This Privacy Policy explains what personal data Tosiu ("we", "us", "our") collects about you, why we collect it, how we use it, with whom we share it, and the rights you have over your data under the EU General Data Protection Regulation (GDPR), the UK GDPR and equivalent laws. We wrote it to be read, not skimmed: every category below corresponds to something the platform really does.

1. Who we are

Tosiu is a software platform on which private-transfer companies create and run their own booking website. It is operated by I/E TOSIU, an Individual Entrepreneur registered in Georgia (identification number 304829112), registered address Nikoloz Baratashvili street N12 / Sanapiro street N2, Tbilisi 0105, Georgia, e-mail contact@tosiu.com, phone +995 557 198 117. I/E TOSIU is the data controller for the processing described in this policy. We are established outside the European Union; the GDPR applies to us under its Article 3(2) because we offer our services to businesses in the Union and measure the use of our site by visitors there. We have not appointed a data protection officer: our processing is not large-scale monitoring and does not concern special categories of data, so Article 37 GDPR does not require one. Data-protection questions go to the e-mail above with the subject "Privacy".

2. Scope of this policy

This policy covers personal data we process when you:

Visit our marketing site at tosiu.com (browsing, reading, registering or sending the contact form);
Hold or use an account on our platform at app.tosiu.com (as an operator or a person the operator invited);
Contact us by e-mail, through the contact form, through a support ticket in the platform, or, on the Leader plan, by WhatsApp or phone.

This policy does not cover personal data processed on the booking websites our customers (the transfer companies, called "Operators") create on the platform. For the visitors, passengers, drivers and partners of an Operator's site, the Operator is the data controller and publishes its own privacy policy on that site. Tosiu processes that data only as the Operator's processor, on its instructions, under our Data Processing Agreement. If you are a passenger and booked on a site run on Tosiu, please read that company's policy and address your requests to them; if you write to us we forward your request to the Operator.

