Privacy Policy

Last updated: 1 November 2026 (effective 1 November 2026)

1. Who we are

This Privacy Policy describes how George Lorentzos ("GoFast", "we", "us", "our") processes personal data in connection with the GoFast app, the GoFast Driver app, the GoFast admin web panel and the contact form on our website (together, the "Service").

Operator: George Lorentzos (natural person, sole operator)
Country: Greece
Contact form: go-fast.app/contact

We comply with Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019. For the purposes of GDPR, the data controller is George Lorentzos.

2. About the Service

The Service has two user groups:

• Passengers — use the GoFast app without creating an account: there is no sign-in, and the app does not ask for your name, phone number or email address. Depending on the area, a passenger either calls a nearby taxi directly through an in-app voice call ("Call Now", available in certain areas, such as islands and small towns), or requests a ride by choosing a destination and a ride type, which is then offered to nearby drivers.
• Drivers — apply to join from the GoFast Driver app (or are added directly by an administrator). Every application is reviewed, and a driver account exists only after an administrator approves it. Drivers sign in with their email address and a 6-digit code sent by email. While online, drivers share their live location so passengers can see nearby taxis.

3. What data we collect

a) Passengers

The GoFast app has no passenger accounts. You do not sign in, and we do not collect your name, phone number or email address. The app works with:

• Device identifier — a random identifier the app creates when it is installed. It is not derived from your phone's hardware identifiers. It is used to deliver calls, ride updates and notifications to your phone, to keep your ride and call records together, and to hold your GoFast points. Uninstalling the app discards it; a new installation gets a new one.
• Caller tag — a 10-digit number derived from the device identifier. Drivers see it as your "caller ID" in calls, ride requests and their history, so they can tell one passenger from another and call you back. It is not your phone number and cannot be used to contact you outside the app.
• GoFast points balance, kept against the device identifier (see section 3(g))
• Push-notification token — so we can notify your phone of incoming calls and ride updates. It is held only in server memory, not in our database.

Our server also contains the technical groundwork for optional passenger accounts (sign-in by phone number, username and profile photo), but this is not available in the app and no such data is collected. If we introduce accounts, we will update this policy first.

Your ride history list in the app is kept on your phone. The ride records we hold on our server are described in section 3(c).

b) Passenger location

While the app is open, it uses your device's location to show your position, your pickup point and the taxis near you. The passenger app does not use your location in the background. Your location is sent to our server only in these cases:

• When you request a ride — the pickup point (coordinates and address name) and the destination you chose are sent to our server and stored with the ride (see section 3(c)).
• When you search for an address or move the pickup/destination pin — the search text, or the pin's coordinates, and (for search) your approximate position to show nearby results first, are sent to our server, which looks up the address with an external address-search service (see section 6). These requests are not stored.
• When the app draws a route on the map or measures the road distance to nearby taxis — the start and end coordinates (for example, your position and a taxi's position, or your pickup and destination) are sent to our own route-calculation service running on our server. These requests are not stored in our database and are not linked to your account.

When you use Call Now, the app picks the nearest taxi on your phone, and the call itself does not carry your location. Apart from the route requests described above, the app does not send your location to our server while a ride is in progress; there is no continuous tracking of passengers.

c) Rides (ride-request areas)

When you request a ride, we store a ride record containing:

• your device identifier and caller tag
• the ride type (Taxi, Taxi Pet or Taxi Van)
• the pickup and destination coordinates and address names
• the driver who accepted the ride
• the ride status and the times it was requested, accepted, started and ended
• if the ride was cancelled: who cancelled it and the reason typed by that person
• the fare: the estimate calculated by the driver's app when the ride is completed, or, for Taxi Van rides, the price offered by the driver and accepted by you

Pickup code (PIN): when the driver reports that you are being picked up, our server creates a 4-digit code that is shown only in your app; the driver enters it to start the ride. The code is held only in server memory while the ride is live and is never written to our database.

A ride request is sent to the suitable online drivers near the pickup point (see section 4). The driver who accepts it then sees the ride until it ends.

d) In-app voice calls

Passengers and drivers talk to each other through in-app voice calls, not ordinary phone calls. The call audio is carried, encrypted in transit, through our own call server (based on the open-source LiveKit software, running on our server described in section 6). Calls are not recorded, and the audio is not stored.

For each call we store a call record: the driver, the passenger's device identifier, who started the call, when it started and ended, and how it ended (for example ended, declined or busy). Drivers see these records as their Call History, together with the passenger's caller tag.

