Privacy policy
Version 2.2 · Effective 5 September 2026 · Replaces version 2.1 dated 29 August 2026
Who is responsible for your data
Förare is a business name of Jamshaid Amjad, an enskild näringsidkare (sole trader) registered in Sweden. Contact: support@forare.eu · +46 76 205 15 61.
We are the controller of the personal data described here. We have not appointed a Data Protection Officer. We reassess whether one is required before location monitoring is enabled at scale. Privacy questions go to support@forare.eu and reach a person, not a queue.
Which part applies to you
Part A if you book or travel with us — a passenger. Part B if you drive for us, or run a taxi company (åkeri) connected to us. Part C applies to everyone.
Part A — Passengers
A1. What we collect
You do not need an account to book with us. That is deliberate: the less we hold, the less there is to protect.
If you choose to create an account, we additionally store your email address (verified with a code), a password hash — never the password itself — and your sign-in sessions, and we link your bookings to the account so you can see them in one place. The account is optional; deleting it removes your access and the link to future bookings, while paid bookings themselves remain for as long as bookkeeping law requires (see retention below).
| What | Where it comes from |
|---|---|
| Name, email address, mobile number | You, when booking |
| Pickup and drop-off address, date and time | You, when booking |
| Flight number | You, when booking |
| Passengers, vehicle class, luggage, notes you write | You, when booking |
| Booking reference, price, VAT, payment status | Generated by us and by Stripe |
| Your flight's scheduled and actual times | Swedavia's flight information service |
| Messages you send us | You |
| Any review you leave | You |
| Technical logs: IP address, browser, timestamps | Automatically, when you use the site |
We never see or store your card number. Card details go directly to Stripe. We receive a payment reference, an amount, and whether it succeeded.
A2. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Taking your booking, arranging the car and driver, carrying out the trip | Art. 6(1)(b) — performing our contract with you |
| Confirmation and the reminder messages before pickup, including your driver's name, phone and plate | Art. 6(1)(b) |
| Watching your flight and moving your pickup when it moves | Art. 6(1)(b) — it is part of what you bought |
| Giving your name, phone, pickup and drop-off to the driver carrying you | Art. 6(1)(b) |
| Payment, receipts, refunds | Art. 6(1)(b) and 6(1)(c) |
| Bookkeeping and VAT reporting | Art. 6(1)(c) — bokföringslagen, mervärdesskattelagen |
| Complaints, disputes, insurance claims | Art. 6(1)(f) — legitimate interest |
| Fraud prevention and site security | Art. 6(1)(f) |
| Asking you, once, to review your trip — always with an unsubscribe | Art. 6(1)(f) |
| Publishing a review you chose to leave | Art. 6(1)(a) — consent, withdrawable at any time |
We do not sell your data. We do not profile you for advertising. We do not make automated decisions about you with legal or similarly significant effects.
A3. How long we keep it
| Data | Retention |
|---|---|
| Accounting records — reference, date, amount, VAT | 7 years after the end of the financial year (bokföringslagen) |
| Booking details — addresses, flight number, driver assigned | 3 years after the trip — the consumer-claim limitation period |
| Free-text notes on a booking | 12 months |
| Support correspondence | 24 months |
| Reviews you chose to publish | Until you withdraw consent |
| Server and security logs | 90 days |
| Contact-form messages that do not become bookings | 12 months |
Part B — Drivers and fleet owners
If you enrol as a driver or register an åkeri with us, we hold considerably more about you than about a passenger. This section says exactly what and why.
