Privacy & Cookie Policy

What this policy covers

AmstelCab is a chauffeur service in Amsterdam. To drive you somewhere we inevitably need to know a few things about you — where to pick you up, how to reach you, and how you paid. This policy explains, in plain language, which personal data we process when you visit amstelcab.nl, book a ride, use a My Ride link, or hold an AmstelCab account, and why we process it. We handle personal data in line with the EU General Data Protection Regulation (GDPR / AVG).

Our service is intended for adults. We do not knowingly collect data from children, and our website is not aimed at them.

Who is responsible for your data

The controller for all processing described here is:

AmstelCab
Burgemeester van de Pollstraat 477
1064 AN Amsterdam, Netherlands
Chamber of Commerce (KvK): 97225444 · VAT: NL005255853B28
E-mail: info@amstelcab.nl · Phone: +31 6 85141194

Privacy contact

We are a small company and have not appointed a formal data protection officer — the law does not require one for an operation of our size. Privacy questions and requests go directly to the owner: e-mail info@amstelcab.nl with “Privacy” in the subject line and we will reply within a few working days.

How we protect your data

All traffic between your device and AmstelCab is encrypted (TLS — the padlock in your browser). Login works without passwords: we e-mail you a single-use code that is valid for ten minutes and stored only in hashed form. Ride links use signed tokens that expire. Card details never touch our servers — they go straight from your browser to our payment provider, Stripe. Access to booking data inside AmstelCab is limited to the people who need it to run your ride.

One honest caveat: ordinary e-mail is encrypted in transport but not end-to-end. Please don’t e-mail us copies of identity documents or other sensitive papers unless we explicitly ask and agree on a safe route.

Visiting our website

When you browse amstelcab.nl — even without booking anything — our hosting providers automatically log technical data: your IP address, the pages requested, date and time, browser type and the referring page. We use these logs to keep the site running, to debug problems, and to detect abuse such as fraudulent bookings or attacks. If you just browse without booking, we don’t know who you are.

Legal basis: our legitimate interest in operating a working, secure website (Art. 6(1)(f) GDPR).

How we measure and improve the website

We want to know where amstelcab.nl works well and where people get stuck — for example at which step of booking visitors give up, which errors they run into and how fast pages load. For that we use our own measurement system. We built it ourselves and run it on a server in the European Union; no analytics company receives this data. It works in two levels, and only the first one runs without your permission.

1. Always: anonymous, within one visit. Your browser tab gets a random visit number that is forgotten when you close the tab or after 30 minutes without activity. During that visit we note what happens on the site: pages viewed, clicks on buttons and links, how far you scroll, how long form fields take (never what you type in them), the prices shown to you, errors and loading speed. Addresses are reduced to an area: the neighbourhood in built-up parts of the Netherlands (only where at least 500 people live in that block of about 0.6 × 0.75 km), and an area of roughly 5 km everywhere else. We never record your name, e-mail address, phone number, full address or payment details, and we filter e-mail addresses and phone numbers out of anything that could contain them. Your IP address is used only for a moment — to block abuse and to look up your country and city — and is not stored. This level uses no cookies and cannot recognise you on a later visit, which is the kind of privacy-friendly measurement Dutch law allows without consent. Legal basis: our legitimate interest in a working website we can improve (Art. 6(1)(f) GDPR).

2. Only if you accept “Analytics” cookies. We then also: give your browser a random visitor number in the ac_vid cookie (13 months), so we can see whether people come back over several days before they book; may record your visit as a session replay — a reconstruction of the page, scrolling and clicks that shows us where the site confuses people, with everything you type, your addresses and guest names hidden, and never on your confirmation, My Ride or account pages; draw heatmaps of mouse movement; and, if you book, link your visit to the booking through a one-way code derived from your e-mail address (we cannot turn the code back into the address). Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the cookie settings; the visitor cookie is then removed.

No advertising tracking. We currently don’t advertise, so we don’t ask for marketing cookies, don’t keep ad click numbers and send nothing to advertising networks. If that ever changes, we will update this policy and ask for your permission first.

