Privacy Policy

AbiKuller is run by Prism Hooldus OÜ (reg. code 16894703, Läänemere tee 62, 13914 Tallinn, Estonia), which is also the controller of personal data. For privacy and data protection matters write to info@abikuller.ee or call +372 354 8514. Use the same contact if you want to see, correct or delete your data. Other help and contacts are on the Help and contact page.

Data you enter yourself. Name, email address, phone number, language preference and password. The password is stored only as a one-way hash, so not even we can read it. You may add a profile photo. A courier also adds vehicle details (make, model, year, colour, licence plate) and uploads documents such as a driving licence. If a courier is invoiced for the membership fee or joins the partner programme, we also collect the business name, registry code, address and bank account number.
Order data. Pickup and drop-off addresses with coordinates, the description of the item, time, order type, number of parcels or passengers, the payment method agreed, courier bids, chats, ratings and listings. We do not handle the money: the client and the courier settle directly with each other.
Safety data. Reports about other users’ content, blocks and excerpts of text stopped by the content filter; when you press SOS, your location and its accuracy.
Data created automatically. IP address, device and browser type, a log of sign-ins and important actions, your notification subscription (push endpoint and encryption keys), and cookies.
Data from other services. If you sign in with a Google account, Google gives us your name, email address and account identifier. We never see your Google password.

We use location only to make the service work. Client: when you place an order the app may ask for your location so that the pickup address is filled in for you. If you decline, you simply type the address and everything else works as before. Courier: while the courier app is open it sends your position to our server so the client can see where a bid comes from and how the order is moving; during an active order the position updates more often. If there is no GPS permission, we work out an approximate city from your IP address (service ipwho.is). We do not track your location when the app is closed — the app has no background tracking. The track points recorded during an order belong to that order and are deleted with the order or the account. When you press SOS we send your exact location to our support team so we can arrange help. You can withdraw the location permission in your device settings at any time.

The app uses the camera and photo library only when you pick a file or take a picture yourself: your profile photo and courier documents (driving licence, registry extract and similar). Files are stored on our server in Estonia. Courier documents are visible only to you and to our administrators who approve the account — clients and other couriers never see them. Deleting your account deletes the files as well. You can withdraw the camera and photos permission in your device settings; without it the app keeps working, you just cannot upload a file.

Push notifications tell you about new bids, chat messages, order status changes and safety matters. For this we store your device’s push endpoint and encryption keys. Delivery to the device itself is handled by the platform push service: Apple (APNs), Google (FCM) or your browser vendor’s service. Notifications are not mandatory. You may decline the permission or revoke it later in your device settings — the app keeps working and every message stays inside the app.

The necessary part. Your sign-in token and language choice are kept in your device’s storage (localStorage). Without them the app cannot work, and they do not require consent.
Analytics. On the public web pages (home page, service and information pages) we use Google Analytics 4 to see how many people visit and where they come from. Analytics sets cookies and sends your IP address and device data to Google. No analytics is loaded inside the app screens (/client, /courier, /board). If you do not want analytics, block cookies in your browser settings or use a blocker; the service keeps working.
We do not use advertising networks, advertising cookies or tracking across other apps and websites, and we do not share your data for advertising.

The client and the courier see each other’s name, profile photo, rating and the reviews they have received. When a courier places a bid, the client also sees the vehicle details, the licence plate and the courier’s approximate position on the map. Once an order is agreed, both sides see each other’s phone number, the order addresses and their chat, and the client follows the courier’s movement until the order ends. Your email address, password, documents and bank details are never shown to other users. Listings and reviews you publish are visible to other users. If you block someone, neither of you sees the other’s content and you cannot write to each other.

We do not sell personal data and we do not pass it to advertising companies. Apart from the other side of a deal, data goes only to the providers the service cannot run without:

• Hosting. The app, the database and the backups sit on a server in Estonia, in the Jõhvi data centre. The host maintains the hardware and the network.
• Stripe Payments Europe, Ltd. (Ireland). Courier membership fee payments. Card details go straight to Stripe and never reach our server; we keep the payment id, the amount and the status.
• Google Ireland Limited / Google LLC. Sign-in with a Google account (name, email, account id) and Google Analytics 4 on the public web pages. Both the website and the app screens also load the Inter typeface from Google’s servers — that request shows Google your IP address and browser details.
• Apple Inc. and Google LLC. Delivery of push notifications to your device (APNs and FCM).
• ipwho.is. Working out an approximate city from your IP address when GPS permission is missing.
• OpenStreetMap Foundation and CARTO. Your device loads the map tiles straight from their servers, so they see your IP address and the map area you are looking at.
• Telegram. An operational message about a new registration, a sign-in and a new order, including the name and email address, goes to our own work channel so we can help the user quickly.

We send email from our own server and use no separate marketing platform. Data also goes to our accountant and legal adviser, and to the authorities where the law requires it (for example a police or court request). Every third party listed here is required to protect your data at least as carefully as this policy describes: they may use the data only for the service the data was given to them for, and for nothing else. With the larger providers (Stripe, Google) data processing terms that meet GDPR Article 28 apply as part of their agreements.

Our own server, database and backups are in Estonia. Some providers (for example Google, Apple, Telegram) also process data outside the European Economic Area. Such transfers happen only under Articles 45–46 of the GDPR: an adequacy decision of the European Commission or the Commission’s Standard Contractual Clauses. If you want to know which basis applies to a given provider, write to us and we will tell you.

You delete your account and everything tied to it yourself, without writing to us:

• in the app: Profile → Account → Delete account;
• on the web: Delete your account — no sign-in needed, the confirmation arrives by email.

Deletion is immediate and final. We remove the account, orders, bids, chats, reviews, listings, documents, saved addresses, track points, notifications and logs. If you have an active courier membership, we cancel it during the deletion automatically. Only the accounting records and the deletion record named in section 11 remain. If you want a copy of your data before deleting, write to info@abikuller.ee.

You have the right to: access your data and receive a copy; have inaccurate data corrected; ask for erasure; restrict processing; object to processing based on legitimate interest; receive your data in a machine-readable form; withdraw a consent you have given.
This is how you withdraw consent and permissions: location, camera and notification permissions are switched off in your device settings; email is opted out of with the link at the end of every message; the account and all data you delete yourself as described in section 12. For other requests write to info@abikuller.ee — we answer within 30 days at the latest. If our answer does not satisfy you, you may lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee).

The connection between the app and the server is encrypted (HTTPS/TLS). Passwords are hashed with bcrypt and cannot be read back. Access is role-based: a user sees only their own orders and chats, and courier documents are visible to administrators only. The server and the backups are in Estonia, backups are taken regularly and administrator actions are written to a log. If a breach occurs that puts your rights at risk, we inform the Estonian Data Protection Inspectorate within 72 hours and, where necessary, you as well.

AbiKuller is meant for adults. We do not knowingly collect data from children under 13. If we learn that an account belongs to a child, we delete it. If you believe your child has given us their data, write to info@abikuller.ee and we will remove it.

If this policy changes materially we say so in the app or by email and update the date at the top of the page. We will send an earlier version on request. Questions, requests and complaints: info@abikuller.ee, +372 354 8514, Prism Hooldus OÜ, Läänemere tee 62, 13914 Tallinn.