Terms of Service and Privacy Policy

Dabba is an intermediation platform that connects private individuals who need to send parcels (Clients) with private individuals already travelling and willing to carry them (Drivers).

Dabba is neither a carrier nor a courier. It does not perform transport itself and is not a party to the transport contract between Client and Driver.

The service is available to users resident in Italy who are of legal age and hold a valid identity document.

To use Dabba you must create an account by providing:

• First and last name, phone number, date of birth and Italian tax code (codice fiscale)
• A valid email address
• For drivers: vehicle details, photos of their ID document (front and back), a selfie holding the document and a self-declaration (valid licence and insurance)

The user is responsible for the accuracy of the information provided and for keeping their access credentials confidential.

• Correctly declare the contents, weight and value of the parcel
• Not send prohibited items (see section 5)
• Package the parcel adequately for transport
• Be available for pickup at the agreed times
• Pay the amount agreed with the Driver through the platform
• Communicate with other users only through Dabba chat: exchanging phone numbers, email addresses or other contacts is not allowed

The Client is liable, both civilly and criminally, for false declarations about the contents of the parcel.

• Carry out the transport with care and diligence
• Not open, damage or withhold the parcel
• Respect the pickup and delivery times
• Promptly report any delays or problems
• Hold a valid driving licence and a vehicle insured for the declared use
• Communicate with other users only through Dabba chat: exchanging phone numbers, email addresses or other contacts is not allowed

It is strictly forbidden to send via Dabba:

• Weapons, ammunition and potentially dangerous items
• Narcotic, psychotropic or illegal substances
• Live animals
• Cash, credit cards, securities
• Dangerous goods (flammable, explosive, corrosive)
• Prescription medicines without documentation
• Any goods whose shipment is prohibited by Italian law

Violation of this article results in the immediate suspension of the account and reporting to the competent authorities.

Payments are processed by Stripe, a PCI-DSS certified provider. Dabba never sees or stores your card details.

At booking the amount is only held on your card: you are charged when a Driver accepts the shipment. If you cancel first, or nobody accepts it within 6 days, the hold is released with no charge.

At checkout you can choose to save your card for next time: Stripe stores it, not Dabba. In the app you only see brand, last 4 digits and expiry, and you can remove it at any time in Profile → Account → Wallet.

The amount paid by the Customer stays with Dabba until the shipment is completed: it does not go straight to the Driver.

• Delivery completed: once the recipient gives the delivery PIN, the Driver is owed 80% of the amount, paid out after 5 business days. Dabba keeps 20% as a service fee.
• Cancelled before pickup: full refund to the Customer, issued immediately; it usually arrives within 5–10 business days.
• Parcel picked up but not deliverable: the Driver must bring it back to the Customer. The full refund is issued only when the Customer has the parcel back and gives the Driver the return PIN. In this case the Driver receives nothing.

Dabba is not responsible for:

• Damage, loss or theft of the parcel during transport
• Delivery delays
• Misconduct by Clients or Drivers
• Service interruptions due to force majeure

Dabba's maximum liability is limited to the amount of the fee received for the transaction. We recommend separately insuring high-value parcels.

After each completed shipment, the Client can leave a rating (from 1 to 5 stars) for the Driver. Ratings are public and contribute to the Drivers' reputation on the platform.

Leaving false, intimidating or bad-faith ratings is prohibited.

Dabba may suspend or close an account in case of:

• Breach of these Terms
• Fraudulent or abusive behaviour
• Repeated negative ratings
• Prolonged inactivity (over 24 months)

You can delete your account at any time in the app (Profile → Account → Close my account). Deletion is immediate: we erase your profile, vehicles, trips, documents, photos, notifications and devices. Completed shipments are kept for tax purposes in anonymous form, without addresses, coordinates or email. If you have shipments in progress or payouts still due, you can delete your account once they are completed. Route alerts and cards saved on Stripe are deleted too.

Data controller

Wajdi Saidani — Viale Cavalieri di Vittorio Veneto 43, 22070 Cirimido (CO), Italy. Email: privacy@dabba.it. We answer requests about your data within 30 days.

