Privacy policy

Last updated: 3 November 2026

PalopGO is a trading name of Bridge Digital Solution LTD, a company registered in England and Wales (company number 17320165), 35a Balaam Street, London E13 8EB, United Kingdom ("PalopGO", "we"). We are the controller of the personal data described here. Contact us about anything in this policy at bridge@bridge-digital-solution.com.

Who this covers

Customers who order through the PalopGO app or website, the people who run the stores that sell through PalopGO, and the couriers who deliver. PalopGO is for people aged 18 or over.

What we collect and why

Data	Why we use it	Legal basis
Your mobile phone number	To create your account and sign you in with a one-time code; so the store or courier can call you about an order	Contract
Delivery addresses and map pins, with any landmark or access notes you add. Your precise location is read only when you tap "Use my location"	To price and deliver your order	Contract
Your orders: items, prices, fees, times and status	To fulfil the order, handle cancellations, refunds and complaints, and keep accounts	Contract; legal obligation (tax and accounting records)
Payment details	Card payments are taken by Stripe. We never see or store your full card number; we keep Stripe's payment reference and the amount	Contract
A random identifier the app creates for your device, the app version and, if you allow notifications, a notification token	To keep you signed in on that device and to send order updates	Contract; legitimate interest (security)
Technical logs of requests to our service	To keep the service secure and working	Legitimate interest
Couriers: name, vehicle, precise location while online with the app open (about every 30 seconds), delivery records, cash collected	To offer and assign deliveries, show the customer where their order is, and pay couriers	Contract
Já que vais (carrying on the way): the trip a deliverer announces (how they travel and where to), their phone's precise location about every 15 seconds while the trip is live and the app is open, the photos of the item, the receipt and the handover, and what a requester asks for	To match requests to trips on the way, price them by the detour, show the requester where their item is, settle the money and decide disputes	Contract
Ponte (people carry for people between cities): what you ask to have carried (its tier, weight and sides, the declared value or, for an envelope, the amount and currency), the sender's photos of it on a scale, the traveller's photos of the contents laid out, the scale, the sealed package and its seal number, the receipt, the handover and the seal at the door, and for an envelope the two short videos of the notes being counted (at the meeting and at the door); the declarations the sender and the traveller sign; the check-ins and, only if the traveller agrees, their live position in the last stretch; for the ladder, a proof of address or a criminal-record certificate that a PalopGO operator looks at once and we then delete, keeping only the kind, the date it was seen and until when it is valid; where the owners switch screening on for envelopes, the result of a check against sanctions and politically-exposed-persons lists	To match a request to a traveller, make every party see what travels before it is sealed, decide disputes and approvals, keep everyone inside the law of both countries, and pay the traveller	Contract; legal obligation (customs and anti-money-laundering rules on cash); legitimate interest (safety; the proofs a dispute is decided on)
Já que vais and Boleia "Preciso de ajuda": who asked for help, when, on which request, what they wrote and, if they allowed it, where their phone was; for a ride, where the car was and its plate	To get help to a person who may be in danger	Legitimate interest (safety); vital interests
Boleia (rides, drivers): your vehicle (make, colour, plate, seats), photos of the vehicle and its plate (and of you, only if you choose to add one), photographs of your driving licence and insurance and of the documents your country asks to drive on demand (the ride permit, such as the TVDE certificate or the TfL licence, and the vehicle inspection) with their dates; where the law there allows it and only to drive on demand, a criminal-record check that a PalopGO operator looks at once and we then delete, keeping only the date it was seen, by whom, and until when it is valid (in the EU and the UK we never ask for it: the authority that issues the ride permit checks it); your attestation, your car's precise location about every 5 to 15 seconds while your trip is live and the app is open, the rides you drive and the ratings passengers give you, the ride calls you were sent and how you answered them (accepted, refused, missed), where your trips of the last 30 days started and ended, the tips you received, and the daily trips you save (from, to, weekdays, time)	To show passengers who drives and in which car before they accept, to check you may drive, to match and price rides, call you for rides that fit you (and pause the calls after missed ones), tell you when someone near where you usually pass needs a ride (you can switch this off in the app), pay you and decide disputes	Contract; legal obligation (licensing where the law requires it); legitimate interest (the alerts about rides near your usual way)
