1. Introduction
NanoCabs Ltd (“NanoCabs”, “we”, “us”) is committed to protecting the privacy of our riders, drivers, and website visitors. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our mobile applications (NanoCabs Rider and NanoCabs Driver), website, and related services.
By using our services, you consent to the collection and use of your information as described in this policy. If you do not agree, please do not use our services.
2. Information we collect
2.1 Information you provide
- Account information: Name, email address, phone number when you create an account via phone number, Google sign-in, or email registration.
- Profile information: Profile photo (optional for riders, required for drivers).
- Driver documents: National ID/passport number, driving licence, vehicle registration, PSV licence, and other verification documents submitted during driver onboarding.
- Payment information: M-Pesa phone number, card details processed through our secure payment partners (Paystack). We do not store raw card numbers on our servers.
- Emergency contact: Name, phone number, and email of your designated emergency contact (optional).
- Communications: Messages sent through in-app support chat, booking chat, and contact form submissions.
- Job applications: Name, email, phone, CV/resume, cover letter, LinkedIn and website URLs submitted through our careers page.
2.2 Information collected automatically
- Precise location data: Real-time GPS location when using the app (riders: during ride booking and active rides; drivers: while online/available). This is essential for matching riders with nearby drivers, providing accurate ETAs, and tracking rides.
- Background location (drivers only): When drivers are online and available, location is collected in the background to update availability and handle ride requests. This stops when the driver goes offline.
- Device information: Device model, operating system version, unique device identifiers, and app version.
- Push notification tokens: Firebase Cloud Messaging (FCM) tokens for delivering ride updates, messages, and safety alerts.
- Usage data: Ride history (pickup/destination locations, routes, fares, timestamps), car hire bookings, and app interaction patterns.
- Audio recordings (SOS only): When you trigger an SOS emergency alert during a ride, the app may record audio from your device’s microphone. Recordings are sent to your designated emergency contact and NanoCabs admin for safety purposes. Recording only occurs during active SOS alerts and stops when the alert ends or the ride completes. Recordings are stored securely and retained for 90 days.
3. How we use your information
- Core service delivery: To match riders with available drivers, calculate fares, process rides, and provide car hire services.
- Payments: To process payments, issue receipts, and handle refunds or disputes.
- Safety: To enable SOS alerts, emergency contact notifications, stationary detection safety checks, share ride details with emergency contacts, and capture audio recordings during SOS emergencies for safety evidence.
- Driver verification: To verify driver identity, documents, and eligibility to operate on our platform.
- Communication: To send ride updates, booking confirmations, support messages, push notifications, and email receipts.
- Improvement: To maintain, improve, and develop our services, fix bugs, and optimize performance.
- Legal compliance: To comply with legal obligations, regulatory requirements in Kenya, and respond to law enforcement requests.
4. Data sharing
We do not sell your personal data. We share information only in the following circumstances:
- Between riders and drivers: Name, phone number, vehicle details, plate number, rating, and real-time location during active rides.
- With recipients: When booking a ride for someone else, the recipient’s name and phone number are shared with the driver.
- Emergency contacts: When SOS is triggered, your emergency contact receives your location, ride details, and driver information via email.
- Payment processors: Transaction data shared with Paystack and M-Pesa for secure payment processing.
- Cloud services: Data stored on secure cloud infrastructure (Cloudinary for images, Firebase for authentication and push notifications).
- Law enforcement: When required by Kenyan law, court order, or to protect the safety of our users.
5. Data retention
- Account data: Retained while your account is active. Deleted within 30 days of an account deletion request.
- Ride and payment records: Retained for 7 years to comply with Kenya Revenue Authority tax requirements.
- Driver documents: Retained while the driver account is active, deleted upon account closure (except as required by law).
- Chat messages: Retained for 1 year for support and dispute resolution.
- Location data: Real-time location is not stored permanently. Ride pickup/dropoff locations are retained as part of ride history.
- Job applications: Retained for 2 years from submission date.
6. Data security
- All data is transmitted over HTTPS/TLS encryption.
- Sensitive data (phone numbers, ID numbers, plate numbers) is encrypted at rest using AES-256 encryption.
- Passwords are hashed using bcrypt with salt rounds.
- Payment information is processed through PCI-DSS compliant partners and is never stored on our servers.
- Access to personal data is restricted to authorized personnel only.
- JWT-based authentication with token refresh and expiry.
- Rate limiting and WAF (Web Application Firewall) to prevent abuse.
7. Your rights
Under the Kenya Data Protection Act 2019, you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your data (see our Data Deletion page).
- Restriction: Object to or restrict certain processing activities.
- Portability: Request your data in a machine-readable format.
- Withdraw consent: Withdraw consent at any time (this does not affect the lawfulness of prior processing).
8. Children’s privacy
Our services are not directed to children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
9. Third-party services
Our apps integrate with the following third-party services that may collect data according to their own privacy policies:
- Google Maps Platform: Location services, maps, directions, and place search.
- Firebase (Google): Authentication (phone/Google sign-in), push notifications, and crash analytics.
- Cloudinary: Image storage for profile photos, driver documents, and vehicle images.
- Paystack: Payment processing for rides and car hire.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or via email. Continued use of our services after changes constitutes acceptance of the updated policy.
11. Contact us
If you have questions about this Privacy Policy, wish to exercise your data rights, or have a complaint, contact our Data Protection Officer:
You may also lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at www.odpc.go.ke.