to
This notice applies to site visitors, account holders, people requesting transport, transporter applicants, customers making a booking and people contacting support.
BauBauCar connects people who need animal transport with transporters. It does not provide veterinary services and requests animal information only where it is needed to assess and arrange transport.
3. Data we process
We do not ask for health data about people. Information about an animal's treatment or medication may be needed for transport safety and is available only to people who need to manage the service.
| Category | Examples |
|---|---|
| Account and contact data | Name, email, telephone number, language, time zone and profile image. |
| Requests and animals | Route, dates, contacts, species, size, photos and operational animal notes. |
| Transporters | Professional details, company, vehicle, licences and application documents. |
| Bookings and payments | Offers, amounts, operational statuses and technical identifiers supplied by Stripe. |
| Support and security | Support requests, notifications, technical logs, anti-spam outcomes and browser technical data. |
4. Why we use data
If you do not provide necessary data, we may be unable to create an account, manage a request, arrange transport or complete a payment. Marketing consent is not required to use the service.
| Purpose | Proposed legal basis |
|---|---|
| Account, access and security | Contract or pre-contractual steps; legitimate interest in security. |
| Requests, offers and transport | Contract or pre-contractual steps. |
| Transporter applications | Pre-contractual steps, contract, applicable obligations and security. |
| Payments, refunds and transfers | Contract and applicable accounting, tax or anti-money-laundering obligations. |
| Support, disputes and legal claims | Contract, legitimate interest or legal obligation. |
| Marketing communications | Separate consent, if and when the service enables it. |
5. Who receives data
- The requester and transporter involved in a request, offer or booking, to the extent needed for transport.
- Authorised BauBauCar staff, according to their assigned role.
- Authorities or legitimate professionals where required by law or to protect a legal right.
| Provider | Service |
|---|---|
| Supabase | PostgreSQL database and private storage for photos and documents. |
| Stripe and Stripe Connect | Checkout, payments, refunds, transfers and transporter onboarding. |
| Vercel | Hosting, application delivery, analytics and performance after consent. |
| Cloudflare Turnstile | Protection of forms against spam and automated submissions. |
| Resend | Transactional and support email, when configured. |
| Google, Facebook and Apple | Social sign-in, only when chosen by the user. |
6. International transfers
Some providers may process data or make it accessible outside the European Economic Area. We are completing the review of locations, subprocessors and transfer tools for each provider.
Before the final version, we will state the transfer mechanism for each applicable provider, such as an adequacy decision or standard contractual clauses.
7. Retention
We retain accounts, requests, offers, bookings and operational communications for the duration of the relationship and as needed for obligations, security and disputes.
Payment and accounting data follow the applicable retention obligations. We are defining exact periods for logs, transporter documents, photos and operational data. When data is no longer needed, we delete or anonymise it unless the law requires retention or it is needed to defend a legal claim.
8. Security and cookies
We use role-based access controls, protected sessions, server-side authorisation, private file storage, signed URLs, anti-spam controls and verification for payments and webhooks.
The Cookie Policy explains cookies and similar technologies. Google Analytics 4 uses Consent Mode v2: without consent it does not use analytics cookies, but it may send cookieless technical and aggregate signals to Google for modelling; Speed Insights starts only after consent. Stripe and Turnstile remain necessary when you use payment or protected forms.
9. Your rights
Where the GDPR applies, you can request access, correction, deletion, restriction, portability or object to processing based on legitimate interests. You can withdraw consent at any time without changing the lawfulness of processing before withdrawal.
Email [email protected]. We may ask for reasonable information to verify your identity. You may also complain to the Italian Data Protection Authority or the authority in your country.
10. Children and updates
The platform is not intended for people who cannot validly enter into the relationship with BauBauCar. The procedure for requests made on behalf of children is still being defined.
We will update this notice when processing or applicable obligations change. For material changes, we may notify you in the private area or by email.