On iPhone, incoming calls are shown through Apple's CallKit; on Android, through the system's calling service. To ring a phone whose app is in the background, we send a push notification through Apple or Google (see section 6). For a call to a driver, the notification contains the passenger's caller tag; for a call to a passenger, it contains the driver's name and a link to the driver's profile photo.

e) Drivers

For each driver account we store the following in our database:

• Full name (shown to passengers)
• Gender (male / female)
• Email address (used to sign in — we email you a 6-digit code — to confirm a driver application, to tell you when your application is approved, and to confirm an email change)
• Phone number (given when you apply; it is not shown to passengers — calls go through the app. It can be changed only by contacting us)
• Vehicle registration plate number, car model and vehicle type (Taxi, Taxi Pet or Taxi Van) — the plate and car model are shown to a passenger whose ride you accept, and the vehicle type decides which ride requests you receive
• Profile photo (optional — only if you add one; re-encoded before storing, which removes embedded metadata; shown to passengers on the driver card and during calls; you can remove it in the app at any time)
• Driving licence expiry date, Ε.Δ.Χ. permit number and expiry date (see section 3(j))
• Account and subscription details: subscription plan, whether the subscription is active, its expiry date, and the account creation date
• Device identifier of the phone you are signed in on (an account can be signed in on one device at a time)
• GoFast points balance (see section 3(g))
• Call and ride records (sections 3(c) and 3(d)), which the Driver app shows as your Call History and Ride History
• One-time codes for sign-in and email changes — stored temporarily, valid for 3 minutes, deleted after use
• Coupons you claim with GoFast points (see section 3(i))
• Push-notification token — held only in server memory, not in our database
• Authentication tokens — issued on sign-in and kept on your device; they are not stored in our database

Settings stored only on your phone, such as Night Mode and Appearance, are not sent to our server.

f) Driver live location, Location Privacy and Busy

While a driver is online in the Driver app, the device sends GPS data (latitude, longitude, speed, heading and accuracy) to our server every few seconds, including in the background while driving. We use it to:

• show your taxi on the passengers' map and on other drivers' maps;
• offer you ride requests near you and let passengers call the nearest taxi;
• show a passenger the position of the taxi that accepted their ride;
• calculate your GoFast points (section 3(g)) and send panic alerts (section 3(h)).

The live location is held only in server memory. Each update replaces the previous one and it is not written to our database. It is removed when you go offline or sign in again, and it is lost whenever the server restarts. The only exception is a panic alert (section 3(h)).

Location Privacy (Driver app Settings): while it is on, the GoFast apps do not show your taxi's position, route or arrival time to passengers or other drivers; passengers can still see your name and distance and can still call you. Your location is still sent to our server while you are online, is still used for the purposes listed above, and is still included in the data our server sends to the apps, which do not display it.

Busy: while it is on, your taxi stays on the map but passengers cannot call you and you receive no ride requests.

g) GoFast points

Drivers earn GoFast points for the distance driven while online, and passengers earn points for each completed ride. For drivers, our server adds up the distance between consecutive location updates (only the running total is kept in memory); only the points total is stored in our database, not the route driven. For passengers, points are added against the device identifier when the driver completes the ride; they stay with that installation of the app.

h) Panic button (drivers)

A driver who presses the panic button sends an alert to every other online driver within 5 km, including drivers who are Busy or use Location Privacy. The alert contains the driver's name, vehicle plate and location. Their apps ring, show the alert, and for 2 minutes show an alert area around your taxi's current position on the map. The alert is held in server memory for those 2 minutes. Our server log also records the alert: the driver's account identifier, the location and the number of drivers alerted.

i) GoFast Rewards and coupons (drivers)

The Driver app shows a Rewards catalogue: offers from partner businesses that a driver can claim with GoFast points. The catalogue (title, description, picture, cost in points, partner business) is public information served by our server. Some rewards are shown as "Soon"; these cannot be claimed yet.

When you claim a reward, the points are deducted and we create a coupon with a random code (for example "GF-A1B2C3"). For each coupon we store: the code, the reward and partner business it belongs to, the points spent, your driver account, when it was created, when it expires (90 days after claiming) and when it was redeemed. The coupon code is shown in the app's "My coupons" list.

To use a coupon you show the code to the partner business, which redeems it in a web portal we provide to partners. The partner sees only the code, the reward, the points spent and the dates — not your name, email address, phone number or anything else about you. A redeemed or expired coupon cannot be used again, and expired coupons are not refunded.

Rewards for passengers are not available in the GoFast app at present.

j) Driver documents

For each driver we record only the expiry dates of the driving licence (Δίπλωμα οδήγησης) and the Special Taxi Driving Permit (Ειδική Άδεια Οδήγησης Ταξί / Ε.Δ.Χ.), the Ε.Δ.Χ. permit number and the vehicle registration plate number. A driver cannot go online once either document has expired; the permit and plate numbers let us check that an applicant is a licensed taxi driver and identify the vehicle. We do not request, upload, scan, photograph, or otherwise store copies of the licence, the Ε.Δ.Χ., the identity card, the vehicle registration certificate, the insurance certificate, or the ΚΤΕΟ. Drivers remain personally responsible for holding all such valid documents under Greek law (see the Terms of Service).

k) Driver applications (Register in the Driver app)

Anyone who wants to drive with GoFast can apply from the login screen of the Driver app. The application asks for: full name, gender, phone number, email address, Ε.Δ.Χ. permit number, vehicle registration plate number, car model, vehicle type, driving-licence expiry date and Ε.Δ.Χ. expiry date. The application is confirmed with a 6-digit code sent to your email address and entered in the app. A code expires after 10 minutes. We also record the IP address the application was sent from, to limit abuse (for example, automated or repeated applications).

