Privacy Policy · Gashtiq

1. Who we are

Gashtiq is operated by AllSaferAI OÜ, a company registered in Estonia under registry code 17591726, with its registered address at Tartu mnt 67/1-13b, Tallinn 10115, Estonia.

AllSaferAI OÜ is the data controller for the personal data described here, under the EU General Data Protection Regulation (GDPR). You can reach us about anything on this page at privacy@allsaferai.com.

2. What this policy covers

This policy covers the Gashtiq website (gashtiq.com), the Gashtiq mobile app for Android and iOS, and the tools bus companies use on Gashtiq to run their trips.

Gashtiq sells tickets for trips run by independent bus companies. When you book, the bus company receives the passenger details it needs to carry you. The company uses them under its own responsibility, as a separate controller. How cookies are used on the website is explained in detail in our Cookie Policy.

3. The data we collect

We collect only what we need to sell and manage your ticket. Most of it you give us yourself.

Your account

Sign-in: your email address and password. We never see your password — only a scrambled (hashed) version is stored.
Profile: your name, phone number, gender, preferred language and, if you add one, a profile photo.

Bookings

Booking contact: name, phone number, email address, and whether you are booking for someone else.
Each passenger: name, gender, phone number and national ID number.
The trip: route, date, seat numbers, boarding and drop-off stops, price, booking reference and ticket status (for example paid, cancelled, checked in).

Saved passengers

If you save travellers to book faster next time, we keep their name, gender, phone number, date of birth, nationality and ID number until you remove them.

Alerts, notifications and reviews

Your notification choices — which messages you want by email, SMS or WhatsApp.
Route alerts you set up: the cities, the travel date, and whether to tell you about new trips or price drops.
Reviews you write about a trip or a bus company.

Payments

You pay from your Gashtiq balance. When you add money, we store the amount, the payment method, the request code, its status, the phone or account number you sent from and the transaction number if you give one. For a card we keep only the last 4 digits. Only Gashtiq staff who check top-ups can see these details, and only to match your transfer. We never ask for a screenshot, your card PIN or your banking password. We store every balance movement — top-up, ticket, refund — as an accounting record.

Device and usage data

When you use the website or app, our hosting providers record technical data such as your IP address, browser or device type and the time of each request. We use it to keep the service secure and working. Analytics and marketing cookies are used on the website only if you agree to them — see the Cookie Policy.

Bus company staff and drivers

Bus companies enter details about their own staff and drivers — such as name, email, phone number, role, and for drivers their national ID, licence number and expiry, photo and languages. The company decides how this data is used, and we process it on its behalf to run the partner tools.

4. Why we use your data and our legal basis

To run your account and your bookings — hold your seat, issue your ticket and QR code, send confirmations, trip reminders and cancellation notices, and handle refunds. Basis: performance of our contract with you (GDPR Article 6(1)(b)).
To give the bus company its passenger list — the company needs each passenger's name, gender, phone and ID number to check identity at boarding and to prepare the passenger list for the trip, which can be checked on the road and at border crossings. Basis: performance of the contract (Article 6(1)(b)).
To apply seating rules — some bus companies do not seat passengers next to a stranger of the opposite gender. We use the gender you give for each passenger only to apply that rule and to show the company who is on board. Basis: performance of the contract (Article 6(1)(b)).
To send route alerts you asked for, by the channels you chose. Basis: performance of the contract (Article 6(1)(b)). You can turn alerts and each channel off at any time in your account.
To keep Gashtiq safe and working — prevent fraud and misuse, fix errors, and understand in general terms how the service is used. Basis: our legitimate interest in running a secure, reliable booking service (Article 6(1)(f)).
To meet our legal duties — keep accounting records and answer lawful requests from authorities. Basis: legal obligation (Article 6(1)(c)).
Analytics and marketing cookies on the website. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time.

We do not sell your personal data. We do not make decisions about you based only on automated processing that have legal or similarly significant effects.

