1. Who processes your data
Spiicy Labs, based in Santo Domingo, Dominican Republic, which operates Ubuuus ("we").
For any question about your data: contact@spiicylabs.com.
2. What data we process and why
| Data | Where it comes from | What for |
|---|---|---|
| Buyer’s email and, if you give them, one email per ticket | You enter them when buying | Sending the receipt and tickets, and notifying you of changes to your trip |
| Passenger details: name, category (adult, child, student…) and, if the company requires it, ID document and phone number | You give them when buying, or at the ticket office | Issuing the ticket, checking the category and letting the company know who is travelling |
| Account: name, email, phone number, encrypted password or Google or Apple sign-in | You give them when creating the account | Letting you sign in and manage your tickets |
| Purchases and tickets: trip, seats, price, status, boarding (when it was scanned), changes, transfers and refunds | Generated by the service | Providing the service, handling complaints and keeping the accounts |
| Payment: the result of the charge | dLocal | Confirming the purchase and making refunds. Your full card number does not pass through Ubuuus: dLocal receives it directly. |
| Phone: notification (push) identifier, platform (iOS or Android) and notification preferences | The app, with your permission | Trip reminders, change notices and live tracking |
| Preferences: favourite routes and companies, light or dark mode | You choose them | Showing you what interests you |
| Technical data: IP address, browser, error and security logs | Your visit | Security, fraud prevention and fixing bugs |
We do not sell your data or use it for third-party advertising. We process it with your consent when you provide it, to perform the service you buy and to meet legal obligations, for example tax.
3. Who we share it with
| Who | What they receive | Why |
|---|---|---|
| The bus company running your trip | Passenger details, ticket, seat and boarding | It is the one transporting you |
| dLocal | Card details, the amount and device data for fraud prevention | Processing the payment |
| Carto | Your IP address, when the trips map loads | Showing the map |
| Our email provider | Your email address and the message content | Sending you tickets and notices |
| Expo, Apple and Google | Your phone’s notification identifier | Sending you push notifications |
| Google or Apple, if you sign in with them | What is needed to identify you | Sign-in |
| Our hosting provider | Service data, stored on their servers | Running Ubuuus |
| Authorities | What the law or a court order requires | Complying with the law |
Some of these providers are outside the Dominican Republic.
4. Cookies and storage in your browser
- The Ubuuus site does not use advertising or analytics cookies.
- The only thing it stores in your browser is whether you chose light or dark mode (local storage, not a cookie). You can clear it from your browser.
- Carto loads the trips map, and dLocal provides the payment form and may use device data to prevent fraud. They are governed by their own policies.
- If we ever add analytics or advertising, we will update this policy and, where the law requires it, ask for your consent first.
5. How long we keep it
- Account: for as long as you have it. If you request deletion, we delete it 90 days later; signing in again before then cancels the deletion. After that period, the account is anonymized: no name, email, phone number or Google or Apple sign-in.
- Purchases, tickets and payments: for as long as accounting and tax obligations require, even if you delete your account. They are unlinked from your anonymized account.
- Technical and security logs: for a limited time.
6. Your rights
You can ask us for access to your data, to correct it if it is wrong, to delete it, or object to a specific use.
You can request account deletion from the app. For anything else, write to contact@spiicylabs.com. If you are not satisfied, you can go to the competent authority.
7. Security
- Encrypted connections (HTTPS).
- Passwords stored encrypted.
- Role-based access: each company only sees its own data.
- Card details are handled by dLocal, not Ubuuus.
No system is infallible. If there is a breach that affects you, we will notify you as the law requires.
8. Minors
Minors can travel on a ticket bought by an adult, who provides their passenger details.
9. Changes
If we change this policy, we will publish it here with the new date and, for important changes, notify you by email.