Privacy Policy

1. Who processes the data and what this policy covers

The controller of personal data for ConvoyMeet is Dzemyanovich Aliaksandr, Italy; requests about personal data: info@convoymeet.com. ConvoyMeet is a mutual-help service for drivers with a map, statuses, chats, parking information and an SOS feature. This policy applies to the website convoymeet.com, the Telegram Mini App and future Android and iOS apps insofar as they implement the processing described here. Before each standalone mobile version is released, this document is checked against its actual SDKs, permissions and sign-in method.

ConvoyMeet is not an emergency service. If there is an immediate threat to life or health, contact your local emergency services (112 in the EU).

2. What data we receive

3. Purposes and legal bases

Providing the service and performing the terms of use (Art. 6(1)(b) GDPR): creating the account and profile, showing the statuses you choose, contact requests, chats, SOS, parking features, storing your settings and deleting the account. Some data is required for the respective feature: without Telegram identification the Telegram Mini App is not available; without location the features that depend on it are not available.

Permission and, where applicable, consent (Art. 6(1)(a) GDPR): access to the device location is requested separately through the system mechanism of Telegram/Android/iOS. You yourself turn on statuses and SOS, which publish coordinates. The system GPS permission and the acknowledgement that you have read this policy are not the same action; the acknowledgement on its own does not replace consent where consent is required by law. The device permission can be withdrawn in its settings; a status that has already been published should also be turned off in the app.

Legitimate interests (Art. 6(1)(f) GDPR): preventing spam and abuse, keeping the service secure, limiting the frequency of requests and reports, handling reports, technical diagnostics and protecting users' rights. When relying on this basis we take into account the expected consequences for users and their rights; in the cases provided for by the GDPR you have the right to object.

Messages to us: the text of your message and any email address you voluntarily provide are processed to review your message, reply to it and contact you about it (legitimate interest in handling enquiries, Art. 6(1)(f) GDPR). You can also send a message without an email address; in that case we cannot reply to you by email.

Legal obligations (Art. 6(1)(c) GDPR): processing or retaining data where applicable law or a lawful request from a competent authority requires it. We do not use data for sale to advertisers and do not make solely automated decisions with legal or similarly significant effects.

4. Location: when exact coordinates are visible to others

Location is normally determined on the device. We do not build a travel history or a continuous route in our database: the relevant record stores the current or last point, not a sequence of all movements. However, the transfer of coordinates to external map and geo services when using certain features is described in section 8.

“Parked here” and “Looking for company”: while the status is on and has not expired, the exact coordinates may be seen by other signed-in drivers who share at least one selected language with you and are viewing the corresponding area of the map. There is no additional distance limit on visibility; the map area limits a specific request but does not mean that only the nearest drivers see you. The coordinate of such a status is the point where it was set and is not updated as you move normally.

“Looking for parking”: this status is not shown to other drivers as a normal point; the position and search area are used to find parkings and to check whether contact is possible. Contact: seeing a driver's card does not by itself guarantee the right to send a request; the app additionally checks the applicable contact conditions.

SOS: active SOS signals in the viewed area of the map are available to all signed-in users regardless of language. For the “Vehicle problem” and “Info” categories, exact updated coordinates, the description and the author's name may be shown. For an emergency SOS, the exact point of the incident and the city are shown, but not the author's name in the public card. The SOS chat and photos are available only to participants who have been granted access. An emergency SOS does not replace calling the emergency services.

To determine the country for an SOS, coordinates may be sent to BigDataCloud directly from the device. For routes and the search area, coordinates are sent to map services; the exact conditions depend on the feature used. If you share your location, other users may see or record it outside our control.

5. Communication, blocking and reports

A personal chat becomes available after a request provided for by the app has been sent and accepted. Depending on the feature, messages and the author's name are seen by the other person or by the participants of the respective parking/SOS chat. If Telegram push notifications are on and the recipient is not in the app, Telegram may receive the sender's name and the first 200 characters of the message. Notifications already delivered cannot be guaranteed to be removed from the recipient's Telegram.

In a personal chat you can permanently block the other person. After blocking, new personal messages, contact requests and related personal push notifications between this pair are prohibited in both directions; there is no separate unblock function. Blocking does not deprive the person of access to shared parking chats and SOS. The technical blocking record is kept as long as the corresponding account exists.

In a parking chat you can report a specific message written by someone else: choose a reason (spam/advertising, insults/threats, fraud or other) and optionally add a comment. The report is kept for review by the administration together with a copy of the message, including a photo attached to it; submitting a report does not by itself delete the message or block the author. The frequency of reports is limited to prevent abuse. Notifications about reports are sent to the administration by email once mail delivery is set up; storing the report in the system does not depend on whether the email is sent successfully.

6. Retention periods

Statuses: until turned off or until the chosen period expires; expired records are normally deleted within 5 minutes. The interface limits the maximum duration of regular statuses to 45 hours, and of parking search to 60 minutes. SOS: up to 3 hours for an emergency SOS or 6 hours for the others, and may be closed earlier; after closing it is deleted after approximately 30 minutes, taking periodic clean-up into account. Free-space reports: about 5 hours.

Messages: 7 days from sending; the daily clean-up means that in practice they are kept for up to about 8 days; SOS chat messages may be deleted earlier together with the SOS. Photos: deleted when no message or SOS refers to them any more; uploaded but unattached photos are cleaned up after approximately 15 minutes. A photo from a message that has been reported is kept together with the report. Files are deleted asynchronously and may require a retry.

