What RailUp stores about you, why, who helps us, how long we keep it, and how to download or delete it.
Who is responsible
RailUp Technologies, S.L. (Barcelona, Spain) is the controller of your personal data. Contact: privacy@rail.molasroca.com.
For payment and e-money data, the licensed institution we act for is also a controller; its privacy notice applies to that part.
What we store
Account: your email, name, @tag, language, the date you joined and your verification level.
Passkeys: the public part of each passkey and a device label (for example "iPhone · Safari"). Your face or fingerprint never leaves your phone; we never see it.
Identity verification: the result, the vendor's reference, the document type and the issuing country. Photos of your ID and your selfie are processed by the verification vendor; RailUp never stores them.
Consents (which document version you accepted, and when) and a security log (sign-ins, passkeys added or removed, verification steps, data exports).
Payment requests: who asked whom, the amount, currency and note, its status and, once paid, the payment reference. The person you ask sees your name and @tag; people can find you by your @tag (not by your name).
Payment methods: the ways you (or a business you own) pay and get paid — for a bank account the IBAN, for Bizum the phone number, for Revolut, Wise and PayPal the tag or email, for a card only its brand and last four digits (never the number or security code). Screens show them masked.
Map listing: a business owner who chooses to appear on the RailUp map publishes the business's name, kind, city, address (optional), a pin they place themselves and its @handle to everyone signed in to RailUp, and can remove it at any time.
Business accounts: the businesses you belong to (name, type, city, tax ID if given), your role in each, and invitations sent to an email address (the address, role and expiry, 14 days). A business has its own @handle, from the same pool as people's tags, and payment requests to and from it are visible to all its members. Members of a business see each other's name and @tag there, and nothing about each other's personal accounts.
Notifications: if you turn them on, each device's push address and its encryption keys (from your browser's push service), and a device label.
Table bills: when you join a table's bill from your phone, the first name you give, the dishes you claim, the split and tip you choose, and your payment's amount and reference. No account is needed; the other guests at that table and the venue see your name. Counter orders at a café or bar work the same way: the items you order and your pickup number are kept with the order, and if you are signed in the venue can notify you when it is ready.
Support: our staff can look up your account to help you (never your ID photos, passkey secrets or full payment identifiers). They see your account details, verification result, sign-in security history and recent payment requests; every look-up and every change (for example pausing money movement for security) is recorded in a staff log, and support notes and cases about you are deleted with your account.
On your device only: settings such as the language, hiding your balance, which digital assets you use, and shared-expense groups.
Why, and on what basis
To provide the service you signed up for (GDPR art. 6.1.b).
To meet legal obligations: identity verification, sanctions screening and record keeping under anti-money-laundering law (Ley 10/2010) (art. 6.1.c).
To keep accounts secure and prevent fraud, for example the new-device pause (legitimate interest, art. 6.1.f).
Your face is compared with your ID only with your explicit consent, given in the verification flow (art. 9.2.a).
We don't sell your data, don't use it for advertising, and don't make decisions about you by automated means alone that have legal effects without human review.
Who helps us
Supabase (database and sign-in; servers in Frankfurt, EU). Cloudflare (hosting and network security). Resend (sends the sign-in code emails). Stripe (card payments: your card details go straight to Stripe and RailUp never sees them; during the pilot, test mode only). The identity-verification vendor and the licensed payment institution (both to be named before launch).
Your browser fetches exchange rates from open.er-api.com and digital-asset prices from CoinGecko directly; those services see your IP address but nothing about your account.
The map of businesses draws its tiles from OpenStreetMap (tile.openstreetmap.org), which sees your IP address and the area of the map you view, nothing about your account. "Near me" uses your phone's location only inside your browser, to sort the list; RailUp never receives or stores it.
While you're on a table's bill, or signed in, your phone connects to Supabase's real-time service to receive the bill's updates or a signal that a payment request changed. That connection carries no account data or sign-in; the app then fetches the details from our server.
Notifications travel through your device's push service (Google for Chrome and Android, Mozilla for Firefox, Apple for Safari). They are end-to-end encrypted: the push service can't read them.
Where a provider processes data outside the EEA, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
How long we keep it
Account data and payment requests: until you delete your account. A business account lasts until its owners delete it or the last owner deletes their login; unanswered invitations are removed after 14 days.
Identity-verification records: 10 years after the account ends, as anti-money-laundering law requires; then they are erased. During that time your former @tag can't be taken by someone else.
Consents, the security log and the staff log of what staff did on your account: kept as proof, with the link to you removed when you delete your account.
Sign-in codes expire after 10 minutes.
Table bills: how long closed bills and guest names are kept will be set with counsel before launch, alongside the payment records the law requires us to keep.
Your rights
Download your data (access and portability) and delete your account (erasure) yourself in Account → Privacy and your data.
For correction, restriction or objection, write to privacy@rail.molasroca.com. We answer within one month.
You can complain to the Spanish data protection authority, the AEPD (aepd.es), or the authority where you live.