Privacy policy

The data controller is Vamo, a collective of private drivers offering transfers in Paris and the Île-de-France region, and the publisher of vamoparis.com.

Our full legal identity — registered company name, legal form, French company number (SIREN), registered office and publication director — has not been finalised yet : the company is still being set up. It will be published on our legal notice page (in French, as French law requires) before the service opens commercially, and this page will be updated the same day. We would rather tell you than display a placeholder.

Contact us: reservation@vamoparis.com. This is currently the only way to reach us — no phone line is in service yet, which is why the « Call » and WhatsApp buttons are hidden everywhere on the site.

We have not appointed a Data Protection Officer. French and EU law do not require one for an organisation of this size whose core activity is not large-scale monitoring of individuals. Your requests are handled at the address above.

Verified against the site's source code on 30 August 2026. Every point below can be checked by any visitor using their browser's developer tools (Network and Storage tabs).

• No trackers, no advertising, no third-party analytics

  No Google Analytics, no Google Ads tag, no Meta/Facebook pixel, no Hotjar, no Matomo, nothing equivalent. No advertising script is loaded. The site only counts its page views (page, referring site) with no cookie, no IP address and no identifier: one number per day, nobody behind it.

• No cookies

  The site sets no cookies at all — not technical, not advertising, not analytics. See section 7 for the single item stored in your browser, and why it is not a cookie.

• No accounts, no passwords for customers

  The public site asks for no account and no password: you manage your ride through the link you receive by email. The collective's internal areas (admin dashboard, driver app) are online, behind a Google sign-in reserved for members.

• No online payment

  You are never asked for card or bank details on this site. There is no payment module. You pay your driver on board.

• Your bookings, and nothing more

  Your booking request is stored in our database (Firebase Firestore, Google Cloud), together with what you add later from your link: messages, requests, announced tip, the rating you leave after the ride. This data is used only to carry out and follow your ride; it is kept as long as needed to manage rides and meet accounting obligations, then deleted.

• No fonts loaded from a third party

  Both typefaces are served by this site itself. No request is made to Google Fonts, so no visitor IP address is sent to a font server — something that has already led to court rulings against websites in Europe.

• We do not sell your data, and we do not profile you

  Your data is never sold, rented or traded. There is no automated decision-making and no advertising profiling.

Six situations only — and you trigger all of them yourself, except the last one, which is how every website on the internet works.

a) When you type an address into the booking form

The pick-up and drop-off fields suggest addresses as you type. Two different mechanisms take turns, and they do not have the same consequences:

• Our own locations — airports and terminals (CDG, Orly, Beauvais), Paris train stations, Disneyland, La Défense, Versailles and the main landmarks: these are written inside the site. Typing them triggers no network request at all. Since they account for the vast majority of our rides, most visits send nothing anywhere.
• Any other address in France: from the third character onwards, and only after you pause typing for a quarter of a second, the text you typed is sent to api-adresse.data.gouv.fr — the interface to the Base Adresse Nationale, France's official address directory. It is a free public service run by the French State (Ministry for Ecological Transition, IGN, ANCT), not a commercial company.

What is sent to that service: the text you typed (which may be a home address) and, as with any internet connection, your IP address. Nothing else.

What is not sent to that service: not your name, not your email address, not your phone number (they only go to our own server, when you submit your request — see c), not your travel date, not the vehicle you selected, and no identifier that would link you to Vamo or allow anyone to recognise you from one visit to the next. No cookie travels with the request.

We deliberately chose the French State's directory over a commercial US address autocomplete service: the data stays in France, with a public body, and the service does not build advertising profiles.

b) When you display the transfer map

Our prices page shows a map of the Paris region with our four destinations. It is a real map: you can zoom it and pan it. It is made of small images called tiles, downloaded from CARTO, built on the open data of OpenStreetMap.

What reaches that service: as with any image loaded from another site, your IP address and the coordinates of the map squares shown on your screen. Nothing else — not your name, not your journey, not what you typed into the form. No cookie accompanies these requests.

What we do to limit it: the map is loaded only if you scroll down to it. If you stay at the top of the page, or if you never visit the prices page, no request is sent to CARTO — your IP address never reaches them. It is the only page of the site concerned.

c) When you send your booking request, and later from your link

When you press « Send my booking request », your browser sends to our own server (vamoparis.com): your name, your email address, your phone number if you gave one, your flight number, your pick-up and drop-off points, the date and time, the vehicle you chose, the site language and your remarks. The server records this request in our bookings database (Firebase Firestore, a Google Cloud service — see section 5), emails it to the collective and sends you a confirmation containing a personal link.

That link lets you change the time or the vehicle, leave a note for your driver, announce a tip, open a request and, after the ride, leave a rating. Each of these actions is recorded with your ride. The link carries a unique token that is stored nowhere in clear text: it alone opens your ride, and it stops working once the ride is complete.

d) When you email us

The email link opens your own email application. The site transmits nothing by itself, and nothing is sent until you press send. We then receive whatever you chose to write.

e) When you message us on WhatsApp

This only applies when a WhatsApp number is displayed on the site: as long as no business number is in service, the WhatsApp buttons are hidden. Here is what happens when they are visible.

The button opens a WhatsApp conversation with a message already written for you. That message contains only your pick-up point, your destination, the vehicle category you selected, and the words « return trip » if you ticked that option. It contains no name, no email address and no identifier. You can edit or delete it before sending: nothing is transmitted until you press send.

