Privacy Policy

The data controller for personal data processed through Patuva is DSU Blacksmith DOOEL Skopje, ul. Salvador Aljende br. 4, Skopje, North Macedonia. For any privacy request or question, contact us at privacy@blacksmith.works.

We collect the following categories of personal data:

• Account data: your name, email address, phone number and password (the password is stored only as a secure hash, never in plain text).
• Role: whether you act as a driver or a passenger.
• Gender: optional and self-declared. It is used solely to enable and enforce women-only rides and is never shown on your public profile. You can change or clear it at any time.
• Profile photo: optional. If you add one, it is shown on your profile and trips to other users. Photos are re-processed on upload to remove embedded metadata such as location.
• Referral data: your invite code, the code you signed up with (if any), and the fee-waiver credits on your account.
• Driver vehicle details: information about the vehicle you use to offer trips.
• Trip, booking and Road Trip data: the trips you publish or join, requests, approvals and related history.
• City and route selections: the origins, destinations and routes you choose.
• Device push-notification tokens: used to deliver notifications to your device.
• Usage and diagnostic data: basic information about how the app is used and technical/crash diagnostics.

We do NOT store card numbers.Card payments for the Platform Fee are processed by our acquiring bank's PCI-DSS-compliant gateway (Halkbank / CaSys cPay). Patuva only receives a payment result and a reference identifier confirming whether the payment succeeded. We never see or hold your full card details.

We use your personal data to:

• operate and maintain the Platform;
• match drivers and passengers for rides;
• process the Platform Fee and confirm payment;
• send you notifications relevant to your trips and bookings;
• detect, prevent and address fraud, abuse and security issues; and
• improve and develop the app.

Some features let you make limited information visible to others, including people without a Patuva account:

• Trip share links: when you choose to share a trip, we generate a private web link. Anyone who has the link can see the route, date, time, the driver's first name, vehicle and rating. It never reveals phone numbers, email addresses or other passengers. You can turn the link off at any time, and it stops working once the trip is cancelled or over.
• Public Road Trip pages: Road Trips are public listings and have a shareable web page showing the title, route, dates, host first name and available spots.
• Public profile: your name, profile photo, ratings, reviews and trip counts are visible to other signed-in users.

These pages are marked so search engines do not index them, but anyone you send a link to can open it.

We share data with carefully selected service providers who process it on our behalf. Some of these providers may process data outside North Macedonia:

• Railway: hosting infrastructure.
• Firebase Cloud Messaging by Google: push notifications.
• Sentry: crash and performance diagnostics.
• MapTiler / CARTO / OpenStreetMap: maps and mapping data.
• Resend: transactional email.
• CaSys / Halkbank: payment processing.

Some of our service providers are located outside North Macedonia. Where personal data is transferred internationally, we rely on appropriate safeguards to ensure that your data continues to receive an adequate level of protection in accordance with applicable law.

We process personal data on the following legal bases:

• Performance of the contract: to provide the Platform and the services you request.
• Legitimate interests: to keep the Platform secure and to prevent abuse and fraud.
• Consent: for example, to send push notifications, where consent is required. You may withdraw consent at any time.

We keep personal data only for as long as it is needed to provide the service to you and to comply with our legal obligations. When data is no longer required, we delete or anonymise it.

We apply appropriate technical and organisational measures to protect your data. These include hashing of passwords, encryption of data in transit, and the principle that no card details are stored by Patuva.

Under the North Macedonian Law on Personal Data Protection (aligned with the GDPR), you have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request erasure of your data;
• request restriction of processing;
• object to processing;
• data portability; and
• lodge a complaint with the Agency for Personal Data Protection of North Macedonia (АЗЛП).

To exercise any of these rights, email us at support@blacksmith.works. We will respond in accordance with applicable law.

You can delete your account and personal data at any time from Profile → Delete account in the app, or by submitting your account email on our account deletion page. Deletion removes your profile, contact details, vehicle, upcoming trips, ride requests and the reviews you wrote.

Records of completed bookings and payments are kept in a de-identified form for the period required by accounting, tax and fraud-prevention law, and are no longer linked to your profile. You must cancel or complete any active bookings before deleting.

Patuva is not intended for and may not be used by anyone under the age of 18. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time; the effective date above will reflect any changes. For any privacy question or request, contact DSU Blacksmith DOOEL Skopje at privacy@blacksmith.works.