Convoy

Privacy notice

Version 2026-10. This notice covers the UK GDPR and Data Protection Act 2018, the EU GDPR, and US state privacy laws, including the CCPA/CPRA.

Who we are

Convoy is run by Joe Bishop, trading as Convoy, 39a Ernest Road. As a sole trader, Joe Bishop is the data controller for the personal data described here.

What we collect

  • Account holders: email address, display name, password (stored only as a salted hash), two-step verification settings, plan, and when you accepted our terms.
  • Everyone in an event, including guests without an account: the name you enter, whether you're coming, how you're travelling, arrival time, the general area you're coming from, seats offered, pickup times and any note you add. A driver or host can add your name to a pickup list.
  • Payments: handled by Stripe. We hold only a Stripe customer ID and subscription status, never card numbers. Paid plans are UK-only, so we check that your billing address and the country that issued your card are in the UK. Both are kept with your subscription as a record of where we sold it.
  • Messages you send us through the contact form or by email: your name, email address and what you write. We use them only to reply to you.
  • Security records: sign-ins, password and security changes, with a truncated IP address (the last part removed).
  • Technical logs: errors and performance data from Azure Application Insights, with IP addresses masked.
  • Advertising (events on the Free plan only): our ad partner, Google, collects device and browser information, your IP address, cookie or device identifiers, and which Convoy pages you view. Google uses this to show, measure and (if you allow it) personalise ads. Ad networks can't see who's in an event or their travel plans: event pages are blocked from ad crawlers and only open with an invite link.
  • Ad measurement (only if you allow it): if you arrive from one of our Google ads and agree when we ask, Google's tag records the ad click on Convoy's public pages and, if you then create an account and confirm your email, that one sign-up happened. Google receives device and browser information, your IP address, cookie identifiers and the ad click ID. It isn't told your name, email address or anything about your events, and the tag never runs on event, account or billing pages.

We don't use analytics cookies, and we don't buy data about you. Ads never appear on sign-in, account or billing pages, or in events hosted on a paid plan.

Why we use it, and our lawful basis

  • To provide the service you asked for, such as showing your event, arrivals and lifts to your group: performance of a contract (UK/EU GDPR Art. 6(1)(b)).
  • To keep the service secure, prevent abuse, and investigate incidents: legitimate interests (Art. 6(1)(f)).
  • Billing and tax records: legal obligation (Art. 6(1)(c)).
  • Service emails (confirming your email, password resets, security alerts): contract and legitimate interests. We don't send marketing.
  • Ads and ad cookies: in the UK, EEA and Switzerland, your consent (Art. 6(1)(a) and PECR/ePrivacy), collected through Google's certified consent message. You can withdraw it at any time on Your privacy choices. Elsewhere: legitimate interests in funding a free service, with an opt-out.
  • Ad measurement: your consent (Art. 6(1)(a) and PECR/ePrivacy), everywhere. You can withdraw it at any time on Your privacy choices.

We don't make automated decisions about you that have legal or similarly significant effects.

Who can see it

Anyone with an event's link can see that event's details, including names and travel plans. Only share links with the people you're meeting. We share data with these processors under written contracts:

  • Microsoft (Azure): hosting, database, email delivery, and monitoring. Data is hosted in the UK/EU region we deploy to.
  • Stripe: payment processing for paid plans.
  • Google (AdSense): advertising on Free-plan events. Google acts as an independent controller for personalised ads, under its own privacy policy. Google may pass data to other ad buyers in the auctions it runs.
  • Google (Google Ads): measuring which of our ads lead to sign-ups, only if you allow it. Google acts as an independent controller for this data, under its own privacy policy.

Where data leaves the UK/EEA, for example to a US-based processor, we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or the EU-US / UK-US Data Privacy Framework, as appropriate.

US state privacy laws: letting Google show personalised ads, or measure which of our ads led to a sign-up, may count as "selling" or "sharing" personal information, or "targeted advertising", under the CCPA/CPRA and similar laws. The categories involved are identifiers (cookie or device IDs, IP address) and internet activity on Convoy, disclosed to Google and its ad partners. You can opt out at Do Not Sell or Share My Personal Information. We also honour Global Privacy Control browser signals as an opt-out. We don't sell or share data about anyone we know is under 16.

Inside Convoy, only the operator named above can see account and event details. They look at it only when needed to give you support, deal with abuse reports, handle billing, or meet a legal obligation. Every such look and every change is recorded in a security log.

How long we keep it

  • Events and everyone's details in them are deleted automatically 7 to 365 days after the event, depending on the host's plan. Hosts and participants can delete them sooner.
  • Accounts that never confirm their email are deleted after 7 days.
  • Security records are kept for 12 months.
  • Support messages are kept in our inbox for up to 2 years after we last hear from you, then deleted.
  • Your account is kept until you delete it. Billing records are kept for 6 years to meet tax law.
  • Backups expire on a rolling basis, within 35 days.
  • Ad cookies set by Google last up to 13 months, and ad measurement cookies 90 days. See the cookie policy.

Your rights

You can access, correct, delete or port your data, and object to or restrict how we use it. Account holders can do most of this themselves on the Account page, which has Download my data and Delete my account. Guests can edit or remove their own entry from the event page. For anything else, use the contact form and choose "Privacy". We'll respond within one month.

US residents (including California): you have the right to know, delete and correct your personal information, and to opt out of the sale or sharing of it, and we won't discriminate against you for using these rights. Use the same methods above, or email us. An authorised agent may act for you.

You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority. We'd appreciate the chance to help first.

Children

Accounts are for people aged 16 and over. Convoy isn't directed at children under 13, and we don't knowingly collect their data. If you think a child has given us data, contact us and we'll delete it.

If a host's events are mainly for under-16s (for example, a youth sports team), they should use a paid plan, which has no ads.

Security

See our security overview. In short: data is encrypted in transit (TLS 1.2+) and at rest, access follows least privilege, and we notify the regulator and affected people of qualifying personal data breaches within the legally required time.

Changes

If we make material changes, we'll update the version above and tell account holders by email.