RIDO
Legal & Privacy
Privacy Policy
1. Who we are
Data controller: Idi Gorezi (NIPT: M61805042V)
Address: Ish-Fusha e Aviacionit, Rruga e Dafinave, Tiranë 1023, Albania
Privacy contact: [email protected]
For any privacy question, request or complaint, contact us at the email above.
2. Summary
- We collect what we need to register your account, match riders with drivers, run trips, process payments, send notifications, and prevent fraud and abuse.
- Drivers: while you are signed in and available, the driver app collects your location continuously, including in the background and when the app is closed. Without this, you cannot receive trip requests.
- Riders: we collect your location only when you actively use the Service (request a trip, view nearby drivers, navigate). We do not track riders in the background.
- During an active trip, riders and drivers share certain contact and identity details with each other (see section 5).
- We do not sell your personal data and we do not use it for advertising.
- You can request access to or deletion of your data at any time (see section 11).
3. Information we collect
3.1 Information you give us
- Account details: email address, phone number, first and last name, password (stored only in hashed form).
- Driver-only details: driver's licence number, vehicle make, model, year, plate, colour and type. Additional verification may be required before activation — see section 3.3.
- Preferences: language, currency, notification settings, saved addresses (riders), default payment method.
3.2 Information collected when you use the Service
- Location. For drivers: precise GPS location (and where available, heading and speed) collected continuously while you are signed in as available — including in the foreground, in the background, and while the app is closed. See section 4. For riders: precise GPS location captured only when you request a pickup, set a destination, view nearby drivers, or navigate.
- Trip information: pickup and dropoff addresses and coordinates, distance, duration, fare, vehicle used, status and timestamps.
- Payment information: identifiers issued by our payment processor, transaction amounts, currency, payment status, and a record of each payment, refund or driver payout. We do not store full card numbers, CVV or bank credentials on our systems — those are handled directly by our payment processor.
3.3 Driver verification
Before activating a driver account — and at any time afterwards if we have a reasonable concern about the accuracy of your information, the safety of the Service, or compliance with the law — we may ask you to verify your identity and eligibility to drive. Verification methods may include, but are not limited to:
- a phone call or video call;
- email correspondence;
- an in-person meeting at a location we arrange;
- submission of supporting documents — for example, a copy of your national ID or passport, your driver's licence, vehicle registration or insurance certificate.
We will request only the information reasonably necessary to confirm your identity and eligibility, will use it solely for that purpose and for fraud prevention, and will retain copies of submitted documents only for as long as needed for those purposes and any related legal obligations. If you decline to complete a verification request, we may decline to activate your driver account or may suspend an existing account.
3.4 Technical and abuse-prevention data
We collect a limited set of technical signals, primarily to keep accounts safe and stop fraud, abuse and automated attacks. This includes:
- IP address, used at the time of a request to rate-limit and block abusive traffic (we do not build a stored profile from it);
- push notification token (so we can send you trip updates);
- authentication and session tokens;
- logs of requests and errors, which we keep to operate, secure and debug the Service.
We use this data only for security, fraud and abuse prevention, account integrity, debugging and operating the Service. We do not use it for advertising or for tracking you across other companies' apps or websites.
4. Driver background location
What we collect: your device's precise location (latitude, longitude, and where available, heading and speed).
When we collect it:
- While the driver app is open and you are signed in and available.
- While the driver app is in the background.
- While the driver app is closed, the operating system may continue to deliver location to a foreground location service so that you can keep receiving trip requests.
Why this is necessary: our core function is to dispatch the nearest available driver to a rider. If background location is disabled or revoked, we cannot share your position with the matching system, you will be marked offline, and you will not receive trip requests until you re-enable it. There is no alternative mode that allows a driver to receive requests without sharing live location.
What we do NOT do with this data:
- We do not use it for advertising.
- We do not sell or rent it.
- We do not share it with third parties except with the rider matched to your active trip, and our routing/mapping provider strictly for the purpose of computing the trip route.
- We do not collect driver location while you are signed out or marked unavailable.
How to control it: you can disable or revoke location permission at any time in your device's system settings. While location is off, you cannot receive trip requests as a driver.
Retention: your live location is held only briefly so we can match and dispatch trips, and is continuously overwritten by newer updates. Location captured as part of a specific trip (pickup, dropoff) is kept with that trip record.
5. Information shared between riders and drivers
To make a trip work, riders and drivers see certain information about each other. This is shared automatically through the app when a trip is requested, accepted or in progress:
- Rider sees about the driver: first name, vehicle make, model, colour, plate, the driver's live position and heading on the map, and a way to call the driver. The driver's phone number may be revealed for direct contact during the trip.
- Driver sees about the rider: first name, pickup and dropoff addresses, and a way to call the rider. The rider's phone number may be revealed for direct contact during the trip.
- We may also share the email address of the matched counterparty where required for receipts, dispute handling or trip-related notifications.
This information is shared only for the purpose of completing the trip, and only with the matched counterparty (not publicly).
6. Third parties we share data with
We share the minimum data needed with the service providers below. Each acts as a processor on our behalf and is bound to use the data only for these purposes.
| Provider | What they do | What we share |
|---|---|---|
| Routing and mapping provider | Calculate routes, distance and ETA; turn coordinates into addresses | Origin and destination coordinates |
| Push notification provider | Deliver in-app push notifications | Push token and notification content |
| SMS provider | Send one-time codes for phone verification | Phone number and the code |
| Email provider | Send transactional emails (verification, account, payment notices) | Email address and message content |
| Payment processor (PokPay) | Authorise and capture payments; process driver payouts | Customer name, email, payment method token, amount, currency, trip metadata |
| Fiscalization service | Issue fiscal/tax records for payments as required by law | Transaction amount, currency and tax details (and, for business invoices, buyer name and tax ID) |
| Cloud infrastructure provider | Host our servers and database | Data necessary to operate the Service |
We may also disclose information:
- To law enforcement, regulators or courts when legally required or to protect rights, property or safety.
- To a successor entity in the event of a merger, acquisition or sale of assets, subject to this Privacy Policy.
- With your consent, in any other case.
We do not sell or rent personal information, and we do not share it with advertising networks, data brokers or analytics resellers.
7. Why we process your information (legal bases)
We process personal data in line with Albanian Law no. 124/2024 on Personal Data Protection, and — for users located in the European Economic Area or the United Kingdom — in line with the EU/UK General Data Protection Regulation. We rely on the following legal bases:
- Performance of a contract — to register your account, run trips, process payments and provide the Service.
- Legal obligation — to fiscalize payments and keep the records required by tax, accounting, transport and consumer protection laws.
- Legitimate interests — to keep the Service secure, verify driver eligibility, prevent fraud and abuse, debug and defend legal claims.
- Consent — for any processing where we explicitly ask you (for example, optional marketing emails). You can withdraw consent at any time.
8. International transfers
Our service providers may be located in countries other than yours. Where personal data is transferred internationally, we rely on safeguards permitted by applicable law, such as the European Commission's Standard