Privacy Policy & Data Processing Terms

1. Who we are

Cabio is a taxi and private-hire dispatch software platform developed and operated by Launchflow. We supply the technology that licensed operators use to take, price, dispatch, and track journeys. We are not a taxi operator and we do not carry passengers.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: Launchflow · 103A London Road, Grays, Essex, RM17 5YB · hello@launchflow.co.uk · cabio.cab

2. Our two roles — controller and processor

Data protection law distinguishes between the party that decides why and how personal data is used (the controller) and the party that processes it on the controller's instructions (the processor). Launchflow holds both roles, depending on whose data it is. This matters, because it determines who you should contact about your data.

In plain terms: if you booked a taxi, the taxi company is the controller of your data and we simply hold and process it for them. We will not use it for our own purposes, and if you ask us to delete it we will refer you to the operator, because it is not ours to decide.

3. What we collect about you

• Your name, business name, email address, phone number, and business address
• Your operator licence details and licensing authority, where you provide them
• Account credentials (passwords are stored only as a cryptographic hash — never in plain text)
• Your subscription plan, billing records, invoices, and payment metadata — we do not store card numbers
• Enquiries, demo requests, support tickets, and our correspondence with you
• Marketing preferences (opt-in and opt-out status)
• Administrative usage of the platform — sign-in times, IP address, and audit-log entries recording actions taken in your account
• Website and analytics data as described in section 14

4. Why we use it, and our legal basis

5. Who we share your data with

We do not sell your personal data. As controller we may share it with:

• Our hosting, email, and infrastructure providers, listed in section 10
• Payment processors, to take your subscription payment
• Our accountants and professional advisers, where necessary
• Regulatory or law-enforcement authorities where we are legally required to disclose
• A purchaser or successor, if the business is sold or reorganised — you would be notified

6. How long we keep it

• Your operator account — for as long as your subscription is active.
• Billing and accounting records — 7 years from the end of the relevant financial year (HMRC requirement).
• Enquiries and demo requests that do not become customers — 24 months.
• Support correspondence — 2 years after the ticket is closed.
• Marketing preferences — until you withdraw consent, plus a suppression record so we do not contact you again.
• Security and server logs — 90 days.
• Audit logs of actions in your account — 12 months.

7. Roles and instructions

For all personal data relating to an operator's passengers and drivers, the operator is the controller and Launchflow is the processor. We process that data only on the operator's documented instructions — which are given through their configuration and use of the platform, and through this policy and our Terms of Service — unless we are required to process it by law, in which case we will tell the operator first unless the law prohibits it.

We will not use passenger or driver data for our own purposes, will not sell it, and will not use it to market to passengers or drivers. We do not use one operator's data to benefit another operator. Each operator's data is logically separated and access-controlled by tenant.

We will inform the operator if, in our opinion, an instruction they give us infringes data protection law.

8. What we process on the operator's behalf

9. Our commitments as processor

• We process personal data only on the operator's documented instructions.
• We ensure that everyone authorised to access the data is bound by an appropriate duty of confidentiality.
• We implement the technical and organisational security measures described in section 11.
• We engage sub-processors only under section 10, and remain fully liable to the operator for their performance.
• We assist the operator, taking into account the nature of the processing, in responding to requests from data subjects — see section 12.
• We assist the operator with security, breach notification, data protection impact assessments, and prior consultation with the ICO.
• We delete or return the data at the end of the subscription, as set out in section 13.
• We make available the information needed to demonstrate compliance and allow for audits — see section 15.

10. Sub-processors

We use the sub-processors below to deliver the platform. Which ones apply depends on the features and integrations an operator has enabled — for example, an operator who does not use SMS will not have data processed by Twilio.

Operators may also connect their own third-party accounts and API keys. Where they do, that provider acts on the operator's own instructions and the operator is responsible for the arrangement with them.

We will give operators at least 30 days' notice by email before adding or replacing a sub-processor that handles passenger or driver data. An operator who reasonably objects on data protection grounds may raise it with us at hello@launchflow.co.uk, and if we cannot resolve it, may terminate the affected part of the service without penalty.

11. Security

We apply technical and organisational measures appropriate to the risk, including:

• TLS encryption for all data in transit, and encryption of data at rest
• Passwords stored as salted cryptographic hashes, never in plain text
• Per-tenant data isolation, so one operator cannot access another operator's records
• Role-based access control, with administrative access restricted to named individuals on a need-to-know basis
• Authentication tokens with limited lifetimes, and scoped tokens for public tracking links
• Rate limiting and abuse protection on public endpoints
• Audit logging of administrative actions
• Regular dependency patching and security review of changes before release
• Backups, held for a limited period and protected to the same standard as live data

If you believe you have found a security vulnerability, please report it to hello@launchflow.co.uk rather than disclosing it publicly.

