1. Who We Are

BookU Hub ("we", "us", "our") is the trading name of Jose Carrolo, a sole trader based in Edinburgh, Scotland, United Kingdom. We operate the BookU Driver platform, a booking and dispatch management tool for licensed private-hire and taxi drivers, and we are the data controller for the personal data described in this policy. Contact: support@bookuhub.com. Our business address is available on request.

2. Data We Collect

We collect information you provide directly, including: full name, email address, phone number, vehicle details, driver licence and badge numbers, DBS certificate details, insurance documents, MOT certificates, and payment information. We also collect: booking data; income and expense records you enter in your logbook (amounts, categories, receipts and supplier statements — this is your own personal record-keeping, not a fiscal or tax-invoicing system); and live GPS location data when tracking is active on a job. We only collect location while a trip is in progress or when you have live tracking enabled, and you can turn it off at any time.

3. How We Use Your Data

We use your data to: provide and improve the BookU Hub platform; process payments via Stripe; send booking confirmation and status emails; verify your identity and documents; comply with legal obligations; and communicate important platform updates.

4. Legal Basis (UK GDPR)

We process your personal data under the following lawful bases: Contract – to perform the service you signed up for; Legitimate Interests – to improve our platform and prevent fraud; Legal Obligation – to comply with applicable laws; Consent – where you have explicitly opted in.

5. Data Sharing & Processors

We do not sell your personal data. We share data only with processors necessary to operate the service, including: Stripe (payments), Resend (transactional email), and Base44 (platform infrastructure). Base44 routes AI assistant requests to third-party model vendors — OpenAI, Anthropic and Google — for inference only. Our Data Processing Agreement with Base44 is publicly available at base44.com/dpa, with the current sub-processor list at base44.com/dpa/exhibitc. Third-party AI model vendors (OpenAI, Anthropic, Google) process your data for inference only and do not use it to train their general models. However, Base44 itself uses customer data to train its own internal models; on our current Base44 plan there is no opt-out from this (opt-out is available on the Enterprise plan). See section 6 for how this applies to Co-Pilot.

6. AI Assistant (Co-Pilot)

The WhatsApp Co-Pilot is an AI assistant that helps manage your bookings, flights, logbook and customer messages on your behalf. When you connect it, you consent to it reading and acting on your data. Under the EU AI Act (Article 50, in force 2 August 2026), Co-Pilot always identifies itself as an AI at the start of any conversation. Co-Pilot is powered by third-party model APIs (OpenAI, Anthropic, Google) used for inference only — those vendors do not train their general models on your conversation or account data. Important: our platform provider Base44 uses customer data to train its own internal models, and on our current Base44 plan there is no opt-out (an opt-out is available on the Enterprise plan). This means your Co-Pilot conversations and account data may be used by Base44 to improve its own models. The allocation of 'provider' versus 'deployer' roles for Co-Pilot under EU AI Act Article 50 is a legal determination that depends on your circumstances; we recommend seeking independent legal advice if this matters to you.

6b. Google Calendar & Google User Data

If you choose to connect your Google Calendar, BookU Driver requests access to (a) read your calendar events (calendar.readonly) so we can show your personal events alongside your bookings and warn you about clashes before you accept a job, and (b) create, update and delete events (calendar.events) so your BookU bookings are added to, kept in sync with, and removed from your Google Calendar. We only access calendar data to provide these features to you. We do not sell Google user data, do not use it for advertising, do not use it to train AI or machine-learning models, and do not share it with third parties except our infrastructure provider (Base44) as needed to run the feature. Humans do not read your calendar data unless you ask us for support, it is required for security reasons, or the law requires it. BookU Driver's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect Google Calendar at any time in the app or at myaccount.google.com/permissions; when you disconnect, we delete the stored access tokens and stop syncing.

7. Data Retention

We retain your data for as long as your account is active, plus any period required by law (e.g. tax records for 6 years). When you delete your account, personal data is removed within 30 days except where retention is legally required.

8. Your Rights

Under UK GDPR and the EU GDPR you have the right to: access your personal data; correct inaccurate data; erase your data ('right to be forgotten'); restrict or object to processing; data portability; and withdraw consent at any time. You can export or delete your own income/expense records and live-location history from your account settings at any time. To exercise any right, contact us at support@bookuhub.com.

9. European Users & International Transfers

BookU Hub (Jose Carrolo, sole trader) is based in the UK. Where we process the personal data of drivers in the EU/EEA (for example drivers in Portugal, Spain or France), that processing is governed by the EU GDPR, and an adequacy decision or appropriate safeguards apply to any transfer to the UK. International transfers to our processors rely on the EU-US Data Privacy Framework, Standard Contractual Clauses (Modules 2 and 3), and applicable adequacy decisions. By default, app data is stored on US-based servers. EU data residency for app data and user records may be available depending on the platform plan (storage location only — not where data is processed; media files, account details and billing data remain in the US). Once we have EU/EEA users we will appoint an EU representative under GDPR Article 27; until then, queries can be directed to support@bookuhub.com.

10. Cookies

We use essential cookies required for the platform to function. We do not use advertising or tracking cookies. You can control cookies through your browser settings.

11. Security

We use industry-standard measures to protect your data including TLS encryption in transit, access controls, and regular security reviews. No system is 100% secure — please use a strong, unique password.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes by email or an in-app notice. Continued use of the platform after changes constitutes acceptance.

13. Contact

For any privacy questions or to exercise your rights, contact us at: support@bookuhub.com