Draft. Have a lawyer in Bulgaria review this before public launch, and add a Bulgarian version.
Privacy
Last updated: 30 October 2026
Drumi ("we") is run by [your name or company, address]. Contact: [privacy@your-domain]. We are the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR).
What we collect
- Account: your email address, first name, phone number, and optionally your car and a short bio.
- Verification: we confirm your phone number with a one-time code. Drivers, and riders who join women-only rides, also pass a check of their ID document and a selfie. Drumi keeps only your first name and last initial from the ID, a one-way fingerprint of the document number (so one ID can't be used on two accounts), and whether the check passed.
- Messages you send to other people about a ride.
- Optional: a profile photo, your gender (used only for women-only rides; taken from your ID when it shows it), and whether you turned on phone notifications on a device.
- Safety: people you block, and whether seat requests you received were accepted, declined or expired (shown as an acceptance rate).
- Trips: rides you post (route, date, time, seats, price, notes), seats you book, ratings you give and receive, and route alerts you set.
- Safety reports you send us.
- Technical data: a sign-in cookie, and your IP address on sign-in requests to stop abuse.
Why we use it
- To run the service you signed up for: matching drivers and passengers and sending sign-in and trip emails (GDPR Art. 6(1)(b), contract).
- To keep the platform safe: verification, ratings, reports, rate limits (Art. 6(1)(f), legitimate interest).
- The ID and selfie check (for drivers and women-only rides) uses biometric data (comparing your face with your ID photo). We do this only with your explicit consent, which you give when you start the check (Art. 9(2)(a)). You can withdraw consent by deleting your account.
Who sees what
- Anyone can see a ride's route, time, price, notes, and the driver's first name, car and rating.
- Your phone number is shown only to people on the same ride: the driver sees passengers' numbers, and passengers see the driver's number after booking.
- Your profile shows your first name and last initial, photo, Verified badges, rating, reviews, car, bio and, for drivers, acceptance rate. Your email, phone and gender are never shown on it.
- When you request a seat on a ride where the driver approves passengers, the driver sees only your rating, number of trips and your note until they accept.
- Messages are visible only to the two people in the conversation. We may read them only when someone reports a problem.
- We never sell your data and don't show ads.
Service providers
Cloudflare (hosting, database and photos), Resend (sending email), Didit (phone codes, ID and selfie checks), Stripe (Drumi Plus payments, if you subscribe) and your phone's push service (Apple, Google or Mozilla; they only receive an empty wake-up signal) process data for us under data processing agreements. Didit keeps the ID images and selfie under its own retention rules; we never receive or store them. Some processing may happen outside the EU under Standard Contractual Clauses.
How long we keep it
We keep your account until you delete it. Sign-in links expire after 20 minutes and are removed after a day. Reports are kept for up to 2 years for safety.
Your rights
You can see and edit your details in the app, and delete your account under Trips → Account. You can also ask us for a copy of your data, a correction, or to object to processing by writing to the contact above. You may complain to the Bulgarian Commission for Personal Data Protection (cpdp.bg).
Cookies
We use one essential cookie to keep you signed in, and your browser storage to remember your language. No tracking or advertising cookies.