What data we process

• Account: first and last name, email, phone, date of birth, tax code, profile photo (optional), language, referral code. If you sign in with Apple or Google, we receive your name and email from them (including Apple's anonymous address).
• Shipments: pickup and delivery addresses and coordinates, weight, type and value band of the parcel, parcel photo, recipient's first and last name and email (used only to send them the tracking link and the delivery code; the driver sees only the name, after accepting; we delete them 30 days after delivery or cancellation), codes and PINs, shipment status, reviews.
• Chat: messages between sender, driver and recipient. The Dabba team may read them only to handle reports and support requests, prevent fraud and keep deliveries safe.
• Drivers: vehicle and number plate, VAT number if any, the self-declaration they accepted (text, language and date) stating that they hold a valid ID and, for motor vehicles, a valid licence and insurance, published trips, GPS location during shipments in progress. Photos of the ID document (front and back) and a selfie holding it: the Dabba team compares them by eye to verify identity, with no automated facial recognition, and never shows them to other users. The details printed on the front and back (name, date of birth, number and expiry) are read automatically by an AI service (Anthropic's Claude) to check them against the profile; the selfie is not analysed and the final decision is always taken by a person on the team.
• Payments: customer payments are handled by Stripe: Dabba only receives amounts, outcomes and transaction IDs. To pay drivers, Dabba stores the account holder's name and the IBAN or PayPal address entered in the app: only Dabba's administration can see them and they are used solely to send payments.
• Notifications and support: device token for push notifications, notifications in your inbox, messages to support and reports.
• Consents: date you accepted the Terms and your newsletter choice.
• Technical data: system logs and app error reports (error message, screen, app version and device type). If you are signed in, the report is linked to your account so we can understand and fix the problem.
• Instructions and delivery photo: if you write them, the pickup and delivery instructions (buzzer, floor, meeting point); the optional delivery photo taken by the driver when handing over the parcel.
• Route alerts: if you ask to be alerted when there is a trip, we store departure and arrival cities, their coordinates and any date, to email you when a driver publishes a matching trip.
• Saved cards: the ID of your customer profile on Stripe, needed for saved cards. The card itself is stored by Stripe.
• Delivery security: when a driver confirms a pickup or delivery from an iPhone, the app uses Apple's App Attest service to prove the request comes from the genuine Dabba app. We store the public key created by the phone (the private key never leaves the device) and the result of each check.
• Android app statistics (Google Analytics for Firebase): we automatically collect the app installation identifier, the Android advertising identifier when available, usage events (app opens, sessions and screens) and approximate location derived from the IP address. We use these data to understand how the app is used and improve it. Precise GPS location used for deliveries is processed separately.

For these statistics, we do not send names, email addresses, chat content or photos to Firebase Analytics. We have not enabled Google Signals, links to Google Ads or Analytics data sharing with other Google products and services. Data are transmitted using TLS encryption. Push notifications are handled separately by Firebase Cloud Messaging.

Why we process it and on what legal basis

• To provide the service (account, shipments, payments, refunds, payouts, notifications and service messages): performance of the contract (Art. 6(1)(b) GDPR).
• To verify drivers' identity and eligibility, keep deliveries safe and prevent fraud and abuse: performance of the contract and legitimate interest (Art. 6(1)(b) and 6(1)(f)).
• To comply with tax and accounting obligations: legal obligation (Art. 6(1)(c)).
• To send you our newsletter with offers and news: only with your consent (Art. 6(1)(a)), which you can withdraw at any time in Profile → Account → Communication preferences.
• In newsletter emails we measure whether they are delivered, opened (using an invisible image) and whether you click a link: we use this only to see the results of each mailing, which we look at as totals. If you don't want opens to be detected, block image loading in your email app.
• To fix bugs, improve app stability and defend our rights in case of disputes: legitimate interest (Art. 6(1)(f)).

We do not profile you and we do not make decisions based solely on automated processing. Prices suggested to drivers are only indicative.

Name, email, phone, date of birth and tax code (and, for drivers, ID photos, selfie and self-declaration) are needed to use Dabba: without them we cannot provide the service. The newsletter is optional.