A confirmed application waits for review by an administrator. If it is approved, its details become the driver account described in (e) above, the application itself is deleted, and we send you an email to let you know. If it is rejected, the application is deleted. An applicant has no account and cannot sign in until approved.

l) Contact form

When you use the contact form on our website we store your name, your email address (optional), your message and the IP address it was sent from (used to limit the number of messages per network). Messages are read in the admin panel.

m) Admin web panel

The admin panel is used by authorised administrators (currently only the operator) to review driver applications, create and manage driver accounts, manage partner businesses and the rewards catalogue, read contact-form messages and view call statistics. For each partner business we store its name, contact email address, phone number and tax number (ΑΦΜ); partner staff sign in to the coupon portal with that email address and a code sent to it. Administrators have their own accounts (name, email address and phone number) and sign in with a code sent by email.

n) Server logs

For each request to our server we log the IP address, the request type and path (without the search or location parameters of the request), the response status and the time taken. These logs are used for security, abuse prevention and fixing faults. To limit abuse we also apply rate limits per IP address, phone number or account; these counters are held in server memory only.

4. What other users can see

• Passengers see about online drivers: name, profile photo, live position, direction and speed (unless the driver uses Location Privacy), and whether the driver is Busy. Once a driver accepts a passenger's ride, that passenger also sees the driver's plate number and car model. During a call, each side sees the other's caller ID: the driver's name and photo, or the passenger's caller tag.
• Drivers see about passengers: the passenger's caller tag (a 10-digit number derived from the device identifier — not a phone number — shown as caller ID in calls, in ride requests and in Call and Ride History) and, for a ride request, the pickup and destination. A ride request is sent to the suitable online drivers within 25 km of the pickup point (matching the ride type, not Busy) before one of them accepts it, so each of these drivers receives the request details. Drivers never see a passenger's name or phone number.
• Partner businesses see about drivers: only the coupon code, reward, points spent and dates of a coupon presented to them (section 3(i)).
• Drivers see about other drivers: the same map information passengers see, and the details in a panic alert (section 3(h)).

5. Why we process this data (legal bases under GDPR Art. 6)

Purpose	Legal basis
Create and operate driver accounts, including sign-in by email address and code; identify passengers' devices so calls, ride updates and points reach the right phone	Contract — Art. 6(1)(b)
Send emails to drivers (sign-in codes, application confirmation, approval, email change)	Contract
Receive and review driver applications	Steps taken at the applicant's request before entering into a contract — Art. 6(1)(b)
Share driver live location, show nearby taxis, offer ride requests to nearby drivers and show the matched driver to the passenger	Contract
Store ride and call records and show them as history	Contract, and legitimate interest — Art. 6(1)(f) — handling disputes, complaints and misuse
Connect in-app voice calls and show the caller ID (passenger caller tag to drivers; driver name and photo to passengers)	Contract
Send push notifications for calls and ride updates	Contract
Pickup code (PIN) and GoFast points	Contract, and legitimate interest — preventing fake rides and points abuse
Rewards catalogue and coupons (claiming, listing and redemption at partner businesses)	Contract, and legitimate interest — preventing coupon fraud
Panic alerts to nearby drivers	Legitimate interest — the safety of drivers; vital interests — Art. 6(1)(d) — where a life may be at risk
Record the Ε.Δ.Χ. permit and vehicle plate numbers, and track driving-licence and Ε.Δ.Χ. expiry dates so drivers with expired documents cannot go online	Legitimate interest + legal obligation
Answer contact-form messages	Legitimate interest — responding to people who contact us
Optional username and profile photo	Consent — Art. 6(1)(a) — you can remove them at any time
Prevent fraud, abuse, or technical attacks (logs, rate limits, IP addresses)	Legitimate interest
Meet tax, accounting, or legal record-keeping requirements (if monetisation begins)	Legal obligation — Art. 6(1)(c)
Defend against or bring legal claims	Legitimate interest

