Privacy Policy

Last updated: 7 October 2026

This policy explains how Uvoya ("Uvoya", "we", "us") collects, uses and protects personal data when you use the Uvoya app (for customers who order food and groceries), the Uvoya Partner app (for restaurants and stores that sell on Uvoya), the Uvoya Rider app (for couriers who deliver Uvoya orders) and the website uvoya.es. We process personal data in line with the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

Uvoya customer app

This part applies if you order through the Uvoya app. The controller is Uvoya, contact uvoya26@gmail.com.

Data we collect

• Account data: your name, email address and, if you provide it, your phone number. You can sign in with email and password, with Google or with Apple. Passwords are managed by Google Firebase Authentication and are never stored in readable form. If you use Google or Apple, we receive the name and email address they share with us (Apple may give us a private relay address).
• Delivery addresses: the addresses you save or enter, including their coordinates, so couriers can find you.
• Location: if you allow it, your device's precise location, used only while you are using the app, to set your delivery address and show nearby restaurants. You can refuse location and enter an address manually. We do not track your location in the background.
• Orders: the items, options, notes for the kitchen, delivery address, status, price and payment method of each order, and the reviews you write about stores.
• Payments: card and Apple Pay payments are processed by Stripe. Your card number is sent directly to Stripe and is never stored on our servers. We keep only the order amount, the payment status and a payment reference. If you choose to scan your card, the camera is used on your device to read it.
• Device data: a push notification token and your device platform (iOS or Android), so we can tell you when your order changes status.
• Preferences such as language and theme, kept on your device or in your account.

We do not collect your contacts, photos, advertising identifier or browsing history, and we do not collect analytics or crash data through the app.

How we use it and why

• Creating your account and signing you in: performance of contract (Art. 6.1.b).
• Taking, preparing, delivering and tracking your orders, and processing payments: performance of contract (Art. 6.1.b).
• Showing nearby stores and setting your address from your location: your consent through the device permission (Art. 6.1.a).
• Order status notifications: performance of contract (Art. 6.1.b).
• Customer support, security and preventing fraud or misuse: legitimate interest (Art. 6.1.f).
• Keeping order and billing records required by law: legal obligation (Art. 6.1.c).

Who we share it with

• The store you order from, which sees your name, phone number, delivery address, order and notes so it can prepare and hand over your order.
• The courier delivering your order, who sees your name, phone number, delivery address and order details.
• Service providers acting on our behalf: Stripe (payments), Google Firebase (sign-in, live order tracking and push notifications), Mapbox (address search and maps: the address you type and the coordinates used to show a map or route are sent to Mapbox), Apple (Apple Pay and Sign in with Apple) and our hosting providers.
• Authorities, when the law requires it.

We never sell personal data or share it with advertisers or data brokers. Some providers, such as Google, Stripe and Mapbox, may process data outside the European Economic Area, protected by an adequacy decision or the European Commission's Standard Contractual Clauses.

How long we keep it

Account data for as long as your account is active. Push tokens until you sign out, uninstall the app or the token expires. Order and billing records for the period required by Spanish commercial and tax law (generally up to 6 years), after which they are deleted. Support emails for up to 2 years.

Deleting your account

You can delete your account at any time inside the app: Account > Delete account. We then delete or anonymise your personal data within 30 days, except records we must keep by law. You can also write to uvoya26@gmail.com or see how to delete your account.

Your rights

You can access, correct, delete, restrict, object to or port your data, and withdraw consent at any time (for example by turning off location in your device settings). Email uvoya26@gmail.com from the address linked to your account and we will reply within one month. You may complain to the Spanish Data Protection Agency (www.aepd.es) or the authority where you live.

Children

The Uvoya app is not directed at children and we do not knowingly collect data from anyone under 16.

Uvoya Rider app and rider applications

This part applies if you deliver orders with the Uvoya Rider app, or apply to become a rider. The controller is Uvoya, contact uvoya26@gmail.com.

Data we collect

• Account data: your name, email address and phone number, and the password you sign in with (never stored in readable form). Rider accounts are created by Uvoya after your application is accepted; there is no sign-up inside the app.
• Location while you are online: when you go online, the app sends your device's precise location (coordinates, heading and speed) to Uvoya about every 20 seconds, and about every 5 seconds while you are delivering an order. This continues while the app is in the background, so you keep receiving offers and customers can follow their delivery; iOS shows a location indicator while it happens. Location stops being sent as soon as you go offline. We never collect your location while you are offline.
• Vehicle: your vehicle type and plate number, if you add them.
• Shift and delivery activity: when you go online and offline, the offers you accept or decline (and the reason you give), each delivery's steps and times, cash you confirm collecting, your earnings, and the ratings and comments customers leave about deliveries.
• Device data: a push notification token and your device platform, so we can alert you about new offers and order changes.
• Practice deliveries run entirely on your device and are not sent to Uvoya.
• Rider applications: when you apply on our Become a rider page, your name, email, phone, city, vehicle and self-employment status, and any message. If you do not become a rider, we delete them within 12 months.

We do not collect your contacts, photos, advertising identifier or browsing history, and the app contains no advertising or analytics tools.

Customer data you can see

During a delivery the app shows you the customer's name, phone number, delivery address, delivery instructions and order details. You may use them only to complete that delivery and must not copy, keep or reuse them.

