Privacy policy
Version of 18 October 2026 (rev. 2)
This policy explains how HopHola processes your personal data, under articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and Italian Legislative Decree 196/2003.
1. Data controller
Nicolas Inzillo, via Carlo Arlotti 58, 42020 Vetto (RE), Italy, email info@hophola.com, website www.hophola.com. Below "HopHola" or "we".
No Data Protection Officer (DPO) has been appointed: for any question about how your data is processed write to info@hophola.com.
2. Which data we process
Account data: email address, the technical identifier of your account and, if you sign in with Google, your Google account identifier. We never see your password: Firebase Authentication manages it.
Public profile, visible to other users: first name, initial of the surname, profile photo (optional), short description (optional), role (passenger or driver), make, colour and fuel of the car, reputation (balance of the votes received and their number), points and number of rides, and the "verified identity" mark if any.
Travel preferences and interests (optional), visible to other users on your public profile: how much you like to chat, music in the car, whether smoking is not allowed and pets are welcome, and up to 6 interests chosen from a closed list (for example sport, films, books, travel). There is no free text, and the list doesn't include categories that would reveal special data (political opinions, religious beliefs, health, sexual orientation). Your phone compares them with the drivers' ones to show you what you have in common and, among rides that are equally good for the trip, to show first those with more in common: the compatibility of the route always comes first and no ride is hidden. You can change or delete them at any time in Profile → Edit → Preferences and interests.
Private personal data: surname, contact email, driving licence number and expiry, number plate and expiry of the car insurance. They are encrypted on your device before being sent, with a key that stays in your Keychain: not even we can read them.
Identity check (selfie and document): to verify your identity you send us a selfie and a photo of your identity card or driving licence (the licence is also a valid identity document and is required for drivers). The photos are encrypted on your device with the public key of the HopHola administrator: only the administrator, who keeps the private key offline, can open them. Until the check they stay encrypted on our servers in the European Union. Before sending, the phone automatically checks, without transmitting the images, that the photo really shows the document (face, typical wording, surname of the profile) and that the selfie shows a face. Then a person compares the selfie with the photo on the document by eye: we don't use facial recognition and we don't create biometric templates. After the check the photos are deleted (section 8). We only keep the outcome: identity verified or not, date of the check, method (manual or external provider) and type of document (identity card or driving licence), with no number or other data of the document. We also keep the outcome of the automatic check (yes/no) until the check is completed.
Car insurance (drivers): drivers send us a photo of the insurance certificate, together with the plate, model, colour and expiry date entered in the profile, encrypted in the same way. Before sending, the phone checks that the certificate shows the plate. A person checks that the insurance matches the vehicle and reads the expiry date; then the photo is deleted (section 8). We only keep the outcome, the date of the check, the expiry date of the insurance and a cryptographic fingerprint of the plate (not the plate itself), used to tell whether you changed car. The expiry date you enter in the profile is encrypted with your private data and is used to remind you of the renewal.
Location and routes: your current location is used only on your device, when you ask for it to search for a ride, and is not stored on our servers. We store the routes you publish as a driver (path, days, time, seats) and, for each ride request, the day booked (each request is for a single ride) and the pickup and drop-off points, which are encrypted on the phone and readable only by passenger and driver, like the car plate shared with the confirmed passenger. "Route privacy" is on by default for new routes: the public path loses its first and last 400 metres, and names and addresses are encrypted and readable only by you. With "Schedule privacy" on, the app doesn't show passengers on which weekdays you make the trip, only the dates of the next rides; the days stay in the database anyway, readable only by you, and are sent to the passenger's phone only together with the results of a compatible search, because the app uses them to work out the bookable dates.
Requests and ride history: who travels with whom, when, status of the request (pending, confirmed, completed, cancelled), affinity and distances.
Chat: messages are end-to-end encrypted (Curve25519, HKDF-SHA256, AES-GCM) and the history is kept only on the devices of who writes and who receives them, encrypted with a key that stays in the Keychain and excluded from the iCloud backup. Our servers only act as a "mailbox": a message stays there, encrypted, until the recipient's phone has received and stored it, then it's deleted. During delivery we only keep the ciphertext and the metadata needed to deliver it (sender, recipient, date and time), and we can't read the content. So we have no copy of conversations and can't restore them if you change phone or reinstall the app.
