Datenschutzerklärung (Privacy)
Draft for the pilot – to be completed and reviewed by a lawyer before public launch. Text in [brackets] is still missing.
Controller
Ranjeet Kumar Yadav, Gottschedstraße 3 · 13357 Berlin · Germany. Contact for privacy questions: hello@carrykin.de.
Account data
Name, e-mail, password hash, home city and community tags – to run your account (Art. 6(1)(b) GDPR). Password-reset links are sent by e-mail; only a hash of the link is stored, and it expires after 60 minutes.
Trips, needs, requests and chat
Route, dates, weights, item descriptions, photos and messages – to match and complete deals. Kin scans chat text to block contact details and links (legitimate interest in keeping deals protected, Art. 6(1)(f)).
E-mails
We send e-mails about your deals (new request, answer, payment, delivery, verification) and password resets. These are necessary to run the service you use (Art. 6(1)(b)). We send no newsletters or advertising.
Identity and flight documents
Uploaded documents are encrypted at rest and reviewed only by the Carrykin team. Rejected documents are deleted right after the decision. Approved documents are kept until 90 days after your last deal, then deleted – unless a reported problem requires us to keep them (legal hold). Every access is logged. Documents are never shown to other users and are disclosed only on a lawful request (e.g. police or court), with the reason recorded.
Payments
Payments and traveller payouts are processed by Stripe Payments Europe, Ltd. (Ireland). Card and bank details are entered on Stripe’s pages and are not stored by Carrykin; we receive the payment status, amount and a reference. Travellers who receive payouts give their identity and bank details directly to Stripe for legally required checks (KYC). Stripe privacy policy: stripe.com/privacy.
Sign-up questions
When you create an account you can optionally tell us whether you mostly send or travel, your usual route and how you heard about Carrykin. We use the answers only in counted form for our own statistics and to decide which routes to promote (legitimate interest, Art. 6(1)(f) GDPR). You can leave them empty.
E-mail confirmation and news
After sign-up we send one e-mail to confirm your address; only a one-way code of the link is stored and it expires after 72 hours. News and offers by e-mail are sent only if you ticked the box and then confirmed your address (double opt-in, Art. 6(1)(a) GDPR). You can withdraw at any time in your account settings or with the link in each e-mail; we keep the date of your consent as proof.
Visitor count
To show how many people visit the site, we count visits and each visitor once a day without cookies: the server forms a one-way, salted code from the date, your IP address and browser type and keeps it for at most 2 days only to avoid counting you twice; the IP address itself is not stored. Only the daily totals are kept (legitimate interest in simple, privacy-friendly statistics, Art. 6(1)(f) GDPR).
Kin Points and referrals
Points ledger, referral code and who invited you – to run the rewards programme and invite-only sign-up.
Service providers
Our hosting provider; MongoDB Atlas (database, region Frankfurt, Germany); Cloudflare R2 (photo and document storage); Resend (e-mail delivery); Stripe (payments). Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR); transfers outside the EU are covered by the EU standard contractual clauses.
Deleting your account
You can delete your account at any time under Account → Delete my account. Your name, e-mail, profile and open listings are removed immediately and ID documents deleted, unless a reported problem requires us to keep them. Past deals stay in the other person’s history as “Deleted user”. The encrypted identity record is kept for 90 days for legal claims, then deleted.
Your rights
Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority (in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Cookies
Only a necessary session cookie (ck_session) is used. No tracking or advertising cookies.
Other pages: Impressum · Datenschutz · Terms (AGB)