1. Introduction
Vanmanoo ("Vanmanoo", "we", "us", "our") operates a digital marketplace that connects Customers requiring transport services with independent Drivers who provide those services.
This Privacy and Cookie Policy explains how we collect, use, store, share, and protect personal data when you access or use our website, mobile applications, or any related services (together, the "Platform").
This Policy applies to Customers using Vanmanoo to book transport services, Drivers providing services through the Platform, Visitors to our website, and any individual interacting with Vanmanoo. By using the Platform, you acknowledge and agree that your personal data will be processed as described in this Policy.
2. Data Controller & Responsibility
Vanmanoo is the data controller for personal data processed through the Platform under UK GDPR. This means Vanmanoo determines what personal data is collected, how it is used, why it is processed, and how long it is retained.
Drivers act as independent service providers. However, Vanmanoo remains responsible for the Platform-level processing of personal data.
3. Platform Model (Marketplace Structure)
Vanmanoo is a technology platform only. We do not provide transport or logistics services ourselves.
Our role is limited to facilitating bookings between Customers and Drivers, enabling communication between parties, processing payments via third-party providers, and providing dispute support and platform safety tools.
4. Information We Collect
4.1 Data provided directly by users
- Full name
- Contact details (email, phone number)
- Collection and delivery addresses
- Booking details and item descriptions
- Payment information (processed securely by third-party providers)
- Support communications
- AI quote inputs you choose to provide — move descriptions, item photos and voice recordings (voice audio is deleted once transcribed)
4.2 Data collected automatically
- IP address and device identifiers
- Approximate location data
- Browser type and operating system
- App usage and interaction data
- Pages viewed and navigation behaviour
- Cookies and similar technologies
4.3 Driver-specific data
- Identity verification data
- Driving licence and insurance details
- Vehicle information
- Bank/payment details
- Background verification data (where applicable)
- Real-time and background location data during active use
Location data is used strictly for operational purposes such as job allocation, tracking, and service updates.
5. Purposes of Processing
- Booking facilitation between Customers and Drivers
- Payment processing and refunds
- Account management and authentication
- Customer support and dispute resolution
- Safety, fraud prevention, and risk detection
- Platform optimisation and service improvement
- Legal and regulatory compliance
- Service notifications and operational communication
6. Lawful Basis for Processing (UK GDPR)
Contract
To provide services requested by users (e.g. booking a Driver).
Legitimate Interests
- Operating and improving the Platform
- Ensuring security and fraud prevention
- Managing disputes
- Analysing usage to improve services
We ensure these interests do not override user rights.
Legal Obligation
Where required by law (tax, regulatory, or legal requests).
Consent
For marketing communications and non-essential cookies.
8. International Data Transfers
Our primary database is hosted by MongoDB Atlas in Ireland (EU), which the UK recognises as providing adequate protection (UK adequacy regulations). Our team accesses it from the United Kingdom.
Some processors operate in the United States — Stripe, Mapbox, Resend, PostHog and OpenAI (via Emergent). Those transfers rely on the UK–US Data Bridge (UK Extension to the EU–US Data Privacy Framework) where the provider is certified, or otherwise the ICO's International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, plus encryption in transit and at rest.
We never transfer personal data outside the UK for third-party marketing purposes.
9. Data Retention
We retain personal data only for as long as necessary. Retention periods include:
- Account data: duration of account + up to 6 years after closure
- Booking data: up to 6 years (contractual/legal disputes)
- Payment data: retained by payment providers under their policies
- Support communications: up to 3 years
- Driver verification data: duration of active account + legal retention period
- Analytics data: typically 12–24 months (aggregated where possible)
After retention periods expire, data is securely deleted or anonymised.
10. Data Security & Breach Management
We implement appropriate technical and organisational measures including:
- Encryption of sensitive data
- Access controls and authentication systems
- Secure hosting environments
- Regular system monitoring and audits
Data Breach Handling
In the event of a personal data breach, Vanmanoo will assess the risk immediately; take steps to contain and mitigate the breach; notify the UK Information Commissioner's Office (ICO) where required; and notify affected users without undue delay where there is a high risk to rights and freedoms.
11. Automated Decision-Making & Profiling
Vanmanoo may use automated systems to match Customers with Drivers based on location and availability; detect fraud or suspicious activity; and prioritise service allocation efficiency. Prices are calculated from the details you enter (van size, helpers, hours, distance, stairs, date) and each Driver's own published rates — not by profiling you. These processes do not produce legal or similarly significant effects without human oversight, and you can ask for a human review of any automated outcome via the request form in Section 12.
12. Your Rights Under UK GDPR
- Access your personal data
- Correct inaccurate data
- Request deletion
- Restrict processing
- Object to processing
- Data portability
- Withdraw consent
Submit any of these requests free of charge using the form below (or via Vanmanoo support). We will confirm your identity and respond within one calendar month (UK GDPR Art. 12), extendable by two further months for complex requests — we will tell you if so. You will receive a reference number (UKPR-…) to track your request, and our privacy team works from a queue with a live 30-day countdown for every request.
