Privacy Policy

1. Who is responsible

The controller is [Company legal name], [UIC / ЕИК], [Registered address]. Write to [contact email] about anything in this policy or to exercise your rights.

Customers and carriers who use Viara are separate controllers of the personal data they receive from each other for a transport (for example a driver's name or a delivery contact), and must use it only for that transport.

2. What we collect

• Account details: your name, company name, email address, phone number, role (customer or carrier), password (stored only as a hash) and, if you turn it on, two-factor authentication settings.
• Company and verification details for carriers: company registration, transport licence, insurance, driver and fleet information, and the documents you upload to prove them.
• Transport details: listings, routes, collection and delivery addresses, vehicle details (including registration and VIN), quotes, messages between the parties, agreements and the names and times of their signatures.
• Handover records: inspection photos with the time and the device's location when each photo was taken, marked damage, notes, and the signatures drawn at collection and delivery, with the signer's name. Shared vehicle locations, when the carrier chooses to share them.
• Payment details: amounts, fees, payment status and the references of payments, refunds and payouts. Card and bank details are entered with our payment provider, Stripe, and are not stored by Viara. Carriers complete identity and bank checks for payouts directly with Stripe.
• Disputes, reports and reviews: what you write, the evidence you add and how operations decided.
• Technical data: the session cookie that keeps you signed in, sign-in and security events (for example failed sign-ins), notification settings and, if you allow them, push notification subscriptions. Our hosting provider records IP addresses in server logs.
• Usage events: which steps of the service are used (for example that a price estimate was shown), to improve Viara. They are not used for advertising.

3. Why we use it and on what legal basis

• To provide the marketplace: your account, listings, quotes, messages, agreements, inspections, payments, payouts and notifications. Basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To check carriers before they can quote, and to keep records that both parties can rely on in a dispute. Basis: our legitimate interest in a safe, trustworthy marketplace (Art. 6(1)(f)).
• To prevent fraud and payment outside Viara: contact details written in messages before a transport is paid may be blocked or hidden automatically. Basis: legitimate interest (Art. 6(1)(f)).
• To keep accounting and tax records. Basis: legal obligation (Art. 6(1)(c)).
• Optional emails such as load alerts, and push notifications. Basis: your choice in the notification settings, which you can change at any time.

Viara does not make decisions that have legal or similarly significant effects on you solely by automated means.

4. Who we share it with

The other party to your transport sees what it needs for that transport. Exact addresses and contact details are shared only once both parties have signed the agreement and the payment through Viara has been made. Operations staff at Viara can see transport records to verify carriers, support users and decide disputes.

We use these service providers, who process personal data on our behalf under data processing terms:

• Stripe (payments, payouts and carrier identity checks); Stripe is also a separate controller for the checks it is legally required to make.
• Vercel (hosting of the application, EU region Frankfurt).
• Neon (database, EU region Frankfurt).
• Cloudflare (storage of uploaded files and photos).
• Resend (sending email).
• MapTiler (map tiles; your browser requests them directly, which shares your IP address).

Some of these providers are based in, or may access data from, the United States. Transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. We may also disclose data where the law requires it, or to establish or defend legal claims.

5. How long we keep it

• Agreements, handover records, disputes and payment records: 10 years after the end of the transport, for accounting and to establish or defend legal claims.
• Messages between the parties: 3 years after the end of the transport.
• Account and verification details: while your account is open; after you close it, we delete or anonymise them within 30 days, except what must be kept under the rows above.
• Security events and server logs: up to 12 months.

6. Your rights

You may ask for access to your personal data, its correction or deletion, restriction of processing, and a copy in a portable format; you may object to processing based on legitimate interests, and withdraw any consent at any time. To close your account or exercise a right, write to [contact email]. We answer within one month.

You can also complain to the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg) or to the supervisory authority where you live or work.

7. Cookies and local storage

Viara sets one strictly necessary cookie, veyra_session, which keeps you signed in. Your browser's local storage remembers choices such as your language and which guided tours you have seen. We use no advertising or third-party tracking cookies, so we do not ask for cookie consent.

8. Security

Data is encrypted in transit, passwords are stored as hashes, sign-in attempts are rate-limited, two-factor authentication is available, and operations accounts must use it. Queued emails are encrypted at rest. Tell us at once at the address above if you suspect your account has been misused.

9. Changes

We will post any change to this policy here with its new date, and tell you in Viara or by email when a change matters to you.