Short questions, help and tests. Sometimes we show a short question (such as “what stopped you from booking?”) or a small help message (such as what the price includes, or help when a payment fails). Your answer is stored with the anonymous visit — please don’t type personal details into the free-text box. To learn whether such help really helps, and to compare two versions of a page, a random share of visitors does not see it or sees the other version. During a visit the site also estimates how likely the visit is to end in a booking, purely to measure and improve the site; it never changes the price you are offered.

Cookies and similar technologies

We keep cookies to a minimum. Without your permission we only set what is strictly necessary: your booking and checkout state, your login session, your language, and the cookie that remembers your cookie choice. Our payment provider Stripe sets cookies for secure payment and fraud prevention. Our one analytics cookie, the visitor number described in section 6, is only set if you accept analytics cookies. We use no advertising or marketing cookies.

The full list, including storage durations, is in the Cookie Policy at the bottom of this page. You can change your choices at any time via “Cookie settings” in the footer.

Legal basis: consent for any optional cookies (Art. 6(1)(a) GDPR); our legitimate interest for the strictly necessary ones (Art. 6(1)(f) GDPR).

Booking a ride

Booking works without an account. To arrange your ride we process:

• Your name, and your e-mail address and phone number so we can reach you about the ride;
• Pickup and drop-off addresses, including their map coordinates, distance and estimated duration;
• Pickup time, and return time for return trips;
• Vehicle class, number of passengers and luggage;
• Your flight number, if you give one, so we can track delays and adjust the pickup;
• Any note you write for the chauffeur, and a promo code if you use one;
• The fare, payment status and — after the ride — any rating or feedback you choose to leave.

If you book for someone else, we also process that person’s name and, optionally, their phone number and e-mail address so we can send them the ride details. Only share someone’s details with us if you have their permission. The passenger receives the itinerary and chauffeur details, but never the price or the invoice — those stay with you as the person who booked.

Your chauffeur receives what is needed to drive you and nothing more: your name, the addresses and times, flight number, passenger count and your note — never your payment details. Our dispatch team is alerted to new and cancelled bookings through WhatsApp-based messaging (a Meta service), so the core booking details pass through that channel to reach our operators quickly.

To turn typed addresses into routes and prices, the addresses you enter are looked up through mapping services (see section 14). Your flight number is checked against Schiphol’s public flight data — that request contains the flight number only, never your identity.

Legal basis: performance of the transport contract (Art. 6(1)(b) GDPR). Optional extras you provide voluntarily — a flight number, a note, feedback — rest on your consent (Art. 6(1)(a)) and our legitimate interest in running a good service (Art. 6(1)(f)).

Your account and My Ride links

An AmstelCab account is optional and passwordless. You log in with your e-mail address and a six-digit code we send you; the code is valid for ten minutes, stored only as a hash, and locked after five wrong attempts. A login keeps you signed in for thirty days. Your account can hold your name and phone number, saved addresses (like “Home”), frequently travelling companions, and your ride history. As with guest bookings: add a companion’s details only with their permission.

Every booking gets a private My Ride link so you can follow the status, and — as the payer — see the price and download the invoice. These links contain a signed token and work without logging in, which means anyone who has the link can view the ride details until the link expires (between 24 hours and 30 days, depending on how the link was issued). Treat a My Ride link like a ticket: don’t forward it to people who shouldn’t see your trip. Links shared with a fellow passenger show the journey but never the price or invoice. Once a chauffeur is assigned, the link also shows their name, vehicle, licence plate and a way to reach them.

From your account you can download a copy of your data and delete the account — see section 15.

Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR) and, for optional profile extras, your consent (Art. 6(1)(a)).

Payment and fraud prevention

Payments are handled by Stripe, a PCI-DSS-certified payment provider. You can pay by card, iDEAL, Klarna or Apple Pay. Your card or bank details go directly from your browser to Stripe; AmstelCab never sees or stores them. On our side we keep only the payment reference, the amount, the payment status and any refund status — enough to match a payment to a booking and to process refunds under our cancellation policy.