Self-service (instant): signed-in users can download all their data (JSON — access & portability), switch marketing emails on or off (withdraw consent) and delete their account from the Account settings card on their dashboard. Booking and payment records are retained for the periods in Section 9 and then erased automatically.
You may also lodge a complaint with the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow SK9 5AF.
14. Marketing Communications
We send marketing communications only with your opt-in consent (the unticked box at sign-up or on the quote form). We do not send personal data outside the United Kingdom for marketing purposes. You may opt out at any time via the unsubscribe link in every email, the Marketing emails switch in Account settings, or by contacting support — booking and safety messages continue regardless.
15. Children
Vanmanoo is not intended for individuals under 18. Every sign-up requires an "I am 18 or older" attestation which we record with a timestamp, and we do not knowingly collect data from minors; if we learn we have, we delete it.
15A. Public Job Listings, Photos & Retention (Post a Job / Bidding Board)
Public listings. When you use Post a Job or the Bidding Board, you are asking VanManoo to publish your move as a public listing on our website and apps (UK and USA, desktop and mobile). The listing shows the move details you enter (date, time window, van size, helpers, hours, stairs, suggested price / budget), the general area only (the outward part of your postcode / ZIP area — never your door number or full address) and any photos of the items you are moving that you choose to upload. It can be seen by drivers and by any member of the public browsing VanManoo. We never publish your name, email address, phone number, exact address or notes; those are shared only with the driver whose bid you accept. You must tick the public-listing box in the form before a listing is published, and you must only upload lawful photos that show the items being moved (see our Prohibited & Illegal Content Policy in the form).
Storage limitation — 14-day active window. Under UK GDPR and the Data Protection Act 2018 we may not keep personal or transactional data in public view for longer than necessary. We therefore run an automated four-stage lifecycle for every public listing:
- Active public listing (1–14 days). A move can only be listed for a date within the next 14 days and is shown publicly for a maximum of 14 days (or until 6 hours after the move time, whichever is sooner) so drivers can bid.
- Automatic removal on confirmation. The moment you accept a bid and the booking fee / card hold is confirmed, the listing is taken off the public website automatically. The job then lives only in the private dashboards of you and your assigned driver.
- Internal record window (30 days). Expired, unaccepted or completed jobs stay in your account history and your driver's account for 30 days so we can handle support tickets, extra-time charges and disputes.
- Permanent photo & file scrubbing (14–30 days after the job). All uploaded room / item photos and exact access details are permanently deleted from our servers and cloud storage no later than 30 days after the job date or listing expiry. Deleted photos cannot be recovered.
Why receipts stay while photos are scrubbed. Your booking record, receipts and invoices (what you paid, when and to whom) remain visible in your account indefinitely and are retained by us for 6–7 years as required for tax and accounting purposes (HMRC). High-resolution photos of your home and belongings are a long-term privacy risk, so they are automatically removed after 30 days in line with the storage-minimisation principle. You may ask us to remove a listing or its photos sooner at any time via your dashboard or our support team (we respond to privacy requests within 30 days).
Public photos & the three mandatory image privacy protections. Photos you attach to a listing are shown on the VanManoo main page and Bidding Marketplace (UK and USA, website and apps) and can be seen by anyone — public visitors, drivers and other customers — for as long as the listing is active. Because of this, every uploaded photo passes through an automated privacy pipeline before it is stored or displayed:
- Automatic EXIF & GPS metadata stripping. Smartphone photos contain hidden metadata (exact GPS coordinates, timestamp, device identifiers). Every photo is re-encoded on upload and all EXIF metadata is permanently removed, so nobody can download a picture and extract your home address.
- AI face, pet, plate & background blurring. Our automated system detects human faces, people, pets, vehicle licence / number plates, house or door numbers, screens, paperwork and framed personal photos and blurs them; the background (walls, doors, driveways) is softened so only the items being moved stay clear. Photos of ID documents, bank cards, adult content, weapons or hazardous materials are rejected outright. Automated detection is not perfect — you remain responsible for removing anything sensitive before uploading.
- 30-day retention & automatic deletion. Photos never stay public indefinitely: they leave the public board the moment a bid is accepted or the listing expires, and an automated daily job permanently deletes or archives job photos no later than 30 days after the job is completed (UK GDPR storage-limitation principle).
16. Complaints
If you are unhappy with how we handle your data, contact us first via support. For further information about your rights under UK GDPR, please see the Information Commissioner's Office (ICO) guidance on individuals' rights.
17. Changes to This Policy
We may update this Policy from time to time. Changes take effect when published.
18. Contact
Privacy requests: use the request form in Section 12 or contact Vanmanoo support. Data Protection lead: hello@vanmanoo.uk.