Boleia (rides, passengers): the pickup and drop-off you ask for, your window, how many seats, your rides, your ratings of drivers and theirs of you, the gender you declare (only if you choose to, for women-with-women rides), a trusted contact you choose to save, the daily rides you choose to save (from, to, weekdays, time) and the tips you give, whether you answered "Estás bem?" when the app asked, the meeting point you accepted, and, only in the last 300 metres before your pickup and only if you leave it on, your phone's precise location every few seconds (deleted when you are picked up, cancel, or the ride goes back to searching)	To match you to a driver going your way, show you the car, meet in a safe place, let the driver find you without calling, keep you safe on board and settle the money	Contract; consent (gender, trusted contact, the last 300 metres); legitimate interest (safety)
Boleia calls through PalopGO (masked): when you tap Ligar, your phone number and the other person's go to our telephony provider (Twilio) only to connect the call; neither of you sees the other's number, and we keep only who called and when, never the numbers or the call	To let a passenger and a driver reach each other without sharing their numbers	Legitimate interest (safety, the ride)
Boleia, your contact at night (Viagem segura): if you keep a contact on your Boleia profile, then by night (22:00 to 06:00), when a driver is confirmed for your ride, we make the ride's follow link: if that number has PalopGO we tell them there; otherwise your app offers to send it by SMS from your own phone. The driver never sees them. You can turn this off or clear the contact at any time	To help someone you trust follow your ride at night	Consent (you choose the contact and can turn it off)
Boleia calls inside the app: when you tap Ligar pela app, your voice and the other person's travel over mobile data through our call provider (LiveKit) for that call only; there is no phone number at all, the call is not recorded, and we keep only who called whom, when, how long and how it ended	To let a passenger and a driver talk without sharing any number	Legitimate interest (safety, the ride)
Conterrâneos: the island, province, region or district you say you come from, the city you live in (your PalopGO market), which of the two consents you chose (to be counted, to meet), that you said you are 18 or over, your short introduction, the proposals and conversations you take part in and the messages you write	To show you and others how many people of each land live in each city, to introduce you to people from your land who also asked, and to keep those conversations safe	Consent (you choose each part and can withdraw it at any time)
Conterrâneos "Pedir ajuda": who asked for help, in which conversation, what they wrote and that conversation's last messages with contact details masked	To get help to a person who may be in danger	Legitimate interest (safety); vital interests
Casa da Terra (hosts): your home's description, photos (with the moment and place each was taken), its exact location and address, the location readings you take inside it, your registration number, your calendar, your stays, your messages and reviews	To show your home, prove it is real and where you say, take bookings, pay you and keep guests and you safe	Contract; legal obligation (registration numbers where the law requires them)
Casa da Terra (guests): the stays you book, the dates and guests, your messages, problems you report and your reviews	To book, pay and protect your stay	Contract
Casa da Terra Mais (stays for someone else, the Pessoa na Terra, the Guardião, linked calendars): when you book a stay for someone else, the name and phone number you give us for them (we find their stay by that number when they sign in; with no PalopGO account nothing is sent to them, your phone offers to tell them); your answers on power and water in a review; as a host, the name and phone number of the person you name for a home and their share, the Guardião's visits (the checklist, the notes, the problems and the photos taken at the house, with the moment and place each was taken), the charges to your saved card (the amount, the date and the card's brand and last four digits: never its number), and the links of the calendars you add from other sites with the nights they hold; as a Pessoa na Terra, your answer, the stays of the homes you look after, your messages and the visits you make	To let the person a stay is for arrive, to let a host's person on the ground do what the host asked, to look after an empty house and report on it, to charge the Guardião's month, and to keep a home from being booked twice	Contract (the payer's and the host's); legitimate interest (the person named: to get them into the stay or the home they were named for)