12. Personal data breaches, and helping with data subject requests

If we become aware of a personal data breach affecting an operator's data, we will notify that operator without undue delay and in any event within 24 hours of becoming aware, and give them the information they reasonably need to meet their own 72-hour obligation to the ICO. We will not notify the operator's passengers or drivers directly unless they instruct us to.

If a passenger or driver contacts us directly to exercise a data protection right, we will not act on it ourselves. We will pass the request to the relevant operator without undue delay and support them in responding, including by providing exports and carrying out deletions on their instruction.

13. Return and deletion of data

An operator can export their data from the admin portal at any time during their subscription. On termination, we will provide a final machine-readable export on request made within 30 days. We then delete or irreversibly anonymise the operator's tenant data within 90 days, and purge it from backups within a further 90 days, except where we are required by law to retain specific records.

14. International transfers

Our primary hosting and databases are located in the EEA. Some sub-processors listed in section 10 are based in the United States. Where personal data is transferred outside the UK, we rely on the UK Government's adequacy regulations where they apply, or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and additional safeguards such as encryption in transit and data minimisation.

15. Cookies and similar technologies

This website uses strictly necessary cookies, and also uses Google Tag Manager to load Google Analytics and Google Ads conversion tracking. Strictly necessary cookies are required for the site to function and do not require consent under the Privacy and Electronic Communications Regulations. Analytics and advertising cookies are not strictly necessary — they help us understand how the site is used and measure which adverts lead to enquiries.

Google Tag Manager may deploy additional Google tags. You can prevent analytics and advertising cookies by using your browser's cookie controls, by browsing in private mode, by installing the Google Analytics opt-out browser add-on, or by using your browser's "Do Not Track" or tracking-protection settings. Blocking these cookies does not affect your ability to use the site.

We also store small amounts of information in your browser's local storage — for example to remember that you have seen the cookie notice, to keep an admin or driver session active, and to remember interface preferences such as dark mode and dashboard layout. This is used only to make the product work and is never shared.

16. AI features

Cabio includes optional AI features — a dispatch assistant that can suggest actions to an operator, and AI-assisted text and transcription. Where an operator enables these, relevant booking, driver, and message content is sent to the AI providers listed in section 10 to generate a response.

Those providers act as our sub-processors, process the data only to return a result, and are contractually prohibited from using it to train their models. AI suggestions are advisory: an operator must review and confirm them, and no AI feature takes an irreversible action on a booking without a human approving it. Operators can turn these features off entirely in their settings.

17. Your rights under UK GDPR

You have the rights below. If your data is held because you are an operator, an enquirer, or a website visitor, exercise them with us. If your data is held because you booked a journey or drive for an operator, exercise them with that operator — see section 2.

• Right of access (Article 15) — request a copy of the personal data held about you.
• Right to rectification (Article 16) — request correction of inaccurate or incomplete data.
• Right to erasure (Article 17) — request deletion where no legal obligation requires the data to be kept.
• Right to restriction (Article 18) — request that processing be restricted in certain circumstances.
• Right to data portability (Article 20) — receive your data in a structured, machine-readable format.
• Right to object (Article 21) — object to processing based on legitimate interests, or to direct marketing at any time.
• Right to withdraw consent — where processing relies on consent, withdraw it at any time without affecting prior lawful processing.
• Rights relating to automated decision-making (Article 22) — we do not make decisions producing legal or similarly significant effects about you by automated means alone.

To exercise a right against Launchflow, contact hello@launchflow.co.uk. We respond within one calendar month, and will tell you if we need to extend that for a complex request. There is no charge unless a request is manifestly unfounded or excessive.

18. Changes to this policy

We may update this policy. The current version is always published at /privacy-policy/. Material changes are notified to account holders by email at least 30 days before they take effect. Changes to Part C that affect an operator's data processing terms follow the notice periods set out in that part.

19. Complaints

If you are unhappy with how your personal data has been handled, please contact us first at hello@launchflow.co.uk so we can try to put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO)

ico.org.uk · Telephone: 0303 123 1113

If you booked a journey, your complaint is normally for the operator you booked with — but you may complain to the ICO about either of us.

20. Contact us

Launchflow (operators of Cabio)
103A London Road, Grays, Essex, RM17 5YB
Email: hello@launchflow.co.uk
Web: cabio.cab