Privacy policy

1. Who is responsible for your data

Bilo is operated by JERRY TECHNOLOGIES S.R.L., tax identification number 46294133, Trade Register number J33/1148/2022, with its registered office at Calea Bucovinei 62A, 725400 Rădăuți, jud. Suceava, Romania.

Our company is the data controller for data used by the Bilo platform. The transport operator chosen by the passenger is separately responsible for the data it needs to provide the journey, issue mandatory documents and offer assistance.

2. What data we use

Passengers and buyers

• name and email address;
• route, stops, date, time, number of tickets and price;
• order, payment, ticket and invoice details;
• messages and requests sent to Bilo or the operator.

Transport operators

• details of the person creating and managing the account;
• company details, public profile, tax details, licence and payout account;
• signatory name and capacity, contract version and fingerprint, acceptance date and technical evidence such as browser information and a pseudonymised IP address fingerprint;
• routes, stops, schedules, prices and uploaded documents;
• order, payout, invoice and communication history.

Searches through ChatGPT and other AI apps

The Bilo integration receives only the parameters needed for a search: localities, travel date and number of adults, or a service identifier for details and the purchase link. We do not request access to the full conversation history or ask for passenger names, email addresses or card details in the AI app. Ordering and payment take place separately on bilo.ro.

To operate and improve the integration, we retain call statistics: tool used, time, localities, travel date, number of adults, result, duration, number of returned services and an approximate identification of the AI app. These statistics do not include conversation text, IP addresses, raw headers, names, email addresses or payment details, and have a 90-day deletion period. Technical deletion may occur after this period expires. The AI app you use has its own privacy policy.

Visitors

We may use information about visited pages, devices and browsers for statistics, security and service improvements. These statistics do not include names, email addresses or payment details entered in forms.

3. Why we use data

• to create and manage the operator account;
• to process orders and payments and issue and send tickets and invoices;
• to enable the operator to provide transport and assistance;
• for accounting, fraud prevention and compliance with legal obligations;
• to respond to requests and improve Bilo;
• for commercial messages, only if you have separately opted in.

We use data where necessary for our contract with you, our legal obligations, legitimate interests such as security and proper operation of the service, or with your consent, as applicable.

4. Who we may share data with

Order data is shared with the selected transport operator. We may also work with providers for payments, messaging, document storage, accounting and invoicing, and with advisers or authorities where required by law.

We provide only the information needed for their role. We do not sell personal data.

If a provider processes data outside the European Economic Area, we use the safeguards required by European legislation.

5. How long we keep data

We retain data while the account or service is active and afterwards for as long as necessary for tax and accounting obligations, the defence of rights and handling requests. Tickets, orders and invoices may have legally required retention periods. Data no longer needed is deleted or anonymised.

6. Your rights

You may request access, correction, deletion, restriction of use or portability of your data, or object to certain processing. Where processing is based on consent, you can withdraw it for the future.

For a request, call us on +40 748 687 863 or write to the registered office listed above. We may ask for reasonable information to verify the requester's identity.

If you are not satisfied with the response, you may lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing.

7. Cookies and statistics

Bilo's own analytics measure public pages, route and date searches, results, filters, sorting, visible cards, journey details opened and clicks towards purchases or operators. They use a temporary random identifier in sessionStorage to link actions within the same tab, including after reloads. The session expires after 30 minutes without events; we do not use cookies, localStorage or identifiers across days, and we do not calculate unique people. If storage is unavailable, the identifier remains only in page memory. We do not send form values, passenger names, email addresses, raw IP addresses or payment information in these events. We retain only the public page path and referring domain, without URL parameters. Browser collection respects Do Not Track and Global Privacy Control signals.

Automated traffic is classified approximately using technical signals, separately from AI integration calls. Our browser collection may include device category, phone make and model when supplied by the browser, browser family, language, visit source, scrolling, active time and performance indicators. We estimate the connection's country and city by temporarily processing the IP address on our server using a local DB-IP Litedatabase. We do not send IP addresses to the database provider or retain them in analytics events; we do not request GPS location. The city is approximate and may differ for VPNs or mobile networks. Traffic that does not run the script requires a separate website server integration. Our events expire after 90 days; technical deletion is asynchronous. Confirmed payments are counted by the backend without passenger data or automatic attribution to a browsing session.

Bilo uses cookies necessary for pages to work and may use cookies for usage statistics. You can control them in your browser settings. Disabling necessary cookies may affect some features.

On public pages we also use Ahrefs Web Analytics for statistics on visited pages, traffic sources, clicks, form submissions, device, browser, language and country- and city-level location. We do not send completed form values. This integration does not load in the internal dashboard, operator accounts, authentication or ticket checks. According to Ahrefs, standard measurement does not use cookies and raw IP addresses are not retained. Details are in the Ahrefs Web Analytics notice.

8. Minors

An adult may purchase a ticket for a minor if authorised to do so. We do not require a minor to create an account to buy a ticket.

9. Changes

We may update this policy when services or legal obligations change. We publish the new version and its update date on this page. If a change is important for an operator, we will ask them to confirm it again.