3. What we collect, why, and on which legal basis

3.1 Visitors of tosiu.com

Data	Purpose	Legal basis (Art. 6 GDPR)
Registration ("Create your site"): first and last name, company, e-mail, phone, country, the plan and the term you choose, the language of the page, IP address and browser string. Until September 2026 a shorter request form stood in its place (name, company, e-mail, the button pressed, the same technical data); the requests it collected are kept as described in section 7	To open your account on the platform (the data then becomes account data, section 3.2), to send you the access details, to contact you about your registration and about Tosiu, and to prevent abuse of the form	Steps at your request prior to a contract (b); legitimate interest in preventing spam and abuse (f)
Where a registration came from (kept on the account): the page you arrived on, the site that sent you, the campaign parameters of the link (utm, keyword match type, campaign id), the kind of ad click, and your cookie choice at that moment. Only if you accepted marketing cookies: the ad click identifier of Google or Meta (gclid, gbraid, wbraid, fbclid) and Meta's browser identifiers (_fbp, _fbc)	To know which campaign brought a registration and what a registration costs us in advertising; with your marketing consent, to report the registration to Google Ads and to Meta (next row)	Legitimate interest in measuring our own advertising (f) for the campaign data; consent (a) for the click and browser identifiers
Contact form: name, e-mail, company and phone number (both optional), country, the topic you pick, message and, when you ask for a demo, the answers to its questions (your main area, the airports you serve, whether you already have a website and its address), plus the language of the page, your country (from the IP, see below), IP address, browser string, referrer and campaign parameters	To answer you and to filter automated spam (a score computed from the message and the browser, with no legal effect on you)	Steps at your request prior to a contract (b) or legitimate interest in answering enquiries (f); legitimate interest in preventing spam (f)
Country from your IP address, resolved on our own server with a MaxMind GeoLite2 database (your IP is not sent to MaxMind) and kept 30 days in the tosiu_geo cookie	To show the site in the language of your country the first time and to decide whether the cookie card must be shown to you	Legitimate interest in a site that works in your language (f); the cookie is strictly necessary
First-party audience measurement (our own tracker, no third party): pages viewed, scroll depth, time spent on each page and which of its sections came into view, clicks on menus and buttons (which button and where it leads), forms sent, on the registration form which fields were started (never what was typed), each press of its button and any error it showed, your language and cookie choices, whether and how quickly the cookie card was answered and which of its two layouts was shown, a light activity signal (that the page is in use, with a count of clicks), screen size, referrer, campaign parameters, language, device, browser family and operating system, country, and an IP address truncated before storage (the last part is removed, so it no longer identifies you); a random identifier lives in your browser only until you close the tab	Statistics on how the site is used and where its visitors come from, to improve it. This measurement is technical, runs on our own server only and is exempt from consent under the Italian Garante's guidelines of 10 June 2021 because the data are truncated, never combined with other data and never shared	Legitimate interest in measuring the use of our own site (f)
Analytics and advertising cookies (Google Analytics 4, ContentSquare, Google Ads, Meta Pixel and Meta Conversions API). When you register after accepting marketing cookies, the registration is reported to Google Ads by the tag in your browser and to Meta twice, by the Pixel and by our server (Conversions API): the event identifier and time, the page address, your IP address and browser string, Meta's _fbp and _fbc identifiers and the price of the plan. No name, e-mail address or phone number is sent. If that registration becomes a paid subscription within 90 days, our server also reports the payment to Google Ads and to Meta: the ad click identifier or Meta's _fbp and _fbc identifiers kept on the registration (row above), the time and the amount paid, again with no name, e-mail address or phone number. When you send the contact form or ask for a demo after accepting marketing cookies, that fact alone is reported to Google Ads and to the Meta Pixel by the tag in your browser (an event with its identifier and time, nothing you wrote in the form). Meta may also show our ads to people who interacted with our Facebook page, our Instagram account or our ads on those platforms: that audience is built by Meta from its own data, under its own terms and your settings there, and does not depend on the cookies of this site	Detailed usage analytics and measurement of our advertising	Consent (a), asked through the cookie card; never loaded before you accept. See the Cookie Policy
Bot protection: Cloudflare Turnstile checks on the registration and the contact form that you are not a robot, using your IP address and browser signals. Its script is loaded on every page of tosiu.com, so Cloudflare receives your IP address and browser data when a page loads	Security of the forms	Legitimate interest in protecting the site from abuse (f)

When you register or send the contact form, we receive it by e-mail and as an instant alert on Telegram (company, name, e-mail, phone, plan and country for a registration; name, e-mail and message for a contact), so that we can answer you quickly. It is also listed in our internal management tools.

3.2 Operators and users of app.tosiu.com

Data	Purpose	Legal basis (Art. 6 GDPR)
Account data: e-mail, password (stored only as a hash), first and last name, phone, company name, VAT or tax number, registered address, language, time zone, currency; the version and date of the Terms you accepted, with the IP address and browser used	To create, secure and run your account; to identify you on our invoices; to prove the contract you accepted	Performance of the contract (b); legal obligation for invoicing data (c)
Business configuration: sites, routes, prices, vehicles, drivers, partners, photos, texts, settings, integrations	To run your sites and your back office	Performance of the contract (b)
Credentials you connect: keys of your payment processor, e-invoicing provider, SMS provider, storage account, management software	To call those services on your instruction. Secrets are encrypted at rest. We never see or store card numbers	Performance of the contract (b)
Billing: plan, invoices, payment status, the bank details you paid from as they appear on our statement	To invoice you and keep the accounting records the law requires	Performance of the contract (b); legal obligation (c)
Support: tickets, messages and files you send, e-mails, and on the Leader plan the WhatsApp messages and calls with us	To help you and to keep a record of what was agreed	Performance of the contract (b)
Activity and security logs: logins, IP address, browser, pages and actions in the platform, session identifiers, "remember me" tokens, CSRF tokens	Security, debugging, abuse prevention, and understanding which features are used	Legitimate interest in a secure and working platform (f)
Product e-mails: weekly platform updates	To tell you what changed in the software you use	Legitimate interest in informing existing customers about the product (f); you can switch them off in your account at any time
AI features you use: the texts you give to the AI assistant (site texts, messages to answer, quote requests, planning notes)	To generate the draft you asked for	Performance of the contract (b)

