Privacy policy

Portivo acts in two roles, and the role decides who is responsible for your data.

Portivo as controller. This covers visitors to operator.portivo.eu, people who book a demo or write to us, the staff and collaborators of charter companies who use the Portivo dashboard, and the Portivo customer account: one account (sign-in with an emailed code or a Google account) works in the shops of every charter company that uses Portivo. We are also the controller of booking updates by SMS that Portivo sends to customers who agree to them when booking. The same applies to visit statistics (PostHog) and error reports (Sentry) in charter companies' shops: we decide what they collect, and each shop's cookie policy gives the details. We are responsible for this data and this policy describes it.

Portivo as processor. If you book a charter in the shop of a charter company (an operator), write to it through channels handled in Portivo or go through its identity verification, that operator is the controller of the data of that booking, conversation and verification. We process it only on the operator's instructions, as the software provider (GDPR Art. 28). The operator's privacy policy describes the purposes, legal bases and retention periods. You can also write to us and we will pass the matter on to the operator. The exception is booking updates by SMS and WhatsApp that you agree to when booking: Portivo is the controller of that channel (your consent, sending the messages and opting out), while the operator remains the controller of the booking data.

The controller is Portivo Inc., a corporation organised under the laws of the State of Delaware (United States of America), Delaware file number 10768094, with its registered office at 131 Continental Dr, Suite 305, Newark, Delaware 19713, USA.

Our representative in the European Union, designated under GDPR Art. 27, is Outofplace Poland spółka z ograniczoną odpowiedzialnością, ul. Żabia 4, 18-400 Łomża, Poland, KRS 0001163427, NIP 7182173789. You can contact the representative, including by post, about any matter concerning the processing of your data.

Contact for personal data matters: privacy@portivo.eu.

• Demo and contact: first name and surname, email address, phone number, company name, tax number (NIP), website, city, fleet size, the modules you are interested in, the tool you use today, the language of the demo, your message, the chosen time, your time zone and the meeting link, your response to the invitation, how the meeting went (held, cancelled, the reason for cancelling), the campaign parameters (UTM) in the address the request came from, and the preparation note described below.
• Data from public registers and websites: when you type a Polish tax number, we fetch the company's record from the VAT taxpayer list kept by the Polish Ministry of Finance (among other things its name, address, REGON, KRS and VAT status) and keep the answer in a cache for up to 24 hours. For the preparation note we also fetch up to 6,000 characters of text from the company's public website, given in the form or taken from the domain of the email address. When an operator account is set up, we complete the company's details from KRS, CEIDG, the REGON register and the European Commission's VIES system.
• Operator dashboard account and Portivo customer account: first name and surname, email address, phone number, dashboard role, sign-in method (emailed code, password, Google account or passkey), date of last sign-in and two-factor authentication settings.
• Booking updates by SMS: the phone number given in the booking, your consent with its time, your IP address and the version of the consent wording, the text messages we send with their delivery status, and the withdrawal of your consent or your opt-out.
• Operators' billing data: company name, address, tax identification number, register number, payment and invoice history and, for the reporting duty of platform operators (DAC7), the data those rules require.
• Technical data: IP address, browser and device type, timestamp and the address of the page you came from. The IP address of the demo form is used only to limit the number of requests: the counter keyed by it lives for an hour at most (up to 5 days in cache snapshots) and never reaches the database.
• Dashboard event logs: operations performed in the dashboard together with the user identifier, IP address and browser identifier.
• Measurement on operator.portivo.eu: the pages you view and what you click on them, how long a page takes to load and to respond to what you do, the window width, the browser and device type, and an approximate location worked out from the IP address, which is not stored. No cookies, nothing stored on your device and no identifier that outlives the day.
• Statistics and error reports in charter companies' shops: with your consent, the pages you visit including the parameters in their address, clicks, scrolling, load times, browser and device type, screen size and a random identifier, and when you book, the booking's identifier and your email address; error descriptions and a sample of speed measurements. Without consent, on the basis of legitimate interest: booking and purchase events (a purchase with its amount and currency; your email address and the ad click identifiers are added only with consent to marketing, so that the charter company's advertising tools can count the sale) and the shop server's errors. We do not keep your IP address, and the screen is not recorded.