Who we share data with

With the other users of a shipment, only what is needed: the driver sees the sender's name and the pickup and delivery addresses; sender and recipient see the driver's name, photo, rating, vehicle and location during transport; the recipient receives the shipment code and the delivery PIN. After accepting, the driver also sees the pickup and delivery instructions; sender and recipient also see the delivery photo, if any. Other users never see your email, phone number, date of birth or tax code.

Anyone with the tracking link (dabba.it/traccia), which the sender or recipient can share, can see without signing in the shipment status, the departure and arrival cities, the driver's first name, rating and vehicle, and their location during transport. The link stops working 48 hours after delivery or cancellation.

With the providers that run Dabba, appointed as data processors (Art. 28 GDPR):

• Supabase — database, sign-in and files (servers in Ireland, EU)
• Stripe — payments and refunds
• PayPal — sending earnings to drivers who choose it
• Resend — sending emails
• Anthropic — reading drivers' ID document details (Claude)
• Google — maps, Google sign-in, push notifications (Firebase Cloud Messaging) and Android app usage statistics (Google Analytics for Firebase)
• Apple — Apple sign-in, push notifications on iPhone, app integrity check (App Attest)
• Komoot (Photon) — address suggestions (Germany)
• Sentry — app error reports (EU)
• Vercel — hosting of dabba.it and of the admin panel

Some of these providers may process data in the United States: transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's Standard Contractual Clauses. We do not sell your data or use it for third-party advertising; we disclose it to authorities only when required by law.

How long we keep it

• Account data: as long as the account exists; erased immediately when you delete it.
• Shipments and payments: 10 years for tax purposes (Art. 2220 Italian Civil Code); after account deletion only in anonymous form.
• Drivers' self-declaration: as long as the account exists. ID photos and selfie: rejected application, 30 days after the decision; approved, as long as the account exists.
• GPS location: shared only during shipments in progress; the delivery point is kept as proof of delivery.
• Inbox notifications: 90 days.
• Chat messages: 12 months, then we delete them automatically.
• Newsletter: until you withdraw consent; delivery, open and click data for each email stay linked to your account for 12 months, then only as anonymous totals.
• Error reports: up to 90 days.
• Route alerts: until the chosen date or, without a date, 90 days at most; you can delete them earlier.
• Delivery security checks (App Attest): 12 months.
• Parcel and delivery photos: as long as the account of whoever uploaded them exists.

Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, object to processing based on legitimate interest and withdraw consent at any time. Much of this you can do directly in the app:

• Profile → Personal details: edit your data
• Profile → Account → Communication preferences: newsletter on or off, route alerts
• Profile → Account → Wallet: saved cards
• Profile → Account → Security and privacy → Download my data: get all your data by email in one file
• Profile → Account → Close my account: immediate deletion, including cards saved on Stripe

For anything else write to privacy@dabba.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (garanteprivacy.it) or with the authority of your country.

Security and minors

Data is encrypted in transit; chats are visible only to the people in the shipment and, for reports and support, to the Dabba team;parcel photos are private and visible only to the Dabba team; pickup, delivery and return PINs are checked on the server. Dabba is for adults only: we do not knowingly collect data from anyone under 18.

The delivery photo is visible only to sender and recipient. When a PIN is on screen, Android blocks screenshots and recordings, and the iPhone hides it while the screen is being recorded or shared.

The dabba.it website uses only technical cookies needed for it to work: no profiling, analytics or third-party advertising cookies. The app stores your sign-in session, language and preferences on your device. On Android, Firebase Analytics also stores identifiers and data needed for the statistics described in the privacy policy.

The Dabba trademark, the logo, the source code and the app's contents are the exclusive property of Dabba. Any unauthorised reproduction or use is prohibited.

These Terms are governed by Italian law. The competent court is that of the Consumer's place of residence (Legislative Decree 206/2005).

Before bringing a claim before the courts, the parties undertake to attempt an amicable resolution by contacting supporto@dabba.it.

Dabba reserves the right to modify these Terms. Changes will be communicated with at least 15 days' notice via in-app notification or email.