6. Where data is stored and who we share it with

• Server hosting: Hetzner Online GmbH, data centre in Nuremberg, Germany. Our application server, the PostgreSQL database, the call server (LiveKit) and the route-calculation service (OSRM) all run on this server, which we operate ourselves.
• Profile photos: stored in Cloudflare R2 (Cloudflare, Inc.) and served from avatars.go-fast.app. Photo addresses contain a random part, so they cannot be guessed.
• Email delivery: Google (Gmail), used to send sign-in codes and other emails to drivers and driver applicants (section 5) and sign-in codes to administrators. Google receives the recipient's email address and the message contents.
• Push notifications: Apple Push Notification service (iPhone) and Google Firebase Cloud Messaging (Android). They receive the push token of the device and the notification contents described in section 3(d) (and, for drivers, ride-request notifications containing the pickup and destination names).
• Maps: the apps display maps with the Google Maps SDK, and the Android apps use Google Play services to read the device location. Google receives technical data such as your device's IP address and the map area being displayed, under Google's own privacy policy.
• Address search: Photon, an address-search service based on OpenStreetMap data, operated by komoot. Our server sends it the search text or pin coordinates; your IP address and account are not sent to it.
• Other users: as described in section 4.
• Authorities: we may share data with law enforcement, tax authorities, or courts when legally required.

We do not sell personal data. We do not run advertising. There are no analytics, advertising or crash-reporting SDKs in the apps.

7. International transfers

Our server is in the EU (Germany). However, Google, Apple and Cloudflare may process data in the United States or other countries outside the EU. These transfers are covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.

8. How long we keep data

• Passenger device identifier and points — kept for as long as records referring to that installation exist (rides, calls, points). Uninstalling the app discards the identifier on your phone; a new installation starts fresh, and old records can no longer be matched to you by the app.
• Coupons — kept while the driver account exists, so that the partner business can verify them and the app can show your coupon history.
• Driver account data — kept for as long as the account exists. After account deletion, kept up to 5 years if needed to satisfy Greek tax or legal record-keeping obligations, otherwise erased.
• Ride and call records — kept for as long as the related account exists, as there is currently no automatic deletion period. We delete them on a valid erasure request unless we need them to establish, exercise or defend legal claims.
• Pickup codes (PIN) and live ride details in memory — kept in server memory during the ride and for 10 minutes after it ends; the PIN is never written to our database.
• Driver live location — held in server memory only; replaced by each update and removed when the driver goes offline or signs in again, or when the server restarts.
• Passenger location — not kept, except for the pickup and destination stored with a ride request (see ride records above).
• Panic alerts — held in server memory for 2 minutes; the server log entry is kept like other server logs.
• One-time codes — valid for 3 minutes (driver sign-in and email change) or 10 minutes (driver applications), and deleted after use.
• Push-notification tokens — held in server memory only.
• Authentication tokens — held only on your device; cleared when you sign out or uninstall the app.
• Driving-licence and Ε.Δ.Χ. expiry dates, Ε.Δ.Χ. permit number, vehicle plate, car model, gender and profile photo — kept while the driver account exists, deleted together with the account (the profile photo can also be removed by the driver at any time in the app).
• Driver applications — kept until an administrator reviews them; deleted when rejected, or turned into the driver account when approved.
• Contact-form messages — kept until we have dealt with them and delete them from the admin panel.
• Server logs — kept for a limited period for security and fault-finding, unless needed for an incident investigation.

9. Your rights (GDPR)

You can, at any time:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16) — drivers can change their name, photo, car details and email address in the app; for a phone number, contact us
• Erase your data — right to be forgotten (Art. 17)
• Restrict processing (Art. 18)
• Port your data to another provider (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Hellenic Data Protection Authority — www.dpa.gr, Kifissias 1-3, 11523 Athens, +30 210 6475600

To exercise any right, including deleting your driver account, use the contact form on our website and tell us the email address of your account. The Driver app does not yet have an in-app option to delete an account. We may ask you to confirm that the account is yours before acting on the request. We respond within 30 days at no cost.

Passengers have no account to delete. To have the ride and call records of your installation erased, contact us through the same form and tell us when and roughly where you used the app, so we can find the records; we may ask you to show the app's history on your phone to confirm they are yours.

10. Security

• All connections between the apps and the server use HTTPS/TLS, and call audio is encrypted in transit.
• Driver sign-in is by signed tokens (JWT, HS256). A driver account can be signed in on one device at a time.
• The PostgreSQL database is not exposed to the public internet.
• Uploaded profile photos are re-encoded before storing, and public endpoints are rate-limited.

No system is 100% secure. If a personal-data breach occurs, we will notify the Hellenic DPA and affected users within 72 hours, as required by GDPR Art. 33–34.

11. Children

The Service is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a minor's data has been collected, contact us and we will delete it.

12. Changes to this policy

We may update this Privacy Policy as the Service evolves (for example, when payments are added or when the operator forms a legal entity). Material changes will be communicated in the apps at least 30 days in advance.

13. Contact

George Lorentzos, Greece
Contact form: go-fast.app/contact