B1. What we collect
| What | Why we need it |
|---|---|
| Name, phone, email, home area, languages | Contact, and matching you to trips |
| Personnummer | Secure identification — see B2 |
| Profile photograph | The passenger is told who is collecting them |
| Scan of your körkort, with expiry date | Legal check: you may not carry a passenger without it |
| Scan of your taxiförarlegitimation, with expiry date | Legal check: same |
| Your company, or the åkeri you drive for | Who we settle with |
| Availability, preferred zones, vehicle classes | Dispatch |
| Trip history: offered, accepted, declined, completed, no-shows | Settlement, quality, disputes |
| Payout records | Settlement and accounting |
| Vehicle data: plate, model, photos, insurance, besiktning, taximeter | Legal and airport requirements |
| Portal login and session records | Access control |
| Push notification registrations | Sending you a ride offer |
| Location during an eligible accepted-ride window: coordinates, time and accuracy | Pickup coordination, active-ride logistics and safety |
For åkerier we additionally hold organisationsnummer, taxitrafiktillstånd, F-skatt confirmation, insurance and bank details for payouts.
B2. Personnummer — the specific rule
Swedish law does not let anyone collect a personnummer just because it is convenient. Under 3 kap. 10 § lagen (2018:218), a personnummer may be processed without consent only where clearly justified by the purpose or the importance of secure identification. We rely on secure identification: verifying that the person holding a taxiförarlegitimation is the person we send to a passenger, and reporting settlements against the right individual. Your personnummer is visible only to our administrators — never to passengers, never to another driver or åkeri.
B3. What we deliberately do not collect
We do not ask for, accept, or store a belastningsutdrag (criminal record extract) — data about convictions is restricted under GDPR Art. 10 and Swedish law, and a private company generally may not register it. If you send one unasked, we delete it and tell you we have. The iPhone app prepares location only after you review the location notice and grant Apple's permission. Collection can begin no earlier than 60 minutes before pickup for an accepted ride, continues while that ride is active, and stops when no eligible ride remains because it was completed, cancelled or marked no-show. Overlapping eligible rides form one continuous window. Location may continue while the screen is locked only when Apple's Always permission is enabled; iOS shows its location indicator. Signing out, revoking permission or losing ride eligibility stops collection. We do not collect speed, heading, altitude, audio or video.
B4. Legal bases
| Purpose | Legal basis |
|---|---|
| Enrolment, portal account, offering and settling trips | Art. 6(1)(b) — contract |
| Verifying körkort and taxiförarlegitimation | Art. 6(1)(c) — taxitrafiklagen makes them a precondition |
| Settlement and accounting records | Art. 6(1)(c) |
| Personnummer | Art. 6(1)(b)/(c), permitted by 3 kap. 10 § dataskyddslagen |
| Passenger safety, fraud prevention, disputes | Art. 6(1)(f) |
| Location during the accepted-ride window for pickup coordination and active-ride operations | Art. 6(1)(f) — legitimate interests, enabled only after a documented necessity and balancing assessment |
| Showing your name, photo and vehicle to the passenger who booked | Art. 6(1)(b) |
| Demonstrating verified supply to partners — in aggregate: counts and compliance status, never your identity documents | Art. 6(1)(f) |
B5. Automated decisions
Two things happen without a person pressing a button, and you are entitled to know: ride offers are routed automatically based on your zones, availability and vehicle class; and a temporary suspension from receiving offers is applied automatically after a third late cancellation within 90 days. You can ask for either to be reviewed by a person, put your side of it, and contest the outcome — write to support@forare.eu and a human, not the system, will look at it.
