TowTow.ge › Privacy Policy

Privacy Policy

Last updated: 2026-09-27

This policy explains what personal data TowTow.ge processes, for what purposes and on what legal basis, who we share it with, how long we keep it and what rights you have. It is based on the Law of Georgia on Personal Data Protection.

Data controller

Name: [to be added before launch]. Identification code: [to be added before launch]. Address: [to be added before launch]. Phone: [to be added before launch]. Email: [email protected]. Website: towtow.ge. Data protection officer: [to be added before launch].

1. What we process

• Account (all users): name, phone, email, password hash (we never store the password itself), profile photo, language. With Google sign-in, the name, email and photo Google shares with us.
• Customers: the cars added to the profile (make and model, plate, type, colour), the exact coordinates and address of the request, the destination, vehicle class, answers about conditions, an optional photo and note, order history, payment status and amount.
• Operators: name and legal form, bank account (IBAN), tax status and number, base address, photos of documents; vehicles — type, maximum weight, plate, model, photos, registration certificate photo, tariffs; on-duty status; reliability score.
• Operator members (dispatchers, drivers): the name and phone the operator's owner gives us when inviting them. We tell the invited person by SMS.
• Location: the driver's GPS coordinates while the vehicle is on duty (to compute distance to requests) and every 5–10 seconds during an order (to show the customer and the share link). We take a customer's location only when you ask for it and allow it in the browser.
• Order execution: statuses and times, route, vehicle photos (4 before loading, 1 at delivery), chat, ratings, cancellation reasons.
• Support: messages with support, including replies from the automated assistant.
• Notifications: the phone or email an SMS or email went to, its type and result.
• Technical: IP address, request logs, settings kept in the browser's local storage (section 11).

2. What we do not process

• We never see or store card details — payment happens on the Keepz page; we receive only the status and the transaction number.
• We do not deliberately collect special categories of data (health, biometrics, etc.). Vehicle photos are not used to identify people.

3. Purposes and legal bases

• Account, requests, matching operators, orders, showing location, chat, payment and refunds — performance of a contract (Art. 5(1)(b) of the Law).
• Accounting and tax records, paying operators — a legal obligation ((c)) and the contract.
• Vehicle photos — legitimate interest ((i)): recording the vehicle's condition to resolve damage disputes.
• Checking operators and vehicles, the reliability score, preventing fraud and misuse, security — legitimate interest: users' safety and a trustworthy service.
• Establishing or defending legal claims — legitimate interest.
• Service SMS and email; request SMS to operators' drivers — the contract.
• Analytics, marketing messages and transfers abroad (section 6) — your consent ((a)), asked for separately and revocable at any time.
• Share link — at your request: only you create it and decide whom to send it to.

4. Required and optional data

• An account requires a name, phone, and email or a Google account. A request requires the location, the service and the vehicle class. Without them we cannot provide the service.
• Operators must provide an IBAN, tax details, documents and vehicle photos — without them we cannot verify them or pay them.
• A profile photo, a request photo and note, and analytics consent are optional.

5. Who we share data with

• The other party to the order. Before payment the operator sees only the area and distance, service, vehicle class and conditions — not the exact place or the phone. After payment the parties see each other's name, phone, exact place, the driver's photo, the vehicle photo and plate, and the chat.
• Whoever receives your share link: the truck's position, plate and driver name until the order is completed.
• Keepz — the payment provider (order amount and number). Bank of Georgia — paying operators (beneficiary name, IBAN, amount, purpose).
• SMSOffice (Georgia) — phone and SMS text. The email service provider — email address and message text.
• Google (USA) — the map in the browser, address search and route distance (coordinates and addresses), Google sign-in.
• OpenAI (USA) — the support assistant: your message and core account details, when the assistant is on.
• Railway — the server and database that store data on our instructions.
• Google Analytics, Meta Pixel, Microsoft Clarity — only with your consent.
• Public authorities — only where the law requires.
• Every provider that processes data on our behalf does so under a written contract (Art. 36 of the Law). We never sell data.

6. Transfers abroad

• Google, OpenAI, Meta and Microsoft process data in the USA, which is not on the list of countries recognised under Georgian law as ensuring adequate protection. Server region: [to be added before launch].
• We make these transfers with your written consent, which we ask for separately (Art. 37(2)(d) of the Law). Before you consent we explain the risk: that country's law may not give protection equivalent to Georgian law, including regarding access by public authorities.
• If you do not consent or withdraw consent: analytics and the automated support assistant are switched off (a person answers support). The map and route calculation are essential to requests and orders, so without them you cannot send a request.

7. Retention

• Account — while it is active. After closure we delete or depersonalise it, except records we must keep by law.
• Orders, payments and payouts — for the period set by tax and accounting law.
• Detailed driver location records — 30 days after the order ends; only the start and end points and the distance stay with the order.
• Vehicle photos and order chat — 1 year after the order ends, or until a dispute is closed.
• Support messages — 2 years after the last message. Notification log — 90 days.

8. Your rights

• To be informed about processing and get a copy of your data; to have it corrected, updated or completed; to have processing stopped or data erased; to have it blocked; to receive data you provided in a structured form (portability); not to be subject to a solely automated decision; to withdraw consent.
• Send requests to [email protected] or through the support chat. We reply free of charge within 10 working days (extendable by 10 working days where justified). We may ask you to confirm your identity.
• We refuse erasure only where the law requires us to keep the data or it is needed for a legal claim, and we tell you why.
• You can withdraw consent as easily as you gave it. Processing before withdrawal remains lawful.

9. Marketing messages

• We send marketing SMS or email only with your consent. You can opt out through the same channel, and we stop within 7 working days. We currently send no marketing messages.

10. Automated processing

• Sending a request to operators (by distance, vehicle type and availability) and computing the price (from the tariff) happen automatically, under the same rules for everyone. We do not take decisions with legal effect on you solely automatically — suspending an account, for example, is decided by a person. You can ask for a human review.

11. Cookies and browser storage

• Local storage holds only what the service needs: the sign-in token, core account details, language, colour theme, your analytics choice and a temporary copy of chats.
• Analytics cookies and scripts load only after your consent. You can change the choice by clearing the browser data.

12. Security and incidents

• Connections are encrypted (HTTPS); passwords are stored as hashes; provider keys are encrypted; administrative access is restricted.
• We report an incident to the State Audit Office within 72 hours of discovering it, unless significant harm is unlikely. If the risk to you is high, we tell you without delay.

13. Age

• The service is for people aged 18 and over. We do not knowingly collect data about minors.

14. Complaints

• If you think your data is processed wrongly, you can complain to the State Audit Office (personal data protection supervision: pdp.sao.ge · [email protected] · +995 32 243 81 81) or to a court. We suggest writing to us first — we can often fix it faster.

15. Changes

• When we update this policy we change the date above. We announce material changes in advance in the app or by email.