Messaging us on WhatsApp does, however, necessarily give us your phone number and your WhatsApp profile (display name, and photo if you have one), and routes the conversation through Meta, which owns WhatsApp. If you would rather avoid that, email gets you exactly the same result.

f) Your host's technical logs

Like every website, this one is served by a host that logs incoming requests: IP address, date and time, page requested, browser type. Those logs keep the site running and help detect abuse such as attacks and bots. We do not read them to analyse visitor behaviour, and they are not linked to any other information.

Under the GDPR, every processing operation must rest on one of the six legal bases in Article 6. Here are ours, one by one.

None of this relies on your consent, for a simple reason: the site does nothing that would require it. The day analytics or advertising measurement is introduced, your consent will be asked before anything is stored, and refusing will be as easy as accepting.

Nobody beyond the three parties below, each for a specific reason. We pass your data to no data broker, no ad network and no commercial partner.

• The French State — Base Adresse Nationale (IGN / ANCT)

  Receives the text you type into an address field and your IP address, for as long as it takes to return suggestions. A free public service, hosted in France, with no transfer outside the European Union. Their own policy: adresse.data.gouv.fr — personal data (French).

• Hostinger — our web host

  The site and its server are hosted by Hostinger. Like any host, it keeps technical logs (request IP addresses) for the security of its service, acting as a processor. Details: Hostinger — privacy policy.

  Google (Firebase Firestore) — bookings database

  Your booking request and its follow-up are stored by our server in Firebase Firestore, a Google Cloud service. Google acts as a processor. Transfers outside the European Union are possible and are covered by the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework. Details: Firebase — Privacy and Security.

  Firebase's authentication component is also present in the page code. It exists only for the collective's driver and administrator area (Google sign-in for members): customers are never asked to sign in or create an account, and it places no advertising identifier and no cookie on your device.

• Meta — WhatsApp

  Only if you choose to message us on WhatsApp, when a number is displayed on the site (see 3.e). The conversation then travels through Meta's servers under Meta's own policy: WhatsApp privacy policy (European Economic Area). On that processing Meta is an independent party: we control neither how long it keeps the data nor where it transfers it.

We would also have to disclose information to a judicial or administrative authority making a lawful request. That has never happened to date.

• What you type into the form: until you send your request, nothing reaches us — it lives in your browser and disappears when you close the page. Once the request is sent, the ride and its follow-up are kept for as long as it takes to carry it out and meet accounting and tax obligations, then deleted.
• Your emails: kept for as long as it takes to handle your request and see your ride through, then for three years from our last exchange if no ride took place. Records tied to a ride that was actually invoiced are kept for the period French accounting and tax law requires.
• Your WhatsApp messages (once that channel opens): the same rule on our side. How long Meta keeps them is governed by Meta's own policy, over which we have no control.
• Your host's technical logs: a few months, under Hostinger's policy.
• Your address searches: not kept by us — we never receive them — and not kept long-term by the State's directory, whose own policy is published on its site.
• Your theme preference and your possible refusal of the language suggestion: they stay in your browser until you clear the site's data. They never reach us.

This site sets no cookies. That is why there is no cookie banner to click through.

At most two items are stored in your browser, and you are the one who creates them: your appearance preference — light theme, dark theme, or « automatic » (the site then follows your device's own setting) — and, if you declined the suggestion to switch language, that refusal (value « no »), so we do not ask again. Technically they live in your browser's localStorage, and each value is a single word.

Three points worth making, because the distinction matters: this is not a cookie (a cookie is sent back to the server with every request — this value never leaves your device); it cannot identify you or track you; and it is erased as soon as you clear this site's data, with no consequence other than returning to the automatic setting.

French law goes further than cookies alone. Article 82 of the French Data Protection Act — which implements the EU ePrivacy Directive — covers any writing to or reading from your device, including this kind of storage. It expressly exempts user-interface personalisation from consent, and the CNIL (France's data protection authority) gives as its own example « the choice of language or of the presentation of a service ». An appearance setting falls squarely within that exemption: no consent is required, so we do not ask for any.

The GDPR gives you the following rights over data concerning you. They apply wherever in the world you live, because we are established in France.

• Access (Article 15): find out whether we hold data about you, and get a copy.
• Rectification (Article 16): have inaccurate or incomplete information corrected.
• Erasure (Article 17): ask us to delete your data, subject to accounting obligations that may require us to keep an invoice.
• Restriction (Article 18): ask us to freeze a processing operation while a dispute is settled.
• Portability (Article 20): receive the data you gave us in a machine-readable format.
• Objection (Article 21): object to processing based on our legitimate interest.
• Post-mortem instructions (French Data Protection Act): set out what should happen to your data after your death.

How: write to reservation@vamoparis.com, in English or in French, saying what you want. We may ask for proof of identity if there is genuine doubt about who is asking — and only in that case.

How quickly: we answer within one month of receiving your request (GDPR Article 12(3)). That period can be extended by two months for complex requests; if so, we will tell you and explain why within the first month.

What it costs: nothing. Exercising these rights is free.

In practice, given how the site works today, we most likely hold no data about you at all — unless you have written to us. That is also an answer we owe you, and we will give it to you plainly.

If, after contacting us, you believe your rights are not being respected, you can lodge a complaint with the CNIL (Commission nationale de l'informatique et des libertés), France's independent data protection authority. Article 77 of the GDPR gives you this right with no severity threshold and without having to exhaust any other remedy first.

If you live in another EU country, you may instead contact the supervisory authority of your country of residence or of your place of work.

This site is young and it will grow. Three planned changes will add processing that does not exist today: analytics and advertising measurement (which will come with a proper consent banner, mandatory, where refusing is as easy as accepting), storing bookings in a database, and sending confirmation emails.

This page will be updated before each of those goes live, never after. The date at the top shows the most recent revision.

See also: legal notice (French) · Politique de confidentialité (français)