Privacy Policy

The data controller responsible for your personal data is YR4U, located at Rua José Vicente Gonçalves, 8F, 2840-100 Seixal, Portugal. Tax number: PT519329201. For privacy-related questions, contact us at contact@yr4u.eu or office@yr4u.eu.

This policy applies to:

• The YR4U website (yr4u.eu) and online store
• The YR4U customer mobile application (shopping, orders, account)
• The YR4U Delivery rider mobile application (approved delivery partners only)
• Customer support, email, and phone communications with YR4U

Depending on how you use our services, we may collect:

Account & identity: name, email address, phone number, password (stored securely hashed), profile photo (if provided).

Orders & delivery: delivery address, order history, payment method type (we do not store full card numbers — payments are processed by Stripe), order notes, and delivery status updates.

Location data: GPS coordinates when you use delivery tracking, when a rider syncs location in the YR4U Delivery app, or when you choose to share location on the website.

Device & technical data: device type, operating system, app version, IP address, browser type, and Firebase Cloud Messaging (FCM) device tokens for push notifications.

Communications: messages you send to support, reviews, and feedback.

Rider-specific data (delivery app): employment/onboarding documents uploaded by admin, availability status, delivery performance stats, and live location during active deliveries.

We use personal data to:

• Create and manage your account
• Process orders, payments, and deliveries
• Assign and track deliveries with approved riders
• Send order updates, delivery notifications, and service messages
• Provide customer and rider support
• Improve our website, apps, and services
• Comply with legal, tax, and accounting obligations
• Prevent fraud and protect the security of our platform

We process personal data on the following legal bases:

• Contract — to fulfil orders, deliveries, and app services you request
• Legitimate interests — to improve services, prevent fraud, and ensure platform security
• Consent — for optional marketing emails, push notifications (where required), and non-essential cookies
• Legal obligation — for tax, accounting, and regulatory requirements

Location data is used to show delivery progress, route riders to customers, and update dispatch. In the YR4U Delivery app, riders must enable location permissions to sync their position during deliveries. You can disable location permissions in your device settings, but some features (live tracking, rider dispatch) may not work.

We use Firebase Cloud Messaging to send push notifications about order status, new delivery assignments, and important service updates. You can disable notifications in the app settings or your device settings. When disabled, we remove or deactivate your device token on our servers.

Our website uses cookies and local storage to keep you signed in, remember your cart and preferences, and analyse site usage. You can control cookies through your browser settings. Disabling cookies may affect checkout and login functionality.

We use trusted third-party providers who process data on our behalf:

• Stripe — payment processing
• Google Maps — maps and address services
• Firebase (Google) — push notifications and app infrastructure
• Hosting and email providers — to operate our platform

These providers are bound by data processing agreements and may only use data as instructed by YR4U.

We do not sell your personal data. We may share data with:

• Delivery riders (limited: name, address, phone for active orders only)
• Payment processors (Stripe)
• Service providers listed above
• Authorities when required by law

All sharing is limited to what is necessary for the stated purpose.

We retain personal data only as long as necessary:

• Account data — while your account is active and for a reasonable period after closure
• Order records — as required by Portuguese tax and commercial law (typically 10 years for accounting records)
• Location data — for the duration of active delivery tracking, then aggregated or deleted
• Device tokens — until you log out, disable notifications, or uninstall the app

We implement appropriate technical and organisational measures including HTTPS encryption, secure password hashing, access controls, and secure token storage on mobile devices. No method of transmission over the internet is 100% secure; we continuously work to protect your data.

Under GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten") in certain circumstances
• Restrict or object to processing
• Data portability
• Withdraw consent at any time (where processing is consent-based)
• Lodge a complaint with CNPD (Comissão Nacional de Proteção de Dados), Portugal

To exercise your rights, email contact@yr4u.eu with your request. We respond within 30 days.

Our services are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Your data is primarily processed within the European Economic Area (EEA). If data is transferred outside the EEA (e.g. by cloud providers), we ensure appropriate safeguards such as Standard Contractual Clauses are in place.

We may update this Privacy Policy from time to time. We will post the revised version on this page with an updated date. Continued use of our services after changes constitutes acceptance of the updated policy.

For privacy questions or to exercise your rights:

Email: contact@yr4u.eu

Office: office@yr4u.eu

Address: Rua José Vicente Gonçalves, 8F, 2840-100 Seixal, Portugal

Website: https://www.yr4u.eu