We use providers who process data only on our instructions, under data processing agreements. The list is complete as of the last update.

The providers of the message channels an operator connects to its dashboard are described in Messages via WhatsApp, Messenger, Instagram, SMS and email.

Data also reaches recipients who are separate controllers:

• Discord Inc. (United States): notifying the sales team when a demo is booked, rescheduled or cancelled (the time, the host, your name, email, company, fleet size, the modules you are interested in, the campaign source). Discord processes this under its own privacy policy, and the transfer relies on the EU-U.S. Data Privacy Framework;
• providers your browser connects to directly, which see your IP address: CARTO (map tiles in the shops and the dashboard), rsms.me (a typeface in the dashboard's page editor) and YouTube, after you click "Play video" on a video an operator embeds in its shop;
• Apple and Google, which deliver push notifications to phones;
• Google, when you sign in with a Google account; Meta, when you write through Messenger or Instagram;
• the Polish Ministry of Finance and the European Commission, when we check a tax number; the tax authority of the Member State where we are registered as a platform operator for DAC7 (in Poland, the Head of the National Revenue Administration);
• our accountants and legal advisers, and public authorities where the law requires it.

We do not sell personal data or share it with other companies for advertising.

We store data on servers in the European Union, in the Frankfurt region, and do not replicate it to other regions.

Portivo Inc. is incorporated in the United States, as are some of the providers in the list above. Access to data from that country is a transfer outside the European Economic Area.

Portivo Inc. is subject to the GDPR directly (GDPR Art. 3(2)), including when it processes data on the instructions of an operator in the European Union. The agreement with the operator also contains the standard contractual clauses (module 2) adopted by Commission Implementing Decision (EU) 2021/914 as a contractual commitment.

For providers in the United States, transfers rely on standard contractual clauses and, for certified providers, also on the EU-U.S. Data Privacy Framework. The Commission's adequacy decision under that framework is in force: on 3 September 2025 the General Court dismissed the action for its annulment, and the appeal against that judgment is before the Court of Justice (case C-703/25 P).

You can obtain a copy of these safeguards (the standard contractual clauses) by writing to privacy@portivo.eu.

Retention of conversations held through message channels is described in the section on channels. When a period ends, we delete the data or anonymise it permanently.

You have the right of access to your data and the rights to rectification, erasure, restriction of processing and data portability.

You have the right to object to processing based on our legitimate interest (GDPR Art. 21), and to direct marketing at any time and without giving a reason.

You can withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before it.

To exercise your rights, write to privacy@portivo.eu or to our representative in the European Union. We reply without undue delay and within one month at the latest. In complex cases the period may be extended by two months, and we tell you so within the first month.

If you use an operator's services, we pass your request to that operator as the controller and help it carry the request out. The Data deletion page explains how to delete data.

You have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or with the authority in the country where you live or work.

Portivo sends text messages (SMS) about bookings under its own name, "Portivo", never from a charter company's number. For this channel Portivo is the controller: we collect your consent, send the messages and handle opt-outs. The charter company you book with remains the controller of the booking itself.

What we send. Updates about a booking you made in the shop of a charter company that uses Portivo, for example its confirmation, changes, payment reminders and reminders before the trip, and messages about the booking from the charter company's team. We send them only if you ticked the optional box for booking updates by SMS and WhatsApp when booking. Message frequency varies with the booking. Msg & data rates may apply.

Consent is optional. Booking updates by SMS are not a condition of booking. Without consent we send booking updates only by email and by push notification in the app. When you consent, we record the time, your IP address and the version of the consent wording. The legal basis is your consent (GDPR Art. 6(1)(a)).

Opting out and help. Where the sender accepts replies, reply STOP to opt out; a message from the sender name "Portivo" cannot be answered. You can always withdraw consent in the settings of your Portivo customer account or by writing to contact@portivo.eu, and we stop text messages to that number before the next message. For help (HELP), write to contact@portivo.eu.

