Privacy policy
Last updated: 28 September 2026. English version. This is consumer information for citybagdrop.com; it is not a substitute for legal advice.
Who is responsible for your data. Tiankun Yao, NIF Y6911229L, Calle Algodón, Madrid, Spain, citybagdrop@gmail.com. Contact for privacy questions: citybagdrop@gmail.com.
What we collect
- Booking data: name, email, phone number, pickup and delivery addresses, dates and times, number and type of bags.
- Payment data: handled by Stripe. We never see or store your full card number.
- Communications: messages you send us by WhatsApp or email.
- Technical data: basic logs needed to run and secure the site.
Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Carry out your booking and delivery | Performance of a contract (art. 6.1.b GDPR) |
| Payment, invoicing, tax and accounting obligations | Legal obligation (art. 6.1.c) |
| Answer your questions and provide support | Performance of a contract / legitimate interest (art. 6.1.b, 6.1.f) |
| Prevent fraud and keep the service secure | Legitimate interest (art. 6.1.f) |
| Marketing messages (only if you opt in) | Consent (art. 6.1.a) |
Who receives your data
- Stripe (payments)
- Vercel (website hosting), Resend (transactional email), Supabase (database and sign-in), Meta / WhatsApp (customer messages), as service providers
- Drivers or partners who carry your bags, when needed to complete the transfer
- Tax and public authorities when the law requires it
We do not sell your data.
International transfers
Some providers, such as Stripe and Meta, may process data outside the EU. Where this happens, transfers rely on safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.
How long we keep it
Booking and invoice data: 6 years, as required by commercial and tax rules. Support messages: up to 24 months. Marketing data: until you withdraw consent.
Your rights
You can request access, rectification, erasure, restriction, portability, and objection by writing to citybagdrop@gmail.com. You can withdraw consent at any time. If you believe your rights have not been respected, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es.
Minors
Our services are for adults. We do not knowingly collect data from children under 14.
Cookies
We use strictly necessary cookies and storage for the site to work (for example booking draft and sign-in). We use Vercel Analytics for aggregate page-view statistics. We do not use marketing cookies.