Ratings: after each ride we ask you how it went. "Good" gives +1 and "Bad" −1 to the other person's reputation; each vote (who gives it and which ride it refers to) is readable only by who gives and who receives it, while the public profile only shows the balance, computed by our servers (in the European Union) and not editable by users. If you answer "Didn't happen", no vote is recorded.
Number plate (drivers): encrypted with your private data and shared only with the passengers whose request you accept, so they can recognise the car.
Meeting code: a 4-digit code created on the passenger's phone for each confirmed ride. On the server we only keep a non-reversible fingerprint (hash) and an encrypted copy that only the passenger can read. We record when the driver confirms the meeting.
Reports and blocks: if you report a user we keep who reports, who is reported, the reason and the related ride. The optional description and, if you choose so, the last messages of the chat with that user (up to 30) are encrypted on your phone with the administrator's public key: for the messages it's the only way for us to see what was written, because chats stay only on the devices. Only the administrator reads reports. We also keep the list of users you blocked, to stop them from writing to you or requesting a seat.
Account status: the mark, set by the administrator, that an account is suspended and under review.
Consents: version of the Terms and Policy accepted, date and time, language, declaration of legal age.
Messages to support: if you write to info@hophola.com (also from Profile → Help and feedback) we receive your email address, the name shown in the message, what you write and, unless you delete them, the app and iOS versions the app adds at the end of the email. They aren't linked to your account automatically.
Technical data: technical identifiers and security logs created by our infrastructure providers (for example IP address and connection time), processed to run and protect the service.
We don't process special categories of data (art. 9 GDPR) or data about criminal convictions, and we ask you not to put them in your description or in chats.
3. Why we process data and on which legal basis
| Purpose | Legal basis |
|---|---|
| Creating and managing the account, showing the profile, publishing routes, finding compatible rides, managing requests, chat, ratings and history | Performance of the contract (art. 6.1.b GDPR) |
| Verifying users' identity, drivers' right to drive and the vehicle insurance, preventing fraud and abuse, protecting people's safety | Legitimate interest of HopHola and of users in safety (art. 6.1.f), and a requirement to use the service (art. 6.1.b) |
| Keeping evidence of the acceptance of Terms and Policy | Duty to demonstrate compliance (art. 5.2 and art. 7.1) and defence of rights (art. 6.1.f) |
| Handling reports and blocks, suspending as a precaution accounts with serious or repeated reports | Legitimate interest in users' safety and in preventing abuse (art. 6.1.f) |
| Showing the plate to the confirmed passenger and checking the meeting with the code | Performance of the contract and legitimate interest in safety (art. 6.1.b and 6.1.f) |
| Answering the messages sent to support | Performance of your request (art. 6.1.b) |
| Sending notifications to your device | Your consent, managed in the iOS settings and revocable at any time (art. 6.1.a) |
We don't use your data for advertising or commercial profiling, and we don't sell it. Matching passengers and drivers is automatic (distance, direction, time), but it has no legal or similarly significant effects on you under art. 22 GDPR: you always decide whether to request or accept a ride. Suspending an account isn't automatic: a person decides it after reviewing the reports, and you can always contact us to explain your side.
Trip sharing and SOS: with "Share trip" you send the ride details (the other person's name, time, places, car and plate) to the contact and app you choose; we receive nothing. The SOS button starts a normal call from your phone to the emergency number (112 in Italy and the EU) and sends us no data. HopHola is not an emergency service.
4. Is providing the data mandatory?
Account data, first name and, before the first ride, an identity check (selfie and document) are needed to use HopHola. Drivers must be checked with their driving licence and provide car details and a verified, unexpired insurance: without it they can't publish routes or accept passengers. Until your identity is verified you can't request rides or publish routes. Profile photo and description are optional. We don't ask for your phone number.