Contact requests: 7 days after activity ends. Feedback and reports: up to 12 months. Unused sign-in sessions: deleted if not refreshed for 30 days; the service log of cron jobs: 14 days. Blocks, ratings, favourites and the profile: until the account is deleted or another deletion provided for. Automatic deletion of inactive accounts is not provided for as of this version.

The reply email address is stored together with the message and deleted together with it: when the retention period for messages expires or when the account is deleted. The notification about a new message (its text and the email address, if provided) and any further correspondence about it are kept in our mailbox at Aruba; these emails are not deleted automatically together with the database record — we will delete them on request to info@convoymeet.com.

Retention periods of logs and backups of infrastructure providers depend on their actual settings and rules; the exact periods as of the date of this version require separate confirmation. In exceptional cases certain data may be kept longer if the law or the justified resolution of a dispute requires it.

7. Account deletion and residual data

You can delete your account in the ConvoyMeet app: Profile → Account → “Delete account”, and confirm the action. The current server procedure deletes the profile, related statuses, chats, SOS, requests, blocks, ratings, favourites, sign-in sessions and related photos, taking asynchronous clean-up into account. Opening the Mini App again after deletion can create a new account only in accordance with the current registration sequence.

Messages sent via “Contact us” are deleted together with the account, including the reply email address provided. Emails about such messages in our mailbox are covered in section 6.

After deletion the following may remain: push notifications previously delivered in the recipients' Telegram; the chat cache on other users' devices; short-lived technical responses of server calls (up to 6 hours in the previously checked configuration); providers' logs and backups until their actual periods expire. Reports you have submitted are deleted together with your account. Reports about your messages may be kept for up to 12 months with a copy of the message and a pseudonymous hash of your Telegram ID without a direct link to the deleted profile. The hash is not fully anonymous.

If you have no access to the app or have difficulties with deletion, write to info@convoymeet.com. We may ask for reasonable confirmation that the request comes from the account owner. Public instructions: convoymeet.com/delete-account.

8. Recipients of data and international transfers

ConvoyMeet uses: Telegram (Mini App sign-in, bot and push); Supabase (database, authentication, files, server functions; the main database region is Frankfurt); Vercel (hosting of the Mini App/website and server functions for routing); OpenRouteService/HeiGIT (calculation of routes and search areas); BigDataCloud (reverse geocoding); OpenFreeMap and Esri (map layers); Google Fonts, unpkg and jsDelivr (loading fonts and software libraries). If you choose an external route, destination data may be passed to Google Maps or Apple Maps on your action.

Aruba (Italy) — the email service for the convoymeet.com domain. Notifications about new messages and reports (with their content and the reply email address, if provided) are delivered to our service mailbox through Aruba’s SMTP server; we also use this service to reply to emails.

Information may be processed outside the European Economic Area, including by infrastructure and providers with global networks. Vercel server functions for routing run in the Frankfurt region (fra1). Even a European region for the main servers does not rule out international transfers through Telegram, global CDNs, support and subcontractors. For transfers falling under Chapter V GDPR, valid legal mechanisms must apply (for example, an adequacy decision or standard contractual clauses, where applicable). We do not claim the existence of unconfirmed signed agreements. You can request information about the applicable safeguards at info@convoymeet.com.

9. Cookies, local storage and external resources

According to the audit carried out, the Telegram Mini App does not use its own analytics cookies or advertising pixels. The device's localStorage is used for interface settings, onboarding and a cache of recent messages. The cache may remain on the device until it is cleared by the app, the browser/WebView or the user; server-side clean-up does not guarantee that copies on other people's devices are removed. The public website uses a functional cookie cm_lang for about a year and localStorage cm-site-lang to remember the chosen language. According to the audit, there are no analytics trackers on the website or in the Mini App. External fonts, libraries and maps may receive your IP address and technical information when they are loaded.

If future Android/iOS versions introduce new SDKs, analytics, advertising identifiers or other ways of storing data, the policy and the app store disclosures must be updated before they are used.

10. Security and your rights

We use access control to the database, authorization checks, rate limiting, time-limited links to photos and removal of unnecessary image metadata in the updated client. However, transmission of data over the internet and via other users' devices cannot be absolutely secure. Do not publish in chats and SOS information that you do not want to disclose to the respective participants.

In the cases and to the extent provided for by the GDPR, you have the right to request access to your data, rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent where it is the legal basis. Withdrawal of consent does not affect the lawfulness of processing before the withdrawal. Send requests, including requests for a copy of your data, to info@convoymeet.com; identity verification may be required to protect the account. We reply within the periods set by applicable law, usually within one month, with extensions permitted by law.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Garante per la protezione dei dati personali (Italy), or the competent authority of the country of your habitual residence, place of work or of the alleged infringement. Garante contact: www.garanteprivacy.it.

11. Children, changes to the policy and contact

ConvoyMeet is intended for drivers, not for children. If we become aware that a child's personal data has been obtained without the necessary legal basis, we will consider a request to delete it. If the ways of processing change significantly, we will update the policy and the version date and, where necessary, notify users or ask for separate consent. The current version is published at convoymeet.com/privacy. Questions about personal data: info@convoymeet.com.