Selo de Confiança: your photo (taken in the app at the moment) and its fingerprint (a short number computed from a photo, from which the photo cannot be rebuilt), what you proved, what you did (counts of completed orders, deliveries and stays), the reminders sent, the reports you make or that are made about you, and couriers' and deliverers' answers about stores	To show others what you proved, detect photos copied from someone else, keep fake profiles and scams out, and remind you of what is missing	Legitimate interests (safety of the people who meet through PalopGO); contract
Festa Gémea: the greetings you send (your first name, your city, what you wrote, when)	To show them on the festa's big screen and keep them free of abuse	Consent (you choose to send one)
Padrinhos: whether you are a newcomer or a padrinho, the land you come from, your languages, the month you came to the city, a short introduction, the journeys you are proposed or walk, the steps you tick, your messages, a thank-you, any request for help, and the paid errands you ask for or offer (the step, the day, the amount and how it was paid)	To introduce newcomers to settled people of the same land, keep both safe, and pay a padrinho for an errand	Consent (you choose to take part); legitimate interests (safety); contract (a paid errand)
Sócios da Terra: your profile (what you bring and seek, your sectors, the places, the stage, your hours), your claims and their proof, the photographs of a document while our team reviews it, who vouched for you and for whom you vouched, the suggestions, your conversations and the warnings on them, what you agreed, and any capital held	To suggest partners who complete you, show what is proven, keep fraud out and hold capital when it is available	Consent (you choose to take part); legitimate interests (preventing fraud); contract (capital held)
Couriers and store staff: the identity and right-to-work checks we carry out before you can work or be paid. Your identity document is checked by Stripe on Stripe's own page (no selfie is asked); we receive only the result (verified or not, and Stripe's reason code), never the document	To meet our legal and safety obligations	Legal obligation; contract
Next-step offers (Sinergias): when something of yours stands (a ticket, a stay, a consular appointment, a guide booking, a pickup order ready, a delivered order), what the offer needs from that record: the place and the time, the store, the size of the order and the reward, your answer, and the request we post on your yes through Boleia or Já que vais	To offer you the next step (a ride there and back, someone bringing your order, ordering again) and, if you say yes, to post that request for you as if you had typed it yourself	Legitimate interest (a next step in a service you are already using); contract for the request itself. You can decline any offer, and the owners can switch a rule, or all of them, off in your city. No provider sees an offer
Learning from what happens (ATENA): numbers about orders, deliveries, rides, offers and their answers, OLYMPUS alarms and the team's reviews of risk flags (durations, distances, counts, rates, amounts, the hour and the weekday, the ids of the records), kept per city; never your name, anything you wrote or a photo	To predict delivery and preparation times and who will accept an offer, to ask you less often, to rank the team's alarms and to join risk signals into a score. A score only opens a review by a person; no model refunds, blocks or sanctions anyone	Legitimate interest. No decision with a legal or similar effect is made about you automatically. Kept 180 days, then deleted; deleted with your account
Document reading (drivers): the photo of a document you send (driving licence, identity document, insurance certificate, vehicle paper) is read for its text (name, dates, number, plate, make and model) and the text compared with what you typed, only in cities where the owners switched document reading on	To check that what you typed agrees with your document; a difference opens a review by a person, never an automatic refusal	Legitimate interest (safety); contract. The photo is sent once to our AI vision provider and the reader keeps no copy; your face is never compared and no selfie is read
Stores: a photo of the store's menu, if the owner chooses to have the app read it: the photo is sent once to our AI menu reader to draft the items and prices, and is not stored by us or kept by the reader	To save the owner typing the menu	Consent (the owner chooses to send the photo)
Stores: business name, address, contact phone, menu and prices, the phone numbers of staff who use the app, and the store's public food hygiene rating, which we look up on the Food Standards Agency register	To list the store, route its orders and check it may sell food	Contract; legitimate interest (food safety)