B6. How long we keep it
| Data | Retention |
|---|---|
| Profile, personnummer, document scans, photograph | While you are connected to Förare, plus 12 months |
| Trip, job and payout history | 7 years — accounting records |
| Vehicle and compliance documents | While the vehicle is connected, plus 12 months |
| A declined application | 12 months, so we can explain the decision |
| Administrative audit log | 24 months |
| Sessions and login records | 90 days |
| Exact driver-duty coordinates | Erased when duty ends; a daily safety sweep clears any points left by a crash or offline phone, so the scheduled maximum is 24 hours |
| Duty start/end, permission state and sample count — no coordinates | 90 days |
Part C — Everyone
C1. Who we share data with
| Supplier | What they do |
|---|---|
| Supabase | Our database — bookings, driver records and document scans. AWS eu-west-1, Ireland |
| Vercel | Runs the website and API, and provides cookie-free, aggregated traffic measurement. Functions in Dublin; company established in the USA |
| Google (Places & Routes) | Turns the address you type into suggestions and measures your route to price it. We send the address text and place ids — never your name or booking. Google Ireland Ltd, with US group companies |
| Stripe | Card payments and refunds. Card details go to Stripe, never to us. EEA entity, with US group companies |
| Resend | Transactional email — confirmations, receipts. USA |
| 46elks | SMS — confirmations, reminders, driver details. Sweden |
| Titan (billed via Hostinger) | Our @forare.eu mailboxes. EU |
| Push services (Google and Mozilla Web Push; Apple APNs) | Deliver ride notifications to a driver's device |
| Our accountant | Bookkeeping, VAT. Sweden |
Swedavia operates the flight information service we use. We send it a flight number — never your name, phone or address. The driver and åkeri carrying you receive your name, phone, pickup, drop-off and flight number — they need them to collect you. The åkeri is a separate controller for its own legal duties, notably taximeter reporting to a redovisningscentral. Booking partners: if you booked through a travel platform, hotel or corporate account, we exchange booking data with them so the trip can be arranged and settled. Authorities: we disclose data to Skatteverket, Transportstyrelsen, Polismyndigheten or a court where the law requires it.
C2. Transfers outside the EEA
Our data lives in the EEA — the database in Ireland, the site served from Dublin. Some suppliers are established in the United States and their staff may access data from there. Where that happens we rely on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the supplier is certified. Ask us which mechanism applies to a specific supplier and we will tell you.
C3. Security
Data is encrypted in transit. Uploaded documents are never reachable by a public link — every request passes our own session check. Access is role-based: a driver sees their own jobs, an åkeri sees its own drivers, and personnummer and bank details are visible only to administrators. Administrative changes are logged. We will notify you and Integritetsskyddsmyndigheten of a breach where GDPR Art. 33–34 require it.
C4. Cookies & measurement
We use only cookies necessary for the site to work: keeping you signed in, and security. Your in-progress booking form is held in your own browser's session storage and is not sent to us until you book. These do not require consent under Swedish law, but you are entitled to know they exist. To understand how the site is used we rely on privacy-preserving, aggregated traffic measurement (Vercel Web Analytics) that sets no cookie, stores nothing on your device and cannot follow you across sites. We do not use advertising or tracking cookies — if that changes, we will ask first, through a banner where refusing is as easy as accepting.
C5. Website statistics
We measure how the public website is used — how many people reach the booking page, and how many of them finish a booking — with Vercel Web Analytics, run by the same supplier that serves the site. It is cookieless: it stores nothing on your device, sets no identifier, and cannot recognise you on a later visit or on any other website. It does not identify individuals, and we do not attempt to. What it records is the page, and — where you arrived from one of our travel guides — which guide it was.
Your name, email, phone number, addresses and the price of your trip are never sent to it. The driver, fleet and admin portals are excluded entirely, so nothing a signed-in driver or partner does is measured. The legal basis is our legitimate interest (GDPR Art. 6(1)(f)) in knowing whether the site works. Vercel describes the service in its own Web Analytics privacy documentation.
C6. Your rights
Under the GDPR you may access the data we hold about you, rectify anything wrong, erase data we have no legal duty to keep, restrict processing while something is disputed, port the data you gave us, object to processing based on legitimate interests, withdraw consent at any time where consent is the basis, and ask for a human where a decision was automated.
To use them, email support@forare.eu with what you want. We reply within one month, and may need to verify who you are first. One honest limit: we cannot delete a booking's accounting record before the 7-year bookkeeping period expires — Swedish law requires us to keep it. We delete everything around it that is not required.
C7. Complaining to the supervisory authority
If you think we are handling your data wrongly, tell us first — we would rather fix it. You have the right to complain regardless, to Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, imy@imy.se, imy.se. If you live in another EEA country you may complain to your own authority instead.
C8. Changes
The version number and date at the top always tell you which version you are reading. Material changes affecting drivers or åkerier are notified in the portal.
See also our Terms of Service.