Stripe screens transactions for fraud on its own systems and may decline a payment it considers suspicious. How Stripe processes data is described in Stripe’s privacy policy.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); fraud prevention rests on our and Stripe’s legitimate interest (Art. 6(1)(f)).

Invoices and bookkeeping

After payment we generate an invoice with your name, contact details, the route, the date, and the fare including 9% VAT. You receive it by e-mail and can download it via your My Ride link or account. Because Dutch tax law obliges us to keep our administration, invoices and the booking records behind them are retained for seven years. This is a legal obligation (Art. 6(1)(c) GDPR) and not something we can delete on request within that period.

When you contact us

If you reach out by e-mail, phone or WhatsApp, we use what you send us to answer you and to handle your request. Enquiries for our concierge service (for example Ultra class requests) are forwarded by e-mail to the team that handles them. We keep correspondence as long as needed to resolve the matter and for a reasonable period afterwards in case follow-up is needed.

Legal basis: performance of (or steps prior to) a contract (Art. 6(1)(b) GDPR) and our legitimate interest in decent customer service (Art. 6(1)(f)).

Ride emails, reminders and offers

Around every booking we send service e-mails: the confirmation with your invoice, reminders before pickup, a “your chauffeur is on the way” message, and afterwards a short request to rate the ride. These are part of carrying out your booking, not marketing.

If you ask us to “e-mail this quote”, we send the ride and price to the address you give, with a link to continue booking — and, only if you tick that box, one reminder the next day. We keep the saved quote and that e-mail address for 30 days and then delete them; the link in the e-mail lets you delete them sooner. No reminder is sent once you have booked.

If you are about to leave after seeing a price, we may show a small window asking what you would like to pay (on a computer together with the short question about what stopped you). If you fill it in, you make us an offer (“Name your price”); closing the window costs nothing and stores nothing except that it was shown or closed. If you send an offer, we keep the ride, the amount you offered, your e-mail address and — only if you give it — your phone number, so that a person can answer you. The offer reaches our team as a WhatsApp notification (see section 8), and we reply by e-mail: yes, no or a counter-offer, with a link to book if the answer is yes. Every offer is answered by a person. We keep the offer for 30 days and then delete it; if you book, the booking itself is kept as described below. Legal basis: steps you asked us to take before a possible contract (Art. 6(1)(b) GDPR).

Separately, you can opt in to our newsletter — for example to receive a welcome discount code. We only send it if you signed up, and you can stop it at any time by e-mailing info@amstelcab.nl — unsubscribing costs nothing and takes effect immediately.

Legal basis: contract performance for service e-mails and a quote you asked for (Art. 6(1)(b) GDPR); consent for the quote reminder and the newsletter (Art. 6(1)(a)), which you can withdraw at any time.

Service providers we work with

We don’t run everything ourselves. The parties below process data on our behalf or as independent services we call on. Where a provider processes data outside the European Economic Area, we rely on an EU adequacy decision (including the EU-US Data Privacy Framework) or on Standard Contractual Clauses.

• Stripe — payment processing and fraud prevention (see section 10).
• Resend — delivers our transactional e-mail (confirmations, codes, invoices).
• MongoDB Atlas — hosts our booking database.
• Render and Vercel — host our backend and website, including the server logs from section 5.
• Google — powers the address suggestions while you type and converts addresses into coordinates and distances (Maps & Places). Those lookups are made by our own server, so Google receives the address text but not your IP address. Google also serves the typefaces on this site (Fonts), which your browser fetches directly and which therefore does include your IP address.
• CARTO / OpenStreetMap — the map tiles on the booking map.
• OSRM — calculates the driving route between your addresses.
• Royal Schiphol Group — public flight data for your flight number (no personal data attached).
• WhatsApp / Meta — carries the operational booking notifications and price offers to our dispatch team (see sections 8 and 13).
• Our measurement server — a server we rent from a hosting provider in the European Union, which stores the website measurements from section 6. Only AmstelCab has access.

