RevUp Privacy Policy
Version 1.0 · Last updated 14 October 2026
Operator and data controller
RevUp369 ApS (trading as "RevUp")
CVR 45069958 · VAT DK45069958
Carl Blochs Gade 59, 1. mf, 8000 Aarhus C, Denmark
Website: https://revup369.com · Email: [email protected]
1. Who we are
1.1 RevUp369 ApS is the data controller for the personal data described in this policy. RevUp is a marketplace where people book parking, rideshare seats and local services from each other. The Terms of Service at https://revup369.com/terms explain how the marketplace works.
1.2 Contact us about privacy at [email protected]. We have not appointed a data protection officer, because the law does not require one for a company of our size and type of processing.
1.3 This policy covers the RevUp app (iOS, Android and web) and the website revup369.com.
2. The short version
- We collect what we need to run your account, your bookings and your payouts, and what the law makes us keep.
- Payments go through Stripe. We never see or store your full card number.
- Identity checks go through Stripe Identity. We do not store images of your identity documents.
- We do not sell your data. We do not use it for advertising. We send only service messages, not marketing.
- We do not keep a history of where you have been.
- You can download a copy of your data or delete your account from Profile, then Privacy & data.
3. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, sign-in method (email, Google or Apple), sign-in times, active sessions (device type/browser and IP address) | You, Google or Apple, your device |
| Profile | Name, phone number, date of birth, profile photo, address, bio, role profiles (e.g. as a driver or service provider) and any certifications you add. We keep a history of changes | You |
| Identity verification | Whether you are verified, when, the Stripe session reference, and the last error code if verification failed. Not the document images, document numbers or selfie — Stripe keeps those | Stripe Identity, our support team (manual verification) |
| Tax profile (providers) | Private or business, legal name, date of birth, address, CVR number, VAT number, and your CPR number when the law requires it (stored encrypted; the app only ever shows its last 4 digits) | You |
| Listings | Parking spaces (address, coordinates, photos, availability, price), rides (route stops, times, seats, vehicle photo), jobs and bids | You |
| Location and addresses | Addresses and coordinates of listings, ride stops and booking locations. If you allow it, your device location is used to show nearby results and fill in addresses. We do not record a location history | You, your device |
| Bookings | Who booked what, when, status, price, extensions, cancellations, booking credit, and any problem reports with photos | You and the other party |
| Payments and payouts | Ledger of amounts, wallet balance, payment events (with the payment method type, e.g. "card"), refunds, payment disputes, payouts, whether your payout account is enabled, and the last 4 digits of your bank account. Stripe holds card and bank details in full | You, Stripe |
| Receipts, invoices and statements | Booking receipts, commission invoices, credit notes and earnings statements, including the names and addresses printed on them | Generated by us |
| Messages | Messages you send and receive in the app | You and the other party |
| Reviews | Ratings and comments you write and receive | You and the other party |
| Reports and moderation | Content you report, reports about you, blocks, and moderation outcomes | You, other users, our screening |
| Notifications | Your notification preferences, push tokens (with the device platform and when last seen), and a log of notifications sent | Your device, us |
| Technical and error data | Error reports and diagnostics (device, app version, the error, and an internal user id). We filter these to remove personal details | Your device, our servers |
| Support | Emails you send us and our replies | You |
| Privacy requests | Your data-export and deletion requests and their status | You |
| Early-access requests | Email address, optional message, language, a hash of your IP address, and when we replied | You |
We do not collect health data, and we ask you not to put sensitive information in messages or listings.
Identity verification and biometric data. When you verify your identity, Stripe Identity compares a selfie with the photo on your document. That comparison uses biometric data. Stripe asks for your consent to this inside the verification flow and processes the images under its own privacy notice (stripe.com/privacy). RevUp never receives the images or the biometric data, only the result.
