Kocheras Home Privacy Policy
Applies to Kocheras Home. For companies there is the Business privacy policy, which includes the data processing contract.
Last updated: 18 August 2026 Data controller: The Kilite SL, tax ID B66873118 (EU VAT number ESB66873118), registered at C/ Modolell 29B, 08021 Barcelona, Spain. Contact: hello@kocheras.app.
What we store and why
| Data | Why | Required? |
|---|---|---|
| Name and email | Your account and notifications | Yes |
| Password (encrypted) | Signing in | Yes |
| Phone | So people sharing a car with you can reach you | No |
| City | Showing nearby cars | No |
| Profile photo | So others recognise you | No |
| Whether your identity is verified, and the date it was verified | Trust between strangers | No |
| That you declare your licence is valid, and its expiry date if you give it to us | So you know what you are committing to, and to remind you before it expires | No |
| Bookings, mileage, fuel | Running the app and splitting costs | Yes |
| Expenses and receipt photos | Splitting costs | No |
| Issue photos | Recording damage | No |
| Vehicle location when returned | So the next person can find it | No |
| Ratings | Reputation | Yes, if you rate |
| What you ask the Help assistant, and what it answers | Keeping the thread of the conversation, checking what it told you if something goes wrong, and seeing what the help is missing | No |
| What you ask for through the assistant | Getting it to the team that has to fix it | No |
| Billing details (name or company name, tax ID, address) | Issuing the invoice the law requires | Yes, if you take out a paid plan |
We do not store ID card or driving licence numbers, nor any photo of the document.
Of the licence we keep three things and no more: that you declare it is valid, its class — B, C, A2 — because that is what decides which vehicles you may drive, and its expiry date if you choose to give it to us, which is only used to remind you before it arrives. Leave it blank and it is not stored.
Kocheras does not check that you hold a licence, nor monitor that it stays valid. Driving on an expired licence is the driver's responsibility, not ours.
There is no real-time tracking. Location is recorded only at the moment a vehicle is returned, and is visible to people with access to that car.
Legal basis
- Performance of a contract: the data needed for the app to work.
- Consent: phone, photos, location and marketing messages. You can withdraw it.
- Legitimate interest: fraud prevention and service security.
- Legal obligation: retaining information where the law requires it.
Who can see your data
- People you share a vehicle with see your name, photo, rating, your bookings for that car and, if you provided it, your phone number.
- The vehicle owner also sees whether your identity is verified and your licence declaration (which classes you say you hold) — never the documents themselves. The licence is not verified: it's your own declaration.
- Kocheras administration can see the data needed to provide support and resolve issues. It never sees identity documents. Any change it makes is logged under its own name in your account's activity log, where you can see it.
- No one else. We do not sell or share your data for advertising.
The Help assistant
Inside Help there is an assistant that answers questions. To answer you it reads your account data: your bookings, your vehicles and, if you have permission to see them, the expenses. It does so with your own permissions: what you can't see in the app, the assistant can't see either.
Three things worth knowing:
- The assistant does nothing on its own. It can suggest things — booking a car, logging an expense, cancelling a booking — but nothing happens until you confirm it, and it is done with your permissions, just as if you did it yourself.
- Your question and that data are sent to the model provider listed below, to generate the answer. They are not used to train any model: that is in the contract.
- Nobody on your account sees the conversation. Not the owner, not whoever manages it. Only you and, if needed to resolve an issue, our support team.
If you'd rather not use it, don't: the help articles are complete and go nowhere.
The reports and campaign emails
If you request a report or leave your details in a form on the website, we store your first name, surname, email and whether you want it for home or for a fleet, for one purpose only: to send you the report and, if you agree, the odd email about Kocheras. There is no profiling or third-party advertising, and we do not sell or share this data.
The legal basis is your consent, given when you tick the form's box. You can unsubscribe from any email we send, or by writing to hello@kocheras.app. We keep the data until you unsubscribe; if there is no contact for 18 months, we delete it.
The form is handled by Netlify Forms and each submission reaches us by email at hello@kocheras.app. Netlify Forms processes this data in the USA under standard contractual clauses (see the table below).
Processors
| Who | What for | Where |
|---|---|---|
| Supabase | Database, accounts and storage | European Union (Frankfurt) |
| Netlify | Web hosting | European Union |
| ZeptoMail (Zoho) | Sending the application's emails | European Union |
| Firebase Cloud Messaging (Google) | Mobile notifications | USA, with standard contractual clauses |
| Stripe | Charging and invoicing | EU, with standard clauses for the USA |
| The Help assistant's provider | Generating the assistant's answers | Stated on this page once the assistant is switched on |
| Google Analytics (Google Ireland Ltd.) | Measuring anonymously how the public website is used, only if you accept | EU, with transfer to the USA under standard contractual clauses |
| Metricool (Metricool SL) | Measuring anonymously the public website's traffic, only if you accept | European Union (Spain) |
| Netlify Forms | Collecting the lead-capture form submissions (the campaign reports) | USA, under standard contractual clauses |
There is a data processing agreement with all of them. None of them uses your data to train models, for advertising or for anything of their own.
How long
For as long as your account is active. When you delete it, we remove your personal data. A vehicle's history may be kept anonymised so the owner retains their mileage and expense records.
Conversations with the assistant — what you ask, what it answers and what it suggested you do — are kept for 18 months and then delete themselves. They are there so we can check what happened if you raise a complaint.
Guest loans
If someone lends you a car without you having a Kocheras account, we keep your name and email only to record who had the vehicle and so you can complete the return from the link. You don't need to create an account.
This data is automatically deleted after 18 months from the loan if you don't create an account. If you want it deleted sooner, write to us at hello@kocheras.app. The loan record may be kept in anonymised form as proof of the vehicle's use.
Your rights
You can access, correct, delete, restrict or object to processing, and take your data with you. In the app: Profile → Terms and privacy → Your data. Or write to hello@kocheras.app.
If you believe we haven't handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).
Minors
Kocheras is for adults. If we identify an account belonging to a minor, we will delete it.