Bussly
Legal

Privacy Policy

Last updated: 9 July 2026 · Applies to the Bussly app and bussly.app website

Draft notice:This policy is a working draft aligned with GDPR requirements. It must be reviewed by qualified legal counsel and updated with the final data controller's registered details before production launch.

This Privacy Policy explains how Bussly ("we", "us", or "our") collects, uses, shares, and protects personal data when you use our mobile application and website (the "Service"). We are committed to transparency and to respecting your rights under the General Data Protection Regulation (GDPR) and applicable national laws.

1. Data controller

The data controller responsible for your personal data is:

Bussly
[Registered company name and address — to be inserted]
Email: privacy@bussly.app

2. Who this policy covers

This policy applies to users of the Bussly app who are 18 years of age or older. The Service is not directed at children, and we do not knowingly collect data from anyone under 18.

3. Data we collect

Account & profile data

  • Name, date of birth, gender, and preferences (who you want to meet, relationship goals)
  • Photos, bio, prompts, interests, lifestyle details, height, work, school, languages, and zodiac sign (if provided)
  • Authentication identifiers from email/password, Google, or Apple Sign-In

Location data

Bussly is location-based. With your permission, we collect approximate or precise location to determine whether you are in a supported city (London, Paris, Amsterdam, Barcelona, Lisbon, Berlin) and to enable boarding and Discover. You can manage location permissions in your device settings; disabling location may prevent you from boarding.

Usage & trip data

  • Boarding status, discoverability, swipe activity, matches, and messages
  • Bus Pass purchase history, plan type, and expiry
  • App interactions, feature usage, and crash/diagnostic logs

Communications

  • In-app messages between matched users
  • Support correspondence if you contact us
  • Push notification tokens (if you enable notifications)

Payment data

Bus Pass purchases are processed by Apple App Store or Google Play. We receive transaction confirmations and subscription status but do not store your full payment card details.

Safety & moderation data

  • Reports, blocks, and moderation actions
  • Content flagged for review under our Community Guidelines

4. How we use your data

We process personal data for the following purposes:

  • Providing the Service — creating your account, showing your boarding card, enabling Discover, matches, and messaging
  • Virtual route mechanics — verifying supported-city eligibility, managing boarding windows, and populating trip-specific Discover pools
  • Payments — validating Bus Pass status and plan benefits (e.g. Rewind, See Who Likes You on Weekly+ plans)
  • Safety & integrity — investigating reports, enforcing Community Guidelines, preventing fraud and abuse
  • Communications — sending service-related notifications and responding to support requests
  • Improvement — analytics, debugging, and product development in aggregated or pseudonymised form where possible
  • Legal compliance — fulfilling obligations under applicable law

5. Legal bases (GDPR)

Depending on the processing activity, we rely on:

  • Contract — to provide the Service you signed up for
  • Consent — for optional permissions (e.g. location, push notifications, marketing if offered)
  • Legitimate interests — for safety, fraud prevention, and service improvement, balanced against your rights
  • Legal obligation — where we must retain or disclose data by law

6. How we share data

We do not sell your personal data. We may share data with:

  • Other users — profile information you choose to make visible, when you board and appear in Discover
  • Service providers — cloud hosting (e.g. Firebase/Google Cloud), analytics, customer support tools, under data processing agreements
  • Payment platforms — Apple and Google for in-app purchases
  • Authentication providers — Google and Apple when you use social sign-in
  • Law enforcement — when required by law or to protect safety, rights, or property

Where processors are located outside the European Economic Area, we use appropriate safeguards such as Standard Contractual Clauses.

7. Data retention

  • Active accounts — data is retained while your account is active and as needed to provide the Service
  • Account deletion — when you delete your account (Settings → Delete Account), we initiate a 28-day soft-delete grace period. After that period, personal data is permanently deleted unless we must retain certain records for legal, security, or dispute-resolution purposes
  • Messages & matches — removed in line with account deletion, subject to retention for active moderation investigations
  • Legal holds — some data may be kept longer where required by law

8. Your rights

Under GDPR, you have the right to:

  • Access — request a copy of your personal data
  • Rectification — correct inaccurate data via the app or by contacting us
  • Erasure — delete your account and request removal of your data
  • Restriction — ask us to limit certain processing
  • Portability — receive your data in a structured, machine-readable format where applicable
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — where processing is consent-based, without affecting prior lawful processing

To exercise these rights, email privacy@bussly.app. We respond within one month, as required by GDPR. You may also lodge a complaint with your local data protection authority.

9. Cookies & similar technologies

Our website may use essential cookies for basic functionality. If we add analytics or marketing cookies in the future, we will update this policy and, where required, obtain consent via a cookie banner.

The mobile app may use local storage and device identifiers for session management, security, and analytics.

10. Security

We implement technical and organisational measures to protect your data, including encryption in transit, access controls, and secure cloud infrastructure. No system is completely secure; please use a strong password and report suspicious activity promptly.

11. Automated decision-making

Bussly uses automated systems to surface profiles in Discover, enforce Community Guidelines, and detect abuse. These systems do not produce legal effects on you beyond access to features (e.g. account suspension for violations). You may contact us to request human review of a moderation decision.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified in-app or on our website. The "Last updated" date at the top reflects the most recent revision.

13. Contact