Privacy Policy

We run an Instagram account for this guide and advertise the app on Instagram and Facebook. Both go through an app we registered with Meta Platforms Ireland Limited, which uses Meta's Instagram API and Marketing API. That app works only on our own business accounts: it publishes our posts and stories, reads the statistics of our posts and ads, and manages our ad campaigns. It has no login for visitors, never asks for your Facebook or Instagram account, and receives no personal data about you.

What we publish is made from our own guides, weather data and maps. Instagram and Facebook report statistics to us only as totals per post or ad - reach, views, likes, saves, shares, clicks and spend - never as a list of who saw or tapped something. We read comments and messages sent to our account in Instagram itself; our systems do not collect or store them.

What we publish on Instagram also appears on our Facebook Page. The same Meta app posts it there with a Page access token, which we store encrypted and use for nothing but publishing. No data about visitors or app users is sent to Facebook for this.

This website links to our Instagram account and shows our own recent posts, which we serve from our own servers: the pictures are the images we made and store ourselves, and no code from Instagram or Meta is loaded, so looking at them tells Instagram nothing - only following a link takes you to Instagram itself.

Meta shows our ads to people it selects by broad criteria we choose, such as country, language and interests. We upload no customer lists, email addresses or phone numbers. Neither this website nor the app contains the Meta Pixel, the Conversions API or the Facebook SDK, so nothing you do here or in the app is reported to Meta.

To learn which ad works, a tap on one of our ads goes through a link on this site that names the ad's campaign. The link counts the click with the campaign, the ad, the store, the language and the country, sets no cookie and stores no IP address, then forwards you to the App Store or Google Play. On Android, Google Play passes the campaign name to the app on its first launch, and the app keeps it with the device record described above. On iPhone the campaign name goes to Apple as a campaign token, and Apple reports only totals per campaign to us. Purchases are attributed to a campaign in the same way, and we look at them only as totals.

When you see or tap one of our ads, or follow, like, comment on or message our Instagram account, Meta processes that as the controller of its platforms, under its own privacy policy: https://www.facebook.com/privacy/policy. For the statistics Meta gives us about our account, Meta and we are joint controllers under Meta's Page Insights Controller Addendum (https://www.facebook.com/legal/terms/page_controller_addendum); Meta has taken on the primary responsibility for them and for answering requests about them.

Legal basis: our legitimate interest in promoting the guide and the app and in knowing which ads pay for themselves (Article 6(1)(f) GDPR). You can object at any time by writing to us; within Meta's apps, the ad preferences in your account settings decide which ads you see.

We run a YouTube channel for this guide, "Madeira LIVE", with a 24/7 live stream of a 3D model of the island and short videos made from it. We upload those videos with a program of our own that uses the YouTube API Services, provided by Google. It works only on our own channel: it uploads our videos and reads our channel's name to check it is the right one. It has no login for visitors, never asks for your Google or YouTube account, and receives no personal data about you.

The videos are made from our own 3D model, weather data and maps. YouTube reports statistics to us only as totals per video or live stream - views, watch time, likes and similar figures - never as a list of who watched. We read comments on our channel in YouTube itself; our systems do not collect or store them.

By using YouTube to watch our live stream or our videos you agree to the YouTube Terms of Service: https://www.youtube.com/t/terms. When you watch, like, comment on or subscribe to our channel, Google processes that as the controller of YouTube, under the Google Privacy Policy: https://policies.google.com/privacy.

Our program keeps one credential, a refresh token for our own channel, on our own computer, readable by no one else. We store nothing that Google or YouTube tells us about viewers, because they tell us nothing about individual viewers. Video statistics we look at stay in YouTube Studio.

Access to our channel can be withdrawn at any time in the Google account's security settings (https://myaccount.google.com/permissions); our program then stops working and its credential becomes useless. If you have a question about what we do with YouTube, write to the address at the end of this policy.

We use YouTube on the basis of our legitimate interest in presenting this guide and the island to people who want to see it (Art. 6(1)(f) GDPR).

When you use Shared rides - in the app, on the website or both - we keep: your profile photo; the rides and requests you post (their kind, island, places, stops, day and times, seats, price and note); the declaration you tick with each offer or taxi share, with its version and time; who asked to join which ride and with what answer; the messages and photos you send in ride chats, with the language and the results of the automatic checks; the translations readers asked for; the ride alerts you set; the people you blocked; reports you make or that are made about you, and what we decided; any warning or ban, and for a permanent ban a one-way fingerprint of your login; your choices about ride emails and chat push previews, and a log of the ride notifications we sent you; and which version of the Shared rides terms you accepted, and when.

