Privacy Policy

This policy is being finalised. We are working with legal counsel to complete it and register it with the Office of the Data Protection Commissioner (ODPC) ahead of launch. Features described as "coming soon" will be covered in full once the relevant app feature is live. Last updated: June 2026.

Growing document. Ryde is launching in stages. We will update this policy as each feature goes live, including Lost & Found, SOS and emergency contacts, and business accounts. We will let you know about material changes in-app and by email before they take effect.

Ryde ("we", "us") is committed to protecting your personal data and handling it in line with Kenya's Data Protection Act, 2019 (DPA 2019). This policy explains what we collect, why we collect it, who we share it with, and the choices you have.

Who we are

[TODO: registered legal entity name] trading as Ryde is a ride-hailing platform being built for Kenya. Our registered address and Data Protection Officer contact will be published here before launch.

For any privacy question, or to exercise your rights under the DPA 2019, email [email protected].

Information we collect

All users

• Account details: name, phone number, email address, and profile photo.
• Trip data: pickup and drop-off locations, routes, distances, times, and fares for every trip.
• Payment data: M-Pesa phone number and transaction confirmation codes. We never store your M-Pesa PIN. Where card payment is used, card details are handled exclusively by our payment processor and are not stored by Ryde.
• Device and usage data: app version, device model, operating system, and approximate location while you are using the app.
• Support data: messages, reports, and photos you send to our support team.

Riders only

• Trip history, ratings given and received, and any lost-item reports you submit.

Drivers only

• National ID, driving licence number, PSV badge number, NTSA inspection certificate, PSV insurance policy, vehicle logbook, SACCO membership certificate, and certificate of good conduct. These are uploaded during onboarding and re-verified periodically.
• Vehicle details: make, model, year, plate, and category.
• Earnings records: trip-by-trip and aggregated earnings, subscription or commission plan, and M-Pesa payout history.
• Document expiry dates and verification status.

Waitlist only

• Email address and role (rider or driver), used solely to notify you when Ryde launches in your city.

How we use your data

• To match riders with available drivers and complete trips.
• To process payments via M-Pesa and pay out driver earnings.
• To keep the platform safe: driver document verification, fraud detection, incident investigation, and SOS response.
• To operate Lost & Found: coordinating item recovery between riders and drivers.
• To meet legal and regulatory obligations, including NTSA digital-hailing rules and KRA record-keeping requirements.
• To send service messages (trip receipts, payment confirmations, verification decisions).
• To send product updates and promotions, with your consent where required by law.

We do not sell your personal data. We do not use your data for targeted advertising by third parties.

What riders and drivers see of each other

During a trip

When a driver accepts your ride request, you (the rider) can see the driver's first name, profile photo, vehicle plate, vehicle type, and star rating. This is shown before you get in the vehicle.

Drivers see the rider's first name and star rating when reviewing a ride offer. The rider's phone number is not shown to the driver during a normal trip.

Neither party sees the other's full phone number during the course of a standard trip.

After a trip (reviews)

After a completed trip, both parties can leave a star rating and written feedback. The rating is attributed to your account but the exact text of a review is not displayed publicly.

Lost & Found contact

If either party opens a lost-item contact request (see the Lost & Found help article), Ryde shares:

• The first name and phone number of the rider with the driver.
• The first name and phone number of the driver with the rider.

This sharing is intentional and necessary for coordinating item recovery directly. It happens only when the contact request is opened, not during or immediately after a trip. The contact window is open for 7 days from the trip end, after which direct sharing closes.

You consent to this sharing when you open a lost-item contact request. You can decline by not opening the request and contacting support instead.

Emergency contacts and SOS

If you trigger the SOS feature (coming soon), your name, live location, and trip details (driver name, plate, vehicle) are sent to your pre-saved emergency contacts via SMS. Those contacts are chosen by you. This data is not shared more widely.

Live trip-share links (shareable at any time during a trip) show the driver's first name, photo, plate, and your live map position to whoever you share the link with.

Sharing with third parties

We share your data only as needed to operate the service:

We do not share your data with marketers or data brokers.

Driver document data

Driver documents (national ID, PSV badge, etc.) are uploaded to encrypted storage. They are reviewed by Ryde staff for verification and re-checked periodically for expiry. Documents are not shared with riders or third parties beyond what is required for regulatory compliance.

Retention

• Trip and payment records: retained for at least 7 years for KRA and NTSA compliance.
• Driver documents: retained for the life of the driver account and a compliance-required period after closure.
• Support messages: retained for 3 years.
• Waitlist data: deleted within 90 days of launch or on request.
• Location data: retained for 90 days, then anonymised or deleted.
• Inactive accounts: data is retained for 2 years after the last activity, then deleted or anonymised unless legal obligations require longer retention.

Security

We use TLS encryption for all data in transit, encrypted storage for documents, and access controls limiting who can see sensitive data internally. Production systems require multi-factor authentication. We conduct regular security reviews.

No system is perfectly secure. We ask you to keep your account credentials safe and contact us immediately at [email protected] if you suspect unauthorised access to your account.

Your rights under the Data Protection Act, 2019

You have the right to:

• Access your personal data and receive a copy.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal retention obligations.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests.
• Withdraw consent where processing is based on consent.
• Data portability for data you provided to us.
• Lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

To exercise any of these rights, email [email protected]. We will respond within the timeframe required by law.

Children

Ryde is not directed at persons under 18. We do not knowingly collect data from anyone under 18.

Changes to this policy

We will update this policy as Ryde adds features (including Lost & Found, SOS, and business accounts). When we make a material change, we will notify you in-app and by email at least 14 days before the change takes effect. The "last updated" date at the top of this page shows when it was last revised.

Contact

Privacy questions: [email protected]

Our designated Data Protection Officer will be named here before launch.

Office of the Data Protection Commissioner: odpc.go.ke