Your rights

Under the GDPR you can, at any time and free of charge:

• Ask what data we hold about you and receive a copy (access);
• Have incorrect data corrected (rectification);
• Have data deleted where no legal duty forces us to keep it (erasure);
• Have processing restricted or object to processing based on legitimate interest;
• Receive your data in a portable, machine-readable format (portability);
• Withdraw any consent you gave, with effect for the future.

Two of these are self-service: in your account you can download your data as a file and delete your account. Deleting the account removes your profile, saved addresses and companions; the underlying booking and invoice records are detached from the account but kept for the retention period in section 17, because bookkeeping law requires it.

For everything else, e-mail info@amstelcab.nl. If you believe we handle your data improperly, you also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

Automated decisions

We do not profile you and we make no automated decisions with legal effect — with one narrow exception: our payment provider’s fraud screening can automatically decline a payment that looks fraudulent, which would stop a booking from completing. If that happens to you in error, contact us and a human will look at it.

The booking-likelihood estimate and the help messages described in section 6 are not decisions about you: they never change your price, never block a booking and have no legal or similarly significant effect.

How long we keep your data

• Login and verification codes: 10 minutes, single use;
• My Ride link tokens: 24 hours to 30 days, depending on how they were issued;
• Account login session: 30 days;
• Your cookie choice: 12 months, then we ask again;
• Website measurements (section 6): 25 months; session recordings: 30 days; visits recognised as bots: 90 days;
• The analytics visitor cookie ac_vid: 13 months, or until you withdraw consent;
• A saved quote and the e-mail address it was sent to: 30 days, or until you delete it;
• A price offer (“Name your price”) and the contact details you gave with it: 30 days;
• Bookings, invoices and payment records: 7 years, the retention period Dutch tax law sets for business administration;
• Account profile, saved addresses and companions: until you delete them or your account;
• Newsletter subscription: until you unsubscribe.

When a retention period ends, we delete or anonymise the data. Where several legal bases overlap, the longest applicable period wins — most commonly the bookkeeping obligation.

Changes to this policy

We update this policy when our service, our providers or the law change. The date at the top always shows the current version. For meaningful changes we will point them out on the website rather than change things silently.

Cookie Policy

Cookies are small text files a website stores on your device to recognise your browser or remember a setting. Some live only for your visit (session cookies); others persist so you are recognised next time. Alongside cookies, modern browsers offer local storage, which we use for things like an unfinished booking form.

Our position is simple: we set what is needed to run the service, and nothing else without asking. Our own analytics cookie stays off until you opt in through the cookie banner, and you can change your mind at any time. We use no advertising cookies.

Cookies we set

Browser storage (not cookies)

Your browser’s local storage holds your login session (up to 30 days), your unfinished booking form and checkout state (cleared per visit or tab), and your latest booking reference so the confirmation screen can find it. For the duration of the tab, session storage also notes where your visit came from (for example a search engine or an AI assistant such as ChatGPT), the first page you opened and the time — no identifiers, nothing from third parties. If you book, that note is attached to your booking so we can see which channels bring bookings. This data stays in your browser, is never used for advertising, and disappears when you clear your browser data.

Our measurement system (section 6) uses session storage for the duration of your tab: ac_t_s holds the random visit number and a counter of what was already shown to you (so a question appears at most once), and ac_t_boot holds the site settings for this visit. Both disappear when you close the tab.

External requests

Some parts of the site load from third parties, which necessarily see your IP address when your browser fetches them: Google Fonts (typefaces), CARTO / OpenStreetMap (map tiles), OSRM (route calculation) and Stripe (the payment form). None of these set advertising cookies on our site. Address suggestions are not in this list: your browser asks our own server, which asks Google on your behalf.

If you accept functional cookies, the addresses you pick in the booking form are also kept in your own browser so they can be offered back to you next time. That list never leaves your device, is never sent to us, and disappears when you clear your browser data.

Managing cookies

You can change your choices at any time via the “Manage cookie settings” button above or the “Cookie settings” link in the footer. You can also block or delete cookies in your browser settings — but blocking the necessary ones will break booking, payment and login.

COOKIE LIST LAST REVIEWED: OCTOBER 9, 2026