Who sees your data

The store you order from sees your order and, for delivery, your address and phone number.
The courier delivering your order sees your delivery address, any landmark or access notes and your phone number, only while the delivery is active.
You see your courier's first name and live location while your order is on its way.
Sócios da Terra: the people you are suggested to and talk with see your first name, profile, claims with their proof and PalopGO record, and your seal; never your phone. The photographs of a document are seen by the PalopGO team only, and only while they review it.
Padrinhos: the person you are proposed to sees your first name, land, languages, time in the city, introduction and seal; never your phone. A request for help is seen by the PalopGO team, never by the other person.
Festa Gémea: anyone sees a festa's greetings with the first name and city of whoever sent each one, and how many tickets each city sold. Nobody sees who bought a ticket.
Selo de Confiança: anyone sees a store's seal and badges. The other person in a stay, a match, a Já que vais request or a Boleia ride sees your seal, your badges and your photo when it counts. A report, and who made it, is seen by the PalopGO team only; the person reported is never told who reported.
Casa da Terra: anyone sees a home's photos, description, area (rounded to about 500 metres), registration number and reviews, and the host's first name. A guest with a confirmed stay sees the exact address and how to get in from 48 hours before check-in. A host sees the first name of the guests who book. A request for help is seen by the PalopGO team, never by the other person. The person a stay was booked for sees the stay (the code, the address and the way in from 48 hours before), never what was paid; the host sees their name and who booked it. A host's Pessoa na Terra sees the guests' first names, the dates and the address of the homes they look after, and their own share; the guests see their first name. The Guardião's visit report and photos are seen by the host and the person who made the visit. A home's private calendar link shows only which nights are taken, never who stays; the links you add from other sites are read by PalopGO only, and the sites see a request from PalopGO.
Conterrâneos: anyone, signed in or not, can see how many people of each land live in each city, only when at least 5 do, never who they are. Someone you are proposed to sees your first name, your land and your introduction; the person you talk with sees your messages. A request for help is seen by the PalopGO team, never by the other person.
Boleia (rides): people asking for a seat see a trip as an anonymous icon at a point rounded to about 300 metres, with the driver's stars. From the moment a driver takes your ride you see their first name, photo, vehicle, colour and plate; once you accept them, the car's live location. The driver sees your first name, your standing as a passenger and, only once they take the ride, the exact pickup and drop-off (or the meeting point you accepted); in the last 300 metres, if you leave it on, where you are right now, until you are in the car. Someone you give the share link to sees both first names, the car, the plate and where it is, until two hours after the ride. A request for help, or an unanswered "Estás bem?", is seen by the PalopGO team, never by the other person.
Já que vais: people asking for an item nearby see a trip as an anonymous icon at a point rounded to about 300 metres, and only if the deliverer chose to appear on the map. The requester whose item is being carried sees the deliverer's first name, how they travel and their live location until the handover. The deliverer sees the requester's address and phone number only while carrying their item. A request for help is seen by the PalopGO team, never by the other person.
Our service providers, who process data for us under contract:
- Stripe (card payments, and identity checks for couriers and store owners)
- Twilio (sending sign-in codes by SMS or voice call)
- Apple (on an iPhone: delivering our notifications through the Apple Push Notification service, which receives the notification token and the notification's text; and Apple Pay, when you choose it to pay, which passes an encrypted payment token to Stripe, so we never see your card)
- LiveKit (carrying the audio of a Boleia call inside the app between the passenger and the driver; nothing is recorded)
- Railway (hosting of our service and database)
- Google (the maps shown in the app load map images from Google for the area on screen)
- Transport for London (for a Já que vais trip by public transport in London, the start and end of the trip, rounded to about 100 metres, to read the timetable; never a name or an account)
- OpenRouter and the AI model provider it routes to (Anthropic), only for a menu photo a store owner chooses to have read; the photo is processed once and not stored
- Google (Gemini), OpenRouter (and the model provider it routes to) and Anthropic, tried in that order until one answers, only for a document photo a driver sends where the owners switched document reading on; the photo is processed once and not stored
Authorities, where the law requires it.

We do not sell your data, and we do not show advertising.

Some of these providers are based outside the UK, including in the United States. Where your data is transferred outside the UK, we rely on the transfer safeguards in those providers' data processing terms.

How long we keep it

We keep your account data while your account is active. Order, payment and accounting records are kept for as long as UK law requires for financial records. Courier location points are kept as part of the delivery record. Your Conterrâneos land and consents are deleted the moment you choose "Esquecer a minha terra"; the messages of a Conterrâneos conversation are deleted 90 days after it closes. A festa's greetings are deleted 90 days after it ends. A Padrinhos journey's messages are deleted 90 days after it ends; a Sócios da Terra conversation's messages 90 days after it closes, and the photographs of a document as soon as it is reviewed (the verdict stays); leaving Padrinhos deletes your profile. Your Selo de Confiança photo is deleted from our store when you take it down or replace it; a photo's fingerprint is kept while the photo is in use, and the fingerprint of a copied photo is kept with the safety record, as are reports and the decisions on them. A Casa da Terra stay's messages are deleted 90 days after the stay closes; the stay, its payments and reviews are kept as part of the record. A Boleia trip's positions are deleted when the trip ends; the request keeps its milestones, its photos and its money records as part of the record. A Ponte request's proof photos and the two counting videos are deleted 180 days after the request closes (the owners may set a shorter term per city; the request keeps its milestones, its seal number and its money records); the traveller's live positions are deleted at the handover; a proof of address or a criminal-record certificate is deleted the moment an operator decides on it. When data is no longer needed, we delete or anonymise it.

Deleting your account

You can delete your account in the app, or on the PalopGO website after signing in with your phone number. We then remove your phone number, saved addresses and devices from your account and sign you out everywhere. Records of past orders and payments are kept, without your phone number or address, for as long as UK law requires for financial records.

Cookies

The PalopGO website uses a small number of cookies to remember your preferences (such as theme, market and light mode) and, for staff, to keep you signed in. We do not use advertising cookies.

Your rights

Under UK data protection law you can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable form. Email bridge@bridge-digital-solution.com from, or mentioning, the phone number on your account. We answer within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

If we change this policy we will update the date above, and tell you in the app if the change is significant.