4. Why we use it and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, sign you in, keep it secure | Account, profile | Contract (Art. 6(1)(b)) |
| Check you are 18 or over | Date of birth | Contract; legitimate interest in keeping minors off the platform (Art. 6(1)(f)) |
| Verify your identity before you book, list or bid | Identity verification | Contract; legitimate interest in preventing fraud and keeping users safe (Art. 6(1)(f)) |
| Publish listings and show search results, maps and routes | Listings, location and addresses | Contract |
| Make and manage bookings, requests, cancellations and refunds | Bookings, payments | Contract |
| Take payments and pay providers, hold funds until bookings complete | Payments and payouts | Contract |
| Bookkeeping, receipts and invoices | Payments, receipts and invoices | Legal obligation (Art. 6(1)(c)) — the Danish Bookkeeping Act (bogføringsloven) and the VAT Act (momsloven) |
| Report provider earnings to Skattestyrelsen (DAC7) | Tax profile, bookings, payments | Legal obligation (Art. 6(1)(c)) — the Danish Tax Reporting Act (skatteindberetningsloven); the CPR number is processed under the Danish Data Protection Act (databeskyttelsesloven) § 11 |
| Let customers and providers message each other | Messages | Contract |
| Show reviews so users can decide who to deal with | Reviews | Legitimate interest in a trustworthy marketplace (Art. 6(1)(f)) |
| Screen content and act on reports, keep users safe, prevent fraud and misuse | Messages, reviews, photos, listings, profiles, reports | Legitimate interest (Art. 6(1)(f)); legal obligation under the EU Digital Services Act for handling reports of illegal content |
| Send service notifications by push and email | Notifications, account email | Contract; push notifications only with your device permission |
| Use your device location for nearby results | Device location | Your consent, given through your device permission, which you can withdraw in your device settings (Art. 6(1)(a)) |
| Find and fix errors | Technical and error data | Legitimate interest (Art. 6(1)(f)) |
| Answer support requests and handle disputes | Support, bookings, messages | Contract; legitimate interest |
| Handle your privacy requests | Privacy requests | Legal obligation (Art. 6(1)(c)) |
| Answer early-access requests and send invites | Early-access requests | Legitimate interest in answering a request you sent us (Art. 6(1)(f)) |
| Defend or bring legal claims | Relevant records | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, you can object (section 9).
5. Who can see your data
5.1 Other users. Other users see what is needed for a booking:
- your public profile: first name, last initial, photo, ratings and reviews;
- your listings, including the locations needed to find and use them;
- the messages you exchange with them;
- once a booking is confirmed, the details needed to carry it out, such as the exact address of a parking space or the pick-up point of a ride.
Your email address, date of birth, phone number and tax details are never shown to other users. If you want to share a phone number, you do so yourself in a message.
5.2 Service providers (processors). These companies process data for us under data processing terms that meet GDPR Art. 28.
| Processor | What they do for us | Data involved |
|---|---|---|
| Supabase | Database, sign-in, file storage and server functions | All categories stored by RevUp |
| Stripe (Payments, Connect, Identity) | Card and wallet payments, provider payout accounts and payouts, identity verification | Payment, payout and identity data; name, email, date of birth, address, bank details for providers |
| Google — Sign-In | Sign in with Google | Email, name, Google account id |
| Google — Maps / Directions | Maps, address search and routes | Addresses, coordinates, route stops |
| Google — Firebase Cloud Messaging | Delivering push notifications to Android devices | Push token, notification content |
| Google — Gemini (through our server) | Screening message and review text for prohibited content | The text of the message or review being checked, and nothing else |
| Google — Cloud Vision | Screening photos before they are published | Uploaded photos |
| Apple — Sign in with Apple | Sign in with Apple | Email (or Apple relay address), name, Apple account id |
| Expo (Push) | Sending push notifications through Apple and Google push services | Push token, notification content |
| Resend | Sending email (e.g. sign-in codes, notifications, earnings statements) | Email address, email content |
| Sentry | Error monitoring | Technical and error data with an internal user id; personal details are filtered out |
| Dataforsyningen (DAWA) | Danish address lookup | Address search text |
| Slack | Internal alerts to our team (e.g. a new report to review) | Internal ids only, no message or profile content |
Independent controllers. For some processing these companies decide the purposes themselves and are independent controllers under their own privacy notices:
- Stripe, for its own legal duties as a payment institution, such as know-your-customer checks, anti-money-laundering screening and fraud prevention, and for the identity-verification images;
- Google and Apple, for the sign-in service on their side of the login (what they record when you use your Google or Apple account).