Other users see you everywhere in Shared rides by your profile photo, your first name and the initial of your last name (“Ana S.”), never by your email address. You need a profile photo to post a ride, ask for a seat or accept an invitation. If you sign in with Google, the app offers to use your Google profile picture; we copy it only if you choose it, and check it like an upload. You can change your photo at any time; if we remove one that breaks the terms, we tell you why. The people on a ride see each other’s names and photos, the ride, its note and the messages and photos in the chats they are part of; the organiser sees who asks to join. What you write in a chat, such as a phone number, is seen by everyone in that chat. Photos are kept at random web addresses that cannot be guessed, and the app shows them only inside the chat; but anyone who has the address can open the photo - also a person who has since left the chat or been blocked - and anyone you send a photo to could keep a copy. If you block someone, or someone blocks you, the two of you no longer see each other in Shared rides, on any of our sites and apps; the person blocked is not told.

Where a ride starts, stops or ends at a home, a street address or a hotel, only the organiser and the passengers they have accepted see that exact place. Everyone else - other users in the app, the ride’s public page, its share picture and the list of rides on the website - sees only the nearest district or village, and the map shows a wider circle around a shifted centre, with the route line stopping short of the place. A ride’s public page and its share picture show the route, the stops as described here, the day and times, the seats and the price - no names, profile photos, notes or messages. Anyone with the link can open the page until 7 days after the ride’s day, and search engines are asked not to index it.

We use this data to run Shared rides for you (Article 6(1)(b) GDPR), the profile photo included, so that the people you travel with see who they are dealing with; to keep it safe - the automatic checks of texts and photos (the spam check also looks at your recent messages, at how new your account is and at whether you have completed a ride), reports, disputes, warnings and bans, the fingerprint that keeps a permanent ban in force, and the copies we keep of reported material - which is our and other users’ legitimate interest (Article 6(1)(f)); and to meet our duties under the EU Digital Services Act (Article 6(1)(c)). The automatic checks decide on their own only whether a single message, note or photo is shown to others; every measure against an account is decided by a person, and you can ask for any decision to be reviewed.

The automatic checks and translation: Vercel Inc., our processor, passes the text of every chat message and ride note when it is sent, the text of a message a reader asks to translate, and every profile photo and chat photo through its AI Gateway to models run by OpenAI and, for texts our own spam rules find suspect, to the Jev model by TypeSafe AI. Both are Vercel’s sub-processors. Every one of these requests asks for zero data retention: the provider keeps nothing once it has answered, except what the law obliges it to keep. In addition, OpenAI Ireland Limited, as our processor, checks every photo with its image moderation before it is stored, and may keep the photo for up to 30 days to detect abuse. None of these requests carries your name, your email address or your account, and none of it is used to train models.

Notifications: push notifications go through Expo, which hands them to Apple’s and Google’s push services; ride emails are delivered by Resend. A chat push shows who wrote and, unless you turn it off, the beginning of the message; under Settings, Shared rides, you can choose to be told only that there is a new message. You can also turn ride emails off there. Routes are worked out on our own routing server.

Who processes Shared rides data for us

These companies process Shared rides data on our behalf. Where data goes to the United States, the transfer rests on the EU-US Data Privacy Framework for a company certified under it, and otherwise on the European Commission’s standard contractual clauses; you can ask us for a copy at i+madeira1@denis.pt.

How long we keep what

A job deletes Shared rides data every day once its period is over. Until then we keep it so that we can deal with reports, disputes and requests from authorities.

Deleting a message with a photo deletes the photo from our storage; copies already saved or cached on someone’s device can remain. If you delete your account, the account, your name, your profile photo and the photos you sent in ride chats are deleted straight away, and so is what you wrote in Shared rides - your messages, notes and the details of your reports - with your ride alerts and notification settings; we also ask our analytics provider to delete your usage data. In Shared rides you then show as a deleted account, your messages read “Message deleted”, your future rides are cancelled and the people on them are told. What remains, such as which rides took place and the reports and decisions about them, is kept pseudonymised - under a random identifier, no longer linked to your account or your name - until its period in the table ends. A permanent ban is kept with the fingerprint of your login, so that it still applies if you register again. Please do not share sensitive information in ride chats - your home address, documents, health or payment details - beyond what the ride needs.

You can ask us for a copy of your Shared rides data, to correct it, to restrict its use and, where the law provides for it, to erase it or to hand it over in a portable format: write to i+madeira1@denis.pt. What we keep for reports, disputes and bans, as described above, we may keep despite a request to erase it, for the period in the table. You can also complain to the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s data protection authority (www.cnpd.pt), or to the data protection authority where you live or work.