WhatsApp and marketing. The same consent will cover booking updates by WhatsApp once Portivo launches them. We do not send them today, and before the first such message we will update this policy and add the WhatsApp provider (Meta) to it. A charter company may send marketing text messages through Portivo only to people who gave it a separate consent to SMS marketing, and each such message carries an unsubscribe link.

Provider. We send text messages through AWS End User Messaging, a service of Amazon Web Services, which processes message content, phone numbers and delivery statuses on our behalf under the AWS GDPR Data Processing Addendum, in the European Union (Frankfurt region). To deliver a message, AWS passes the phone number and the content to the mobile carrier of that number, which may be outside the European Union. Data may be transferred to Amazon Web Services, Inc. in the United States under the EU-U.S. Data Privacy Framework or standard contractual clauses.

Mobile information will not be shared with third parties or affiliates for marketing or promotional purposes.

An operator can connect a WhatsApp Business account, a Facebook Page (Messenger), an Instagram business account and an email address to its dashboard. Portivo then receives the messages you send to the operator through these channels, shows them to its team in one inbox and sends replies on its behalf. The operator's team may receive push notifications with an excerpt of new messages.

In these conversations we process: message content, attachments (for example photos, documents and voice notes), phone number, email address, the profile name and identifier assigned by WhatsApp, Messenger or Instagram, the date and status of each message (sent, delivered, read) and a record that you opted out of messages on a given channel (for example by replying STOP to a text message).

The controller of this data is the operator you are talking to. It decides why and for how long conversations are kept, and it is the first place to send requests about your data. The purpose is to hold a conversation with you, for example about a booking, an offer, a payment or your trip. The legal basis is usually steps prior to entering into a contract or its performance (GDPR Art. 6(1)(b)) or the operator's legitimate interest in answering enquiries (GDPR Art. 6(1)(f)). The operator states the exact basis in its own privacy policy.

Portivo processes this data on the operator's behalf as a processor (GDPR Art. 28), only to provide its service and under the Portivo platform services agreement. We do not use it for our own purposes, including advertising, and we do not sell it.

If your phone number or email address matches a customer record the operator already has in Portivo, the conversation may be linked to that customer. We do not create a Portivo account for you when this happens.

We process the operator's own data needed to connect channels as a controller, to perform our contract (GDPR Art. 6(1)(b); for the person representing the operator, Art. 6(1)(f)). This covers identifiers of connected accounts and numbers and access tokens issued by the providers.

WhatsApp: for businesses in the European Economic Area the WhatsApp Business service is provided by WhatsApp Ireland Limited, which processes messages as a processor acting for the operator. Messages are handled by the WhatsApp Cloud API on Meta's servers, where they are kept for no longer than 30 days. Data may be transferred to WhatsApp LLC and Meta Platforms, Inc. in the United States under the EU-U.S. Data Privacy Framework.

Messenger and Instagram: messages pass through Meta's services. You use them with your own account under Meta's terms, so Meta also processes your data under its own privacy policy. Portivo receives from these services only the messages sent to the Page or account the operator has connected, events related to them (for example delivery, read, reaction) and your profile name.

SMS: an operator does not connect its own number. Text messages about a booking, including those its team writes to you in Portivo, are sent by Portivo under the rules in Booking updates by SMS.

Email: when the operator replies to you in the chat and you have not read the reply, we send you an email notification through Resend with an excerpt of its latest message. The notification has a reply address of the form reply+token@inbox.portivo.eu, where the token points to the conversation. Replies to that address are received by Amazon SES in the Frankfurt region: the received email is stored in AWS file storage. We delete a processed email from that storage right after processing, and the storage itself deletes any other email, for example one we could not process, after one or two days. Only the text above the quoted message (up to 8,000 characters) and attached photos and PDF files enter the conversation, and we remove EXIF metadata, including GPS coordinates, from photos. Resend (Plus Five Five, Inc., USA) processes the notifications we send, including your email address and the message excerpt, as a sub-processor under a data processing agreement, and keeps them for up to 30 days, with backups for a further 7 days. It processes them in the United States, under the EU-U.S. Data Privacy Framework and standard contractual clauses.