How we use it and why

• Creating and managing your rider account and signing you in: performance of contract (Art. 6.1.b).
• Offering you nearby deliveries, guiding you to the store and the customer, and showing the customer where their order is: performance of contract (Art. 6.1.b).
• Calculating and showing your earnings and keeping delivery records: performance of contract (Art. 6.1.b) and legal obligation (Art. 6.1.c).
• Safety, support, quality (including customer ratings) and preventing fraud or misuse: legitimate interest (Art. 6.1.f).
• Assessing your application: steps taken at your request before a contract (Art. 6.1.b).

Who we share it with

• The customer of the order you are delivering, who sees your first name, vehicle and live position on the map until the order is delivered.
• The store preparing the order, which sees your name and when you are arriving.
• Service providers acting on our behalf: Google Firebase (push notifications and live order tracking), Mapbox (maps and routes: your coordinates are sent to Mapbox to draw the map and calculate routes, and the Mapbox SDK may collect technical usage data) and our hosting providers.
• Authorities, when the law requires it.

We never sell personal data or share it with advertisers or data brokers. Some providers may process data outside the European Economic Area, protected by an adequacy decision or the European Commission's Standard Contractual Clauses.

How long we keep it

Account and vehicle data for as long as your rider account is active. Live tracking data for an order is deleted 7 days after it is delivered. Delivery and earnings records for the period required by Spanish commercial and tax law (generally up to 6 years). Push tokens until you sign out, uninstall the app or the token expires.

Deleting your account

Write to uvoya26@gmail.com from the email you sign in with, or follow how to delete your account. We delete or anonymise your data within 30 days, except records we must keep by law.

Your rights

You can access, correct, delete, restrict, object to or port your data. You can stop location sharing at any time by going offline, and refuse or withdraw the location permission in your device settings (you then cannot receive offers). Email uvoya26@gmail.com; we reply within one month. You may complain to the Spanish Data Protection Agency (www.aepd.es) or the authority where you live.

Age

You must be 18 or older to apply to or ride with Uvoya.

Uvoya Partner app and partner applications

The rest of this policy applies to stores and businesses that use the Uvoya Partner app or apply to sell on Uvoya.

1. Who is responsible for your data

The data controller is Uvoya. For any question about this policy or your personal data, contact us at uvoya26@gmail.com.

2. The data we collect

Account data

• The email address and password you use to sign in. Passwords are never stored in readable form on our servers.
• Your account identifier and the stores linked to your account.

Partner applications

• When a business applies on our Become a partner page, we receive its name, type and city, and the contact person's name, email and phone, plus any message. We use them only to assess the application and contact the applicant. If the business does not join Uvoya, we delete them within 12 months.

Store data you enter

• Store name, description, address, phone number, email address and opening hours.
• Store settings such as open, busy or paused status, preparation time and accepted payment methods.
• Your menu or catalogue: products, prices, descriptions, options and sections.
• Photos you take with your camera or choose from your photo library to illustrate your products. The app only accesses your camera or photos when you choose to add a photo.
• Order handling information, such as order status changes, preparation times and reasons for declining an order.

Device data

• A push notification token and your device platform (iOS or Android), so we can alert you when a new order arrives.

On your device, the app keeps your session token and preferences (selected store, language, theme and sound settings) so you stay signed in.

We do not collect your location, contacts, advertising identifier, browsing history, or analytics or crash data through the Uvoya Partner app.

3. Customer data you can see

To prepare and hand over orders, the app shows you information about the customers who order from your store: their name, phone number, delivery address, order notes, the items ordered and the payment method, along with reviews customers leave about your store. This data belongs to Uvoya's customers and is shared with you only to fulfil their orders. You may use it only for that purpose, must keep it confidential and must not copy, store or reuse it for anything else, such as marketing.

4. How we use your data and why

We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.

5. Who we share data with

• Customers of Uvoya, who see your public store information, menu, photos and opening hours.
• Couriers delivering an order, who see the store name and address needed for pickup.
• Service providers who process data on our behalf under a data processing agreement: our hosting providers, which store our servers and databases, and Google (Firebase Cloud Messaging), which delivers push notifications.
• Authorities, when we are required to by law.

We never sell personal data or share it with advertisers or data brokers.

6. International transfers

Some providers, such as Google, may process data outside the European Economic Area. When that happens, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.

7. How long we keep data

• Account and store data: for as long as your partner account is active.
• Push notification tokens: until you sign out, uninstall the app or the token expires.
• Order and billing records: for the period required by Spanish commercial and tax law (generally up to 6 years), after which they are deleted.
• Support emails: for up to 2 years after the conversation ends.

When you delete your account, we delete or anonymise your personal data within 30 days, except for records we must keep by law.

8. Your rights

You have the right to:

• access the personal data we hold about you;
• correct inaccurate data (most store data can be edited directly in the app);
• delete your data and account (see how to delete your account);
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw any consent you have given, at any time.

To exercise these rights, email uvoya26@gmail.com from the address linked to your account. We will reply within one month. If you are not satisfied with our answer, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or with the data protection authority where you live.

9. Security

All communication between the app and our servers is encrypted with HTTPS. Access to personal data is limited to the people who need it to operate the service. No system is completely secure, but we work to protect your data and will notify you and the authorities of a breach when the law requires it.

10. Children

The Uvoya Partner app is a business tool meant for adults who run a store. It is not directed at children, and we do not knowingly collect data from anyone under 16.

11. Website

The uvoya.es website does not use advertising or analytics cookies. Our hosting provider may keep standard server logs, such as IP address, date and page requested, for security purposes for a limited time.

12. Changes to this policy

We may update this policy from time to time. We will change the date at the top of this page and, for significant changes, let you know in the app or by email.

13. Contact

Uvoya · uvoya26@gmail.com