5. How we protect the data
Private data, identity check photos and chats are encrypted on the device before sending. Security rules restrict access to the database: each user can only change their own data, profiles can only be read one at a time and routes can't be read by other users: rides are searched on our servers (in the European Union), which return only the drivers compatible with the searched start and destination, with a limit of searches per user, no user can read the identity check photos and only the administrator can record the outcome of the check. The key that opens the photos is kept offline by the administrator, who opens them only for the check, on a dedicated computer, and deletes them right after; every check is logged (date, user, outcome), without images. We apply data minimisation: other users only see first name, initial of the surname and what is strictly needed for the ride.
6. Who receives the data
Other users: only the public profile, the routes compatible with their search (or only the shared segment, with Route privacy on) and, for agreed rides, the meeting points and the messages you choose to send.
Providers processing data on our behalf (processors under art. 28 GDPR):
- Google Ireland Limited and Google LLC: Firebase Authentication, Cloud Firestore (database located in the European Union, region eur3), Cloud Storage (the encrypted photos for the identity check, stored in Belgium, region europe-west1), Cloud Functions (the processing on our servers, such as the ride search, the reputation count and the automatic deletion of expired data, run in Belgium, region europe-west1) and, if you use it, Sign in with Google.
- Apple Distribution International Ltd. and Apple Inc.: maps, address search and route calculation (MapKit). Address and route searches are sent to Apple.
- Cloudflare, Inc.: receives the email sent to info@hophola.com and forwards it to the controller's mailbox; it also hosts the website www.hophola.com.
- The provider of the controller's mailbox, where messages to support are delivered.
Authorities: judicial authorities and police, when the request is provided for by law.
We don't sell or transfer your data to anybody else.
7. Transfers outside the European Union
Some providers (Google LLC, Apple Inc., Cloudflare, Inc.) are based in the United States. Transfers rely on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 and, in any case, on the Standard Contractual Clauses approved by the Commission (art. 46 GDPR). You can ask us for a copy of these safeguards.
8. How long we keep the data
- Account, profile, private data, routes, requests and ratings written: until you delete the account, which you can do at any time from Profile → Delete account. Deletion is immediate.
- Chat messages on our servers: only until they're delivered to the recipient, usually a few seconds. If the recipient doesn't open the app, an undelivered message is deleted after 10 days. The history on your phone stays until you delete the chat or the account, or uninstall the app.
- Selfie, document and insurance certificate photos: until the check, and in any case they are deleted within 48 hours of the check; if they aren't checked within 7 days they are deleted automatically and we'll ask you to send them again. Until the check is completed you can withdraw them from the app (Profile → Documents) and they are deleted at once; they are also deleted at once if you delete your account.
- Outcome of the check (verified or not, date, method, type of document) and of the insurance (outcome, date of the check, expiry, plate fingerprint): until you delete the account.
- Evidence of consents (version, date, language): 10 years, the ordinary limitation period, to protect the rights of the parties.
- Reports, including any attached messages: as long as needed to handle them, and no longer than 24 months unless needed for ongoing proceedings.
- List of blocked users: until you unblock the user or delete the account.
- Messages to support: as long as needed to handle the request, then deleted, unless needed to protect a right in a dispute.
- Providers' technical and security logs: as long as set by each provider, usually no longer than 12 months.
9. Your rights
At any time you can ask to access your data (art. 15), correct it (art. 16), erase it (art. 17), restrict its processing (art. 18), receive it in a structured format (portability, art. 20) and object to processing based on legitimate interest (art. 21). You can withdraw consent to notifications in the iOS settings. If you have been reported you can know the data about you but, to protect the person who reported (art. 15.4 GDPR), we don't disclose their identity. To exercise your rights write to info@hophola.com: we'll answer within one month (extendable by two months for complex requests).
You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or with the supervisory authority of the EU country where you live or work.
10. Minors
HopHola is only for people aged 18 or over. If we find out that an account belongs to a minor, we close it and delete its data.
11. Changes to this policy
If we change this policy substantially we'll tell you in the app, which will ask you to read it before continuing. The current version is always available in Profile → Terms and privacy and on the website www.hophola.com. The website has its own privacy policy, which only covers browsing the website.