ThumbitPrivacy Policy
Last updated: 13 October 2026
1. Who we are
Thumbit is run by Michael Binmore-May, trading as Thumbit, a sole trader in the United Kingdom. Michael is the data controller for the personal data Thumbit collects. This means he decides how it is used and is responsible for keeping it safe.
Thumbit is a booking app. It is not a taxi firm. Your journey is provided by an independent, licensed taxi or private hire firm. Thumbit Dispatch, our booking and dispatch system, sends your booking to local firms.
- Contact: support@thumbittaxis.com
- Website: thumbittaxis.com
This policy covers the Thumbit app and any Thumbit website. It explains what we collect, why, who we share it with, how long we keep it and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
2. What we collect and why
We only collect what we need to book and run your taxi journeys.
| What | Examples | Why we need it | Lawful basis |
|---|---|---|---|
| Your details | Name, mobile number, email address | Your account, sign-in codes, booking confirmations, so your driver can contact you | Contract |
| Booking details | Pickup and destination, date and time, passengers, luggage, notes for the driver, preferred taxi firms | To price, book and dispatch your journey | Contract |
| Booking extras | Pet, quiet ride, wheelchair-accessible vehicle | So the right vehicle and driver are sent | Contract; for an accessibility need, your explicit consent, given when you turn the option on |
| Location | Your phone's location, only when you tap "use my location" or use Emergency SOS | To set your pickup point, or to tell our safety team where you are | Contract; vital interests for SOS |
| Payments | Booking fee and any late-cancellation fee, card type and last 4 digits | To take the fees you agreed to | Contract |
| Trips | Booking history, driver and vehicle for each trip, trip status | To show your bookings and for our records | Contract; legal obligation for records we must keep |
| People you add | Family and carer profiles (name, mobile, optional email), trusted contacts (name, email), saved places | To book for someone else, or to send a tracking link to people you choose | Contract; legitimate interests |
| Feedback | Ratings, complaints, lost property reports, suggestions | To deal with your request and improve the service | Legitimate interests |
| Safety alerts | Emergency SOS alerts with your trip and location | To help you if you feel unsafe | Vital interests |
When you add someone else's details (a family member, carer or trusted contact), please make sure they're happy for you to do so.
We do not collect your contacts, photos, health records, or your location in the background.
3. Who we share it with
We never sell your personal data.
The taxi firm doing your journey. They receive your name, mobile number, pickup, destination, time, passengers, luggage, extras and notes, so they can carry out the trip. The firm is a separate data controller for that information. If you chose preferred firms, your booking is offered to them first.
People you choose. If you share a trip or turn on trusted contacts, those people get a link showing your trip's progress.
Service providers who run parts of Thumbit for us, under written agreements, using your data only on our instructions:
| Provider | What they do |
|---|---|
| Supabase | Hosts Thumbit's database and sign-in |
| Stripe | Takes card payments; Thumbit never sees your full card number |
| Twilio | Sends text messages and sign-in codes |
| Lovable | Sends booking emails and hosts the Thumbit Dispatch website |
| Address search, routes and journey times | |
| Apple | Maps on iPhone |
| postcodes.io (Ideal Postcodes) | Finds the postcode for a map position, to pick the right council tariff |
| Expo | Delivers app updates |
| GitHub | Hosts this website |
The law. We may share information with the police, a licensing council or a regulator where the law requires it, or to protect someone's safety.
4. No tracking, no advertising data, no cookies
Thumbit does not track you.
- We do not share your data with data brokers.
- We do not link your data with other companies' data for advertising or marketing.
- The app contains no advertising or analytics tools.
- The app does not use cookies. The only web page shown inside the app is Stripe's secure payment page. It opens in a private window that keeps nothing after it closes. Stripe uses strictly necessary cookies on that page for payment security and fraud prevention only. See Stripe's privacy policy.
- This website does not use cookies or analytics.
Posters on the home screen. Some may be adverts for local businesses, always labelled "Sponsored". Choosing which posters to show uses only the postcode area of your last pickup (for example "TQ9"), which is stored on your phone and not sent to us or to advertisers.
We will only send you marketing messages if you have agreed to them, and you can stop them at any time.
5. Location, payments, storage and security
Location. Thumbit only asks for your location while you're using the app. It's used when you tap "use my location" for your pickup, and when you send an Emergency SOS. You can turn it off in your phone's settings and type your address instead.
Payments. Card payments are handled by Stripe on its secure page. Stripe saves your card so the late-cancellation fee can be taken if it applies, as explained before you pay. We see only the card type, the last 4 digits and whether a payment worked.
How long we keep it.
| Information | Kept for |
|---|---|
| Your account | Until you delete it, then a 30-day grace period before it's erased |
| Booking and payment records | 6 years, for tax, accounting and licensing rules |
| Text message logs | About 30 days |
| Email delivery logs | About 3 months |
| Complaints and lost property reports | 2 years after they're closed |
Outside the UK. Some providers (Stripe, Twilio, Google, GitHub and parts of Supabase) process data in the United States. These transfers are protected by the UK Extension to the EU-US Data Privacy Framework and/or the ICO's International Data Transfer Addendum.
Security. Data is encrypted in transit and at rest. Each passenger can only see their own information, and taxi firms only see your details while your booking is active and for a short time after.
6. Your rights
You can ask us to:
- give you a copy of your data
- correct anything that's wrong
- delete your data
- limit or object to how we use it
- send your data to you or another service in a common format
Where we rely on your consent, you can withdraw it at any time. Email support@thumbittaxis.com and we'll reply within one month.
Deleting your account. In the app go to Settings → Delete my account, or see how to delete your account. Your account is erased after 30 days; sign in before then to cancel. Records we must keep by law (section 5) are kept separately.
Children. You must be 18 or over to have a Thumbit account. An account holder can book a trip for a child they're responsible for, using a family profile.
Changes to this policy. We'll post any changes here with a new date, and tell you in the app or by email if they're important.
Complaints. If you're unhappy with how we use your data, please contact us first. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.