3.3 Passengers and other people on Operator sites

We are the processor, not the controller, of the bookings, quote requests, contact messages, Portal accounts, driver and partner records that Operators handle through the platform. What we do with that data, where it is stored, which sub-processors we use and how transfers are protected is set out in the Data Processing Agreement, which binds every Operator. Two things are worth knowing if you are a passenger: your data sit on our servers only because the transport company you booked with uses our software, and the company, not Tosiu, decides how long they are kept and answers your requests.

4. Automated decisions and profiling

We make no decision about you based solely on automated processing that produces legal or similarly significant effects. The only automation is a spam score on the contact form and the bot check on the forms; a message flagged as spam is not delivered, and you can always write to us by e-mail instead.

5. Who receives your data

We do not sell personal data. We share it only with the providers we need to run the platform, each bound by a data-processing agreement, and only to the extent needed for their function:

Hosting: Namecheap, Inc. (United States). Our server, with its database and files, runs in a Namecheap data centre in the United States.
Content delivery and media storage: BunnyWay d.o.o., bunny.net (Slovenia, EU); encrypted backups: bunny.net and Amazon Web Services (Frankfurt, Germany).
E-mail delivery: SMTP2GO Ltd (New Zealand, servers in the EU and the United States) relays every e-mail we send.
Bot protection: Cloudflare, Inc. (United States), Turnstile.
Instant alerts: Telegram FZ-LLC (United Arab Emirates) carries the alert for new requests, contacts and support tickets to our team.
AI features: Anthropic, PBC (United States) and OpenRouter, Inc. (United States, which routes requests to model providers such as Anthropic and Google). The text of the feature you use is sent to them; under their commercial terms it is not used to train models.
Google (Google Ireland Ltd / Google LLC): Maps Platform for addresses typed in the platform, sign-in with Google if you use it, Google Ads API for the Ads tools, and, only with your consent on tosiu.com, Google Analytics 4 and Google Ads measurement.
ContentSquare SAS (France) and Meta Platforms Ireland Ltd: only with your consent on tosiu.com, for usage analytics and advertising measurement (Meta through the Pixel in your browser and, for a registration and its first payment, also from our server through the Conversions API, section 3.1).
Your own providers: when you connect a payment processor, an e-invoicing provider, an SMS provider or a storage account, we transmit data to them on your instruction under your own contract with them.
Banks and accountants: the bank we receive your payment through and, where needed, our accountant, for the invoicing records.
Authorities: where disclosure is required by law, court order, or to establish, exercise or defend legal claims.

Flight data lookups (AeroDataBox via API.market) receive only a flight number and a date, never personal data. The MaxMind country database runs on our server; nothing is sent to MaxMind.

6. International transfers

Where your data is. Tosiu is established in Georgia and the platform is hosted in the United States. When you use tosiu.com or app.tosiu.com you give your data directly to us, a controller outside the EEA to which the GDPR applies; we protect it with the measures in section 8 and with the contracts below.
Our providers outside the EEA. Transfers to Namecheap, Cloudflare, Anthropic, OpenRouter, Google and Meta in the United States rely on the EU-US Data Privacy Framework where the provider is certified and on the European Commission's Standard Contractual Clauses (Decision 2021/914) in their data-processing terms. SMTP2GO is in New Zealand, which the European Commission recognises as adequate. Telegram receives only the minimal alert described above; no contractual safeguard is available from that provider, which is why we keep the content of the alert to a minimum. You can ask us for a copy of the relevant safeguards.
For Operators' passenger data we are the importer under the Standard Contractual Clauses (Module Two) incorporated in the Data Processing Agreement.