Sending from the operator's Gmail: the operator can connect a Gmail or Google Workspace account to Portivo so that replies to you go out from its own address. We then ask Google only for permission to send email on the operator's behalf (the gmail.send scope) and for the account's email address. Portivo does not read the operator's mailbox and does not download its messages, contacts or calendar. We store the access token issued by Google encrypted with a key in AWS Key Management Service and use it only to send a reply that the operator's team wrote in Portivo. We do not sell data received through Google APIs, do not use it for advertising or to train artificial intelligence models, and do not share it with anyone other than the providers described in this policy, to the extent needed to provide the service. Portivo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The operator disconnects Gmail in the channel settings of the panel or in the security settings of its Google account. When it disconnects in the panel, we revoke the consent at Google and delete the token.

We store conversations and attachments on the Amazon Web Services infrastructure described in Who we entrust data to for as long as the operator uses Portivo, unless they are deleted earlier at its request or yours. Attachments sent by customers are deleted automatically after 365 days. Technical records of provider notifications (for example about a new message) are deleted after 30 days, and records that could not be processed after 90 days. Disconnecting a channel stops receiving and sending messages but does not delete the conversation history. When our contract with the operator ends, we delete or return its data in accordance with GDPR Art. 28(3)(g).

The quickest way to exercise the rights in Your rights is to write to the operator you are talking to. You can also write to privacy@portivo.eu and we will pass the request to the operator and help carry it out. The Data deletion page explains how to delete data from conversations.

An operator may ask its customers to verify their identity before a trip. Didit Identity Spain, S.L. carries out the check: it inspects the identity document, runs a liveness test (whether a live person is in front of the camera) and compares the face with the photo in the document.

The face comparison uses biometric data, a special category of data (GDPR Art. 9). The controller is the operator that orders the verification, and the legal basis is your explicit consent, which the operator asks for before the verification starts (GDPR Art. 9(2)(a)). You can withdraw consent; this does not affect the lawfulness of a verification already carried out.

Portivo and Didit act on the operator's instructions. Portivo keeps on the operator's behalf the verification result, its scores (such as the face match score) and the data read from the document: name, date of birth and the document's type, number and expiry date. We do not store photos of your face or document: the operator's dashboard fetches them from Didit only while they are on screen.

The verification result is linked to your Portivo customer account. If another operator that uses Portivo also requires verification, we may reuse that result so you do not have to verify again, but only with your explicit consent given for that booking. We are responsible for the reuse, as the controller of the customer account.

The verification result does not decide a booking on its own. The operator makes the decision.

We apply technical and organisational measures appropriate to the risk (GDPR Art. 32), in particular:

• we encrypt connections to our services with TLS and make browsers use secure connections (HSTS);
• we encrypt the database and file storage with AES-256;
• we keep data in the European Union, in the Frankfurt region, backups included;
• we offer two-factor authentication in the dashboard: an authenticator app or a passkey;
• we keep each operator's data apart and control access to it at the application level;
• we keep event logs that show who performed an operation in the dashboard and when.

We do not process or store payment card data. Card payments are handled by Stripe, which is certified to PCI DSS Level 1, the highest level of that standard for service providers.

If your browser sends a Global Privacy Control or Do Not Track signal, operator.portivo.eu runs neither its visit statistics nor its performance measurement.

No third-party tools on operator.portivo.eu track your activity across other sites.

We do not sell personal data or share it for advertising based on your activity on other sites.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

A language model drafts a summary of your answers for us before a demo and makes no decisions. If an operator uses identity verification, the operator, not the system, decides whether to accept a booking.

Providing data is voluntary, but it is necessary to use the service it concerns. Operators are required by tax and reporting law to provide billing data.

We may update this policy. The current version is always available on this page with the date of the last update and the change history. We notify people we have an agreement with of material changes by email.