1. Who We Are
CabPass is operated by CABPASS LTD (company number 17266625), registered in England and Wales. We are the data controller for personal data collected through this service. Contact us at support@cabpass.co.uk.
2. What We Collect
We collect the following information when you register:
- Full name and email address
- Phone number and home address
- Operating area (Manchester locality)
- Payment confirmation (on the website, processed by Revolut — we do not store card details)
We also automatically collect:
- Usage data — which questions you answer, your scores, session timestamps
- Technical data — IP address, browser type, device type
3. How We Use Your Data
We use your data to:
- Create and manage your account
- Provide access to study materials and track your progress
- Process and verify your payment
- Send service-related emails (password resets, account notices)
- Improve the quality and accuracy of our question bank
We do not use your data for marketing without your explicit consent. We do not sell your data to third parties.
4. Legal Basis for Processing
Under UK GDPR, we process your data on the following bases:
- Contract — processing your registration and payment
- Legitimate interests — preventing fraud, improving the service, ensuring security
- Legal obligation — complying with applicable law
5. Data Sharing
We share data only where necessary:
- Revolut — payment processing (their privacy policy applies to card data)
- Apple and Google — if you buy access inside the CabPass app, the purchase is processed by the App Store or Google Play under their own privacy policies; we never see your card details
- RevenueCat, Inc. — our in-app purchase processor; receives the store receipt, your CabPass user number and device platform to confirm the purchase (US-based, UK-GDPR adequate safeguards via standard contractual clauses)
- Hosting provider — server infrastructure within the UK/EU
- Law enforcement — where required by law
Apart from the in-app purchase records held by RevenueCat (see Mobile Apps below), no personal data is transferred outside the UK/EEA.
6. Data Retention
We retain your account data for as long as your account is active and for up to 2 years afterwards, unless you request earlier deletion. Usage/score data may be retained in anonymised form indefinitely for service improvement.
Separately, records of payments (date, amount, order or store transaction reference) are kept for 6 years as UK tax law requires; when you delete your account your name and email are removed from them.
7. Your Rights
Under UK GDPR, you have the right to:
- Access — request a copy of your personal data
- Rectification — correct inaccurate data
- Erasure — request deletion of your data
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Restriction — request we limit processing in certain circumstances
To exercise any of these rights, email support@cabpass.co.uk. We will respond within 30 days.
You can delete your account yourself at any time from Settings → Delete account in the CabPass app, or at cabpass.co.uk/delete-account.php. Deletion is immediate.
8. Cookies
We use two first-party cookies: an essential session cookie that keeps you signed in, and a 90-day referral cookie that is only set if you arrive through a referral partner's link, so we can credit that partner. Neither tracks you across other websites, and no third-party tracking or advertising cookies are used. Full details are in our Cookie Policy.
9. Security
All data is transmitted over HTTPS. Passwords are stored as one-way hashes (bcrypt). On the website, payment processing is handled entirely by Revolut — we never see or store your card details. Access to our production database is restricted to authorised personnel only.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. Continued use of the Service after notification constitutes acceptance of the updated policy.
11. Complaints
If you believe we have mishandled your personal data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
12. Live Chat
You can message us through the live chat bubble on our pages. The chat runs entirely on our own server — no third-party chat or analytics service is involved. When you use it we store the messages you send and our replies, the page you started the chat from, your browser type, and the time of each message. If you are signed in, the conversation is linked to your account so we can help with it; if you are not, it is linked only to a random identifier held in your browser's local storage (see our Cookie Policy). You may optionally leave an email address so we can reply when you have left the site; we use it only for that conversation.
New chat messages alert the owner by email and by a push notification sent through our own private notification relay to the owner's phone — no third-party messaging platform sees your message. If you have left an email address and have left the page, our reply may be emailed to you as well as shown in the chat. Closed conversations are deleted 12 months after they close, and chats linked to an account are deleted with the account. You can ask us to delete a conversation sooner at any time by emailing support@cabpass.co.uk.
13. Mobile Apps and In-App Purchases
The CabPass app for iPhone and Android uses the same account and the same data as the website. When you buy 6 months of access inside the app, Apple or Google take the payment and issue a receipt. The receipt is checked by RevenueCat, Inc. on our behalf and we store: the store (App Store or Google Play), the store transaction reference, the date, the price paid and which account it belongs to. We use this to unlock your access, to honour store refunds and to keep the tax records described in section 6. Refunds for in-app purchases are handled by Apple or Google under their rules; our own 14-day guarantee in the Terms applies to payments made on the website.
The app does not use advertising identifiers, analytics SDKs or tracking of any kind.