5.3 Authorities. We share provider data with Skattestyrelsen for DAC7 (section 7). We share data with the police, courts or other authorities when the law requires it.
5.4 Business changes. If RevUp's business is sold, merged or restructured, personal data may be passed to the new owner so that the service can continue. The new owner must use it under this policy, and we will tell you before it happens.
5.5 We do not sell personal data and do not share it for advertising.
6. Transfers outside the EU/EEA
Some processors, or their sub-processors, may process data outside the EU/EEA, in particular in the United States (Stripe, Google, Apple, Expo, Resend, Sentry, Slack). Where they do, we rely on:
- the EU–US Data Privacy Framework, where the recipient is certified under it; or
- the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
We choose EU processing where the provider offers it. Our database and file storage are hosted in the EU. You can ask us at [email protected] for details of the safeguards for a specific processor.
7. Tax reporting (DAC7)
7.1 RevUp is a digital platform operator under EU rules known as DAC7 (Council Directive (EU) 2021/514), implemented in Denmark in the Tax Reporting Act (skatteindberetningsloven) and the executive order on reporting by platform operators. If you earn money on RevUp, we must collect information about you and report it once a year to Skattestyrelsen, by 31 January for the previous calendar year.
7.2 The report includes:
- your name, address and date of birth;
- your tax identification number (CPR number for individuals, CVR number for businesses) and any VAT number;
- per quarter: what you earned, the fees we took, and the number of bookings.
For parking hosts it also includes the address of each space and, where available, its land registry number (matrikel/BFE).
7.3 Skattestyrelsen may exchange this information with tax authorities in other EU countries.
7.4 We ask for your CPR number only when the law requires it. We store it encrypted and use it only for DAC7. We delete it once the report it was collected for has been filed and accepted, unless the reporting rules require us to keep it longer.
8. How long we keep data
We keep data only as long as we need it for the purposes above, or as long as the law requires.
| Data | How long |
|---|---|
| Account and profile | Until you delete your account, plus the 30-day grace period. After deletion, the booking, payment, message and problem-report records around your recent bookings keep your identity for 180 days after your last booking, so card disputes (which a bank can raise for up to 120 days) can be answered. After that your identity in them is anonymised |
| Bookings, payments, ledger, payouts, receipts, invoices and credit notes, and the identity details printed on them | 5 years from the end of the financial year they relate to, as the Bookkeeping Act requires. Then invoice identity details are removed and the PDF files deleted |
| Tax profile | If you never completed a booking as a provider and never received a payout: deleted with your account. Otherwise kept until the last DAC7 year it relates to has been reported, and at most for the 5-year bookkeeping period |
| CPR number | Deleted once the DAC7 report it was collected for has been filed and accepted, unless the reporting rules require longer |
| Identity verification | Our record of the result is kept with your account. On deletion we ask Stripe to redact the verification session |
| Messages | Kept for as long as both accounts exist. If you delete your account, your messages stay visible to the other party but your name is replaced with "Deleted user" |
| Reviews | Reviews you wrote about others stay published, with your name replaced with "Deleted user". Reviews others wrote about you are removed with your profile |
| Problem reports and moderation records | Kept anonymised in the booking record for the 5-year bookkeeping period, because they explain refunds and held funds. Photos in problem reports are kept with the booking |
| Listings and photos | Unpublished at once when you delete your account; photos deleted when deletion completes |
| Push tokens and notification preferences | Deleted when you delete your account, or when a device stops being used |
| Old profile history and addresses | Removed after the 180-day identity hold following account deletion |
| Data export files | Deleted 24 hours after they are created |
| Error and diagnostics data (Sentry) | 90 days |
| Emails sent through Resend | Delivery logs are kept by Resend for a short period under its retention policy, then deleted |
| Support emails | 2 years after the case is closed, so we can answer a follow-up or a complaint |
| Stripe records | Stripe keeps its own records of payments, payout accounts and verifications under its legal duties. When you delete your account we delete your Stripe customer record and close your payout account, but Stripe may keep transaction history as the law requires |
| Early-access requests | Until sign-ups open to everyone, and at most 12 months |
9. Your rights
You have these rights under the GDPR. Most can be used directly in the app.
