Datenschutzerklärung (Privacy)
Draft for the pilot – to be completed and reviewed by a lawyer before public launch. Text in [brackets] is still missing.
Controller
Ranjeet Kumar Yadav, Gottschefstr 3, 13357 Berlin. Contact for privacy questions: hello@carrykin.de.
Account data
Name, e-mail, password hash, home city and community tags – to run your account (Art. 6(1)(b) GDPR). Password-reset links are sent by e-mail; only a hash of the link is stored, and it expires after 60 minutes.
Trips, needs, requests and chat
Route, dates, weights, item descriptions, photos and messages – to match and complete deals. Kin scans chat text to block contact details and links (legitimate interest in keeping deals protected, Art. 6(1)(f)).
E-mails
We send e-mails about your deals (new request, answer, payment, delivery, verification) and password resets. These are necessary to run the service you use (Art. 6(1)(b)). We send no newsletters or advertising.
Identity and flight documents
Uploaded documents are encrypted at rest and reviewed only by the Carrykin team. Rejected documents are deleted right after the decision. Approved documents are kept until 90 days after your last deal, then deleted – unless a reported problem requires us to keep them (legal hold). Every access is logged. Documents are never shown to other users and are disclosed only on a lawful request (e.g. police or court), with the reason recorded.
Payments
Payments and traveller payouts are processed by Stripe Payments Europe, Ltd. (Ireland). Card and bank details are entered on Stripe’s pages and are not stored by Carrykin; we receive the payment status, amount and a reference. Travellers who receive payouts give their identity and bank details directly to Stripe for legally required checks (KYC). Stripe privacy policy: stripe.com/privacy.
Kin Points and referrals
Points ledger, referral code and who invited you – to run the rewards programme and invite-only sign-up.
Service providers
Our hosting provider; MongoDB Atlas (database, region Frankfurt, Germany); Cloudflare R2 (photo and document storage); Resend (e-mail delivery); Stripe (payments). Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR); transfers outside the EU are covered by the EU standard contractual clauses.
Deleting your account
You can delete your account at any time under Account → Delete my account. Your name, e-mail, profile and open listings are removed immediately and ID documents deleted, unless a reported problem requires us to keep them. Past deals stay in the other person’s history as “Deleted user”. The encrypted identity record is kept for 90 days for legal claims, then deleted.
Your rights
Access, rectification, erasure, restriction, portability, objection and complaint to a supervisory authority (in Berlin: Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Cookies
Only a necessary session cookie (ck_session) is used. No tracking or advertising cookies.
Other pages: Impressum · Datenschutz · Terms (AGB)