5. Who we share your data with

The bus company running your trip — it sees the booking contact, the passenger details and the seats for its own trips only. It may also need to show the passenger list to authorities on the route.
Payment providers — only when online payment is available: First Iraqi Bank (FIB) and QiCard would process those payments under their own privacy policies, and receive what is needed to take the payment, such as the amount and booking reference.
Service providers who work for us — they process data only on our instructions:
- Supabase, Inc. — database, sign-in and file storage, on servers in Frankfurt, Germany (EU).
- Vercel Inc. — hosting of the website.
- Expo (650 Industries, Inc.) — building the mobile app and delivering app updates.
- Email, SMS and WhatsApp providers that deliver the messages you have chosen to receive.
- WhatsApp (Meta) — sending verification codes to your phone number.
Analytics and advertising providers — Google, Meta, TikTok and LinkedIn, only if you consent to those cookies on the website. The details are in the Cookie Policy.
Authorities — when the law requires it, or when it is needed to protect someone's safety or to defend a legal claim.

6. Where your data is stored and international transfers

Our database is hosted in the European Union, in Frankfurt, Germany. Some data leaves the European Economic Area:

To bus companies in Iraq (and payment providers, when online payment is available) (and, on international routes, the countries the trip passes through). There is no EU adequacy decision for these countries. The transfer is necessary to carry out the booking you asked for, including a booking made for someone else in their interest (GDPR Article 49(1)(b) and (c)).
To service providers based in the United States (Vercel, Expo, Supabase support, WhatsApp (Meta Platforms, Inc.) when we send you a verification code, and — with your consent — the analytics and advertising providers). Where the provider is certified under the EU–US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision of 10 July 2023. Otherwise it relies on the Commission's Standard Contractual Clauses (Decision (EU) 2021/914).

You can ask us for a copy of the safeguards used for any transfer at privacy@allsaferai.com.

7. How long we keep your data

Account and profile: for as long as you keep your account.
Saved passengers, route alerts and notification choices: until you delete them or close your account.
Bookings and payments: booking and payment records are accounting records, which Estonian law requires us to keep for 7 years after the end of the financial year they belong to. If you delete your account, we remove the personal details from them, as described in section 9.
Balance records and top-up details: accounting records, kept for 7 years after the end of the financial year they belong to.
Seat holds: a seat you have selected is held for 10 minutes while you check out, then released.
Technical logs: for a short period set by our hosting providers, normally no longer than 90 days.

8. How we protect your data

All traffic to Gashtiq is encrypted (HTTPS).
Database access rules make sure passengers see only their own bookings, and each bus company sees only bookings for its own trips.
Passwords are stored only as a hash.
In the mobile app, your sign-in token is kept in your phone's secure storage (Keychain on iOS, Keystore on Android), not in plain files.
Only staff who need it for their work can reach personal data.

9. Your rights

Under the GDPR you have the right to:

access the data we hold about you and get a copy of it,
have inaccurate data corrected — you can change most of it yourself in your account,
have your data erased, including closing your account,
have processing restricted,
object to processing based on our legitimate interests,
receive your data in a portable, machine-readable format,
withdraw your consent at any time, without affecting what happened before you withdrew it.

To use any of these rights, write to privacy@allsaferai.com from the email address on your account, so we can confirm it is you. We answer within one month.

Deleting your account

How to ask: Delete your account. When your account is deleted, we delete:

your profile: name, email address, phone number, gender, language and photo
your password and sign-in details
saved passengers
route alerts and notification choices
reviews you wrote
the names, phone numbers, email addresses and ID numbers on your past bookings

For each past booking we keep only the booking reference, price, date and bus company. Estonian accounting law requires us to keep these records for 7 years after the end of the financial year. They are no longer linked to your name or contact details.

If you still have money in your Gashtiq balance, or a top-up being checked, contact support before deleting your account so we can settle it.

Complaining to a supervisory authority

If you think we have handled your data wrongly, you can complain to the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon
Tatari 39, 10134 Tallinn, Estonia
info@aki.ee

You may also complain to the supervisory authority of the EU country where you live or work.

10. Booking for someone else

If you book a ticket for another person — for example a family member in Iraq — you give us their details. Please only do this with their permission, and tell them about this policy. We use their details only for that booking, as described in this policy.

11. Children

Gashtiq accounts are for people aged 18 or over. A parent or guardian can book a ticket for a child and gives the child's details for that booking. We do not knowingly create accounts for children.

12. Changes to this policy

We update this policy when the data we collect or the way we use it changes, or when the law changes. The date at the top always shows the current version. If a change is important, we will also tell you by email or in the app before it applies.

13. Contact

Privacy questions and requests: privacy@allsaferai.com. Other legal matters:

legal@allsaferai.com