| Right | How to use it |
|---|---|
| Access and portability — get a copy of your data | Profile, then Privacy & data, then Export my data. You confirm with a 6-digit code sent to your email. We prepare a ZIP file with your data in a machine-readable format (JSON) and a readme. The download link works for 15 minutes and the file is deleted after 24 hours. You can request one export every 24 hours. Other people in your data (for example, the other side of a conversation) appear by first name only |
| Rectification — correct your data | Edit your profile, listings and tax profile in the app. For anything you cannot edit, email us |
| Erasure — delete your account | Profile, then Privacy & data, then Delete account, confirmed with a 6-digit email code, or on the web at https://revup369.com/delete-account. See below |
| Restriction | Email us |
| Object to processing based on legitimate interest | Email us |
| Withdraw permission for push notifications or location | Your device settings. You can also turn individual notification types on or off in Profile, then Notifications |
| Complain | See section 15 |
How deletion works:
- Your account is deactivated and hidden at once, and you are signed out everywhere.
- You have 30 days to change your mind — just sign in again, and we email you to confirm the deletion was cancelled.
- After 30 days we delete or anonymise your data as described in section 8. This includes:
- deleting your Stripe customer record and closing your payout account;
- asking Stripe to redact your identity verification;
- revoking Sign in with Apple, if you used it;
- deleting your photos and push tokens.
- We cannot delete your account while money is owed to you or by you, a payout is in progress, you have open bookings as a provider, or you have unused booking credit. The app will tell you to contact support.
- Some records must be kept by law (section 8).
We answer requests sent by email within one month. We may ask you to confirm your identity first.
10. Automated screening and decisions
10.1 To keep RevUp safe, we screen content automatically:
- photos in listings, profiles and vehicle photos are checked with Google Cloud Vision before they are published;
- message and review text is checked with Google Gemini after it is published.
Content the check flags may be hidden automatically and sent to our team for review. Photos attached to a problem report are not screened: they are evidence that only our support team and the two parties to the booking can see.
10.2 No decision with legal or similarly significant effect is made solely by automated means. A person on our team reviews before any account is suspended or closed. If content of yours is hidden or removed, we tell you what was affected and why, and you can ask for a human review by emailing [email protected] (Community Guidelines, section 11).
10.3 We also use automatic rules to run the marketplace, for example:
- the age check at sign-up;
- expiring unanswered booking requests;
- releasing held funds when a booking completes.
These follow the rules in the Terms of Service.
11. Security
We protect personal data with access controls, encryption in transit, encryption of your CPR number at rest, row-level access rules in our database, and by limiting who on our team can see it. No system is completely secure. If a breach puts your rights at risk, we will tell you and Datatilsynet as the law requires.
12. Children
RevUp is only for people aged 18 and over. We check date of birth at sign-up and block accounts under 18. If you believe a child has an account, tell us and we will delete it.
13. Cookies and similar technologies
13.1 App. The app does not use cookies or advertising identifiers. It stores sign-in and settings data on your device so you stay signed in and your preferences are remembered.
13.2 Website. The pages on revup369.com are static. They set no cookies, run no analytics and load nothing from third parties. If that changes, we will add a cookie notice here and ask for consent where the law requires it.
14. Changes to this policy
We will update this policy when our processing changes. Each version has a version number and date. If a change is significant, we will tell you in the app or by email before it takes effect.
15. Contact and complaints
- Questions or requests: [email protected]
- You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, www.datatilsynet.dk. You can also complain to the data protection authority where you live or work in the EU.