Privacy notice

Who is responsible

Travel HUB is used by organizations to manage their staff's work trips. Your organization decides why and how your data is used, and is responsible for it. Geopenmind runs Travel HUB on your organization's behalf and only processes your data to provide this service. For any question about your data, contact an administrator of your organization.

What data we use

• Account: your work email, name, role (passenger, driver or administrator) and, if you add it, your mobile phone.
• Trips: pickup, stops and destination (address and map point), date and time, number of passengers, purpose, notes for the driver, the assigned driver and vehicle, and the time of each status change.
• Your location: only when you tap "My location" and your browser allows it. It is used once to find the address and is not tracked or stored apart from the address you choose.
• Technical: a sign-in session cookie that keeps you signed in. Travel HUB uses no advertising or analytics cookies.
• Email records: who was sent each notification and whether it was delivered.

Why we use it

To request, approve, assign and carry out work trips; to let the driver and the passenger reach each other; to send sign-in codes and trip notifications; and to give your organization records of its trips (for example waiting and travel times). Your data is not sold, and it is not used for advertising or profiling.

Who can see it

• Administrators of your organization: the people, trips and history of the organization.
• The driver and the passenger of a trip see each other's name and phone only while that trip is approved or in progress. When it ends, they no longer see them.
• Other staff do not see your data. Each person sees only their own trips.

Service providers

These companies process data for Travel HUB under their own data protection terms:

• Supabase: database and sign-in.
• Vercel: hosting of the application.
• Resend: sending of sign-in codes and notifications (servers in the European Union).
• OpenStreetMap services (Nominatim, Photon and OSRM): address search and driving routes. They receive the address text or map points from our server, never your name or email. Map images are loaded by your browser directly from OpenStreetMap, which therefore sees your IP address.

Some of these providers may process data outside your country, with safeguards such as standard contractual clauses.

How long we keep it

• Your account, while your organization gives you access.
• Trips, as records of your organization, for as long as it needs them.
• Email notification records, 180 days.
• Sign-in codes expire shortly after they are sent.

Your rights

You can see and correct your name and phone in My profile, and download a copy of your data there. You can also ask an administrator of your organization to correct or delete your data, or to limit how it is used. You may complain to the data protection authority of your country.

Security

Connections are encrypted (HTTPS). Sign-in uses one-time codes sent by email, so there are no passwords to steal. The database itself enforces who can read each record, and secret keys are kept only on the server.