GoodHitch privacy notice

UK courier work-permission checks

Where applicable, authorised named reviewers record the prescribed check, work conditions, decision, follow-up dates and private evidence. Identity and permission to perform courier work are separate. This information is not shared with customers or other couriers. We do not require everyone to supply a share code and do not store share codes or dates of birth in the verification record.

Prescribed check evidence is retained securely for the applicable engagement and normally two years after its recorded end, subject to reviewed legal obligations and holds, then securely deleted. An application date is not assumed to be the contractual start or end date. Please do not send identity documents or share codes through general support messages.

Information we collect

• Account, contact and application information: name, email, phone, account identifiers, sign-in provider, selected market, courier interest details and support correspondence. Guest moves also use identifiers to let you recover or claim your requests.
• Move information: pickup, destination and extra-stop locations, collection time, item descriptions, quantity, dimensions, weight, item photos, access details, instructions and assistance needs.
• Courier information: transport and vehicle details, service area, availability, identity and licence documents, applicable licence checks, insurance documents or declarations, and review status. The information required depends on market and transport.
• Job and payment records: offers, fees, payment and payout status, Stripe references, refunds, progress, reviews, reports and disputes. Job proof can include photos and location coordinates, time and GPS accuracy; active-job tracking can include courier location.
• Technical and usage information: browser or app/device information, session data, notification preferences and push identifiers, security/request metadata, funnel events, source pages and advertising attribution such as UTM parameters and Facebook click identifiers where supplied. Hosting services may process IP addresses in request and security logs.

How and why we use information

We use information to save and resume applications and moves, authenticate users, review couriers, calculate quotes, match suitable jobs, coordinate delivery, record proof, process payments and payouts, send service notifications, provide support and resolve reports. We also use usage and attribution information to understand the customer and courier journeys and improve the service, and security information to prevent abuse, fraud and unauthorised access.

Where UK data protection law applies, our purposes include taking steps at your request and performing our service agreement, legitimate interests in operating and protecting the marketplace and improving the service, and meeting legal obligations for accounting, payments and compliance. Where processing relies on consent, you can withdraw that consent. Optional device permissions and notification preferences can be changed in the app or device settings; turning off push does not by itself stop service emails.

Who receives information

We share information needed to operate the service with providers acting as processors or, where applicable, independently responsible for their own processing. These include:

• Supabase for authentication, database and private file storage; Vercel for hosting, request/security processing and Web Analytics.
• Stripe for payments, connected-account onboarding and payouts. Card entry is handled by Stripe; GoodHitch does not store full card numbers or card security codes.
• Resend for service and authentication emails; Porkbun email forwarding and Google Gmail for support correspondence; Expo and Google Firebase/FCM for native push delivery, and browser push providers for web notifications.
• Postcodes.io and Zippopotam.us for postcode/ZIP location lookups used in route estimates. These lookups send postal codes rather than courier documents or account credentials.
• Auth0 for the separate AI/MCP authorisation flow, and the AI service you choose to use, as explained below.

Customers and couriers receive the job information needed for a move. Customer contact details are not shown to couriers before a paid job is accepted. Job proof and relevant progress information are available to the customer, assigned courier and authorised administrators. Verification documents, private account details and payout information are not public listings or shared with unrelated customers or couriers. Authorised staff may access information for review, support and safety.

We may disclose limited relevant records to professional advisers, payment/dispute providers, regulators or law enforcement where necessary and lawful. Providers may process information outside your country. Contact us for information about the providers and applicable international-transfer arrangements for your data.

GoodHitch does not sell your personal information.

GoodHitch AI and MCP customer tools

If you use GoodHitch through an AI service such as ChatGPT, that service sends the move details you provide to GoodHitch for a quote. These can include market, route locations, item descriptions and measurements, quantity, timing, assistance and extra-stop details. GoodHitch returns the quote, move summary, requirements and warnings to that service. Your conversation and tool results are also subject to the AI provider's own privacy policy and settings.

Quotes can be requested without linking a GoodHitch account. Creating a booking review link requires separate Auth0 authorisation. GoodHitch validates the authorisation and uses limited authentication identifiers in hashed form for abuse protection; it does not automatically merge Auth0 identities with Supabase accounts based on email.

The quote reference and review handoff are encrypted, short-lived capabilities that expire after 15 minutes. Keep the review link private. The tools do not expose private customer accounts, courier documents, courier contact details, payout information or administrator records. They do not take payment, create a paid job or assign a courier. You review the move and continue through GoodHitch's existing customer and payment flow yourself.

How long we keep information

Retention depends on the purpose: keeping your account and saved application usable, fulfilling a move, handling support or disputes, preventing fraud, and meeting legal or accounting requirements. Unpaid, expired or cancelled requests may be retained for service records and analytics; expiry does not mean immediate deletion. Other personal data is kept only as long as legally or operationally necessary, and eligible data can be deleted through an account deletion request. The 15-minute AI handoff expiry is not a retention period for all service, provider or security records.

As explained on our account deletion page, limited transactional and accounting records may be kept for up to seven years, or longer where an active legal, regulatory, fraud or dispute matter requires it. Required records are restricted and are not used to keep a deleted account active. Contact us about retention of a particular record.

Your choices, rights and contact

Depending on the law that applies and the reason for processing, you may request access to, correction or deletion of your information, restrict or object to processing, request a portable copy, or withdraw consent where we rely on it. These rights are subject to applicable exceptions, including required transactional and compliance records. We may need to verify your identity to protect your information.

For privacy requests or support, email our monitored official contact: contact@goodhitch.com. Do not email passwords, payment card details or verification documents unless we arrange a secure method with you.

You can also request account and eligible personal-data deletion on the account deletion page, without the app installed. You may complain to your applicable data protection authority; in the UK this is the Information Commissioner's Office.