Privacy Policy

E-Rides (“we”, “us”) is the data controller for the personal data described here, as defined by Kenya’s Data Protection Act, 2019.

Contact: gidienesh@gmail.com

Everyone (riders and drivers)

• Phone number — how you sign in. We send a one-time code by SMS to verify it.
• Name — shown to the rider or driver you are matched with.
• Location — precise GPS location. For riders, to set your pickup point and follow your trip. For drivers, your location is shared continuously while you are online or on a trip, so we can match you with nearby requests and so your rider can watch you approach. Location collection stops when a driver goes offline and when a trip ends.
• Trip records — pickup and drop-off points, route distance and duration, fare, payment method, timestamps, and the rating you give or receive.
• In-trip messages — chat between rider and driver during a trip.
• Notification token — a device identifier used only to deliver ride alerts and trip updates.
• Saved places and trusted contacts — if you choose to add them. Trusted contacts (a name and phone number) are used only to send a trip-tracking link when you share a trip or raise an SOS. Choosing a contact from your phone book is optional; we read only the contact you pick and never upload your address book.

Drivers only

• Identity and licensing documents — photographs of your national ID (front and back), driving licence, PSV licence, insurance certificate and certificate of good conduct, plus your national ID number. We need these to verify that you are legally permitted to carry paying passengers.
• Vehicle details — type, number plate, model, year, and photographs of the vehicle.
• Earnings records — fares collected, commission owed, and wallet transactions.

• To create and secure your account, and to verify it's really you signing in.
• To match riders with nearby drivers, price the trip up front, and navigate the route.
• To let a rider and driver find each other, contact each other, and complete the trip.
• To keep people safe — trip sharing, SOS alerts, and detecting fraudulent or faked trips.
• To verify that drivers are licensed, insured and permitted to carry passengers.
• To account for fares, commission and driver payouts, and to meet our tax obligations.
• To support you when something goes wrong with a trip, and to resolve disputes.

Our lawful bases are the performance of our contract with you (providing rides), our legal obligations (driver licensing, tax and accounting records), your consent (optional features such as trusted contacts and notifications) and our legitimate interests in keeping the service safe from fraud and abuse.

We do not sell your personal data, and we do not use it for advertising. We share it only as follows:

• The rider or driver you’re matched with — your first name, your rating, the driver’s vehicle and plate, and live location during the trip.
• Anyone you send a trip link to — if you share a trip or trigger an SOS, the contacts you chose receive a link showing that trip’s live location.
• Cloudflare, Inc. — hosts our servers and databases.
• Our SMS provider (TalkSasa or Africa’s Talking) — receives your phone number to deliver your sign-in code and trip alerts.
• Expo and Google Firebase Cloud Messaging — deliver push notifications to your device.
• Map and routing providers (OpenFreeMap, OSRM, Photon) — receive location coordinates in order to draw the map, calculate the route and look up place names. They do not receive your identity.
• Safaricom (M-Pesa) — will receive your phone number and the fare amount when in-app M-Pesa payments launch. Today all trips are paid in cash directly to the driver, and we do not process card or mobile-money payments in the app.
• Law enforcement or regulators — where we are legally required to disclose, or where it is necessary to protect someone’s safety.

• Account details (name, phone number) — until you delete your account.
• Trip and financial records — retained for up to seven years after the trip, to meet Kenyan tax and accounting requirements. After you delete your account these records are anonymised, so they can no longer be linked to you.
• Driver identity and licensing documents — deleted when you delete your account.
• Location traces from a trip — kept as part of that trip's record and anonymised on account deletion.
• In-trip messages — deleted when you delete your account.

You can delete your account at any time, and it takes effect immediately. Either open the app and go to Menu → Delete account, or use the account deletion page on this site.

Deletion permanently erases your name, phone number, saved places, trusted contacts, in-trip messages, notification token and — for drivers — every identity and licensing document you uploaded, along with your national ID number and vehicle details. Your past trips are kept as anonymous financial records, with nothing left that identifies you.

If you have a trip in progress, or a driver wallet with money owed or owing, you will be asked to settle it first.

Under the Data Protection Act, 2019, you have the right to:

• Be told what personal data we hold about you, and get a copy of it.
• Have inaccurate data corrected.
• Have your data deleted (see the section above).
• Object to, or ask us to restrict, how we use your data.
• Withdraw consent for optional features, such as notifications or trusted contacts.
• Complain to the Office of the Data Protection Commissioner if you believe we've mishandled your data.

To exercise any of these, email gidienesh@gmail.com. We’ll respond within 30 days.

Your data is transmitted over encrypted connections (HTTPS/WSS) and stored on Cloudflare’s infrastructure. Your session token is held in your device’s secure keystore. Access to identity documents is limited to staff reviewing driver applications, and every administrative action is written to an audit log.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.

E-Rides is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

Our infrastructure providers (Cloudflare, Expo, Google) operate globally, so your data may be processed on servers outside Kenya. We rely on these providers’ contractual data protection commitments to keep your data protected to the standard required by the Data Protection Act, 2019.

If we change this policy we’ll update the date at the top of this page, and we’ll tell you in the app if the change is significant.