7. How long we keep your data

Request and contact-form data (the requests sent through the former request form, and contact messages): 24 months from your last interaction with us, then deleted or anonymised automatically, unless you became a customer (then it is account data, below). You can delete it earlier with the tool in section 10.
Where a registration came from (section 3.1): the campaign data is kept with the account data, below; the ad click identifiers of Google and Meta (gclid, gbraid, wbraid, fbclid) and Meta's browser identifiers (_fbp, _fbc) are deleted 90 days after the registration.
First-party audience measurement: 365 days, then deleted automatically. The rows hold a truncated IP address and no browser string, so they do not identify you.
Account and business data: for as long as your account is active. Within 48 hours of an account-closure request we e-mail you a copy of your data; after delivery we delete or anonymise it on our standard schedule, except what we must keep by law. Deleted data can persist in encrypted backups for up to 365 days.
Terms acceptance records: for the life of the account plus the limitation period for contractual claims.
Invoices and accounting records: as long as tax and accounting law requires (up to 10 years).
Support tickets and e-mails: for the life of the account plus 24 months.
Security and activity logs: platform activity 365 days; sessions 90 days; expired login tokens 30 days.
Data-request verification records (section 10): 12 months, as proof that the request was handled.
Consent records (cookie choice): 12 months in your browser; the event that you chose is kept with the audience measurement above.

8. Security

We protect your data with encrypted connections (HTTPS with modern TLS), passwords stored only as one-way hashes, secrets encrypted at rest, one administrator with access to production, role-based access for the people you invite, throttling and bot protection on every public form, security headers, automated tests before changes, daily review of the logs, and encrypted backups every four hours on two independent providers. No system is 100% secure: if you believe your account has been compromised, write immediately to contact@tosiu.com. We notify the competent authority and, where the law requires it, you, of any personal data breach that is likely to result in a risk to you.

9. Your rights

Under the GDPR you have the right to:

Access your personal data and obtain a copy;
Rectify inaccurate or incomplete data;
Request erasure ("right to be forgotten");
Restrict or object to processing, including to processing based on our legitimate interests and to any direct marketing;
Data portability: receive your data in a machine-readable format;
Withdraw consent at any time, without affecting the lawfulness of what was done before;
Lodge a complaint with a supervisory authority: the one of the EU member state where you live or work, or where you believe the infringement took place (in Italy, the Garante per la protezione dei dati personali, garanteprivacy.it; in the United Kingdom, the Information Commissioner's Office). We would appreciate the chance to answer you first.

To exercise any of these rights, e-mail contact@tosiu.com from the address concerned and we will answer within 30 days (extendable by two months for complex requests, in which case we tell you). If you have an account on app.tosiu.com, you can correct your data in Account and request closure and export from the same page. Visitors who used our forms can use the self-service tool in section 10.

10. Manage your data (visitors of tosiu.com)

If you sent us a request or a contact message, you can receive a copy of everything we hold under your e-mail address, or have it deleted, without writing to us. We send a verification link to that address first; it is valid for one hour and can be used once. Deletion removes your contact messages and anonymises your request record (the row stays for our statistics without any data that identifies you).

11. Children

The platform is intended for business use by adult professionals. It is not directed at children under 16, and we do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to this policy

We may update this policy from time to time, for example when we add a provider or a feature. Material changes are notified by e-mail to account holders or by a notice in the platform; the list of processors in the DPA follows its own 30-day notice rule. The "Last updated" date at the top always reflects the current version.

13. Contact

I/E TOSIU, Nikoloz Baratashvili street N12 / Sanapiro street N2, Tbilisi 0105, Georgia (ID: 304829112), phone +995 557 198 117. Questions about this policy or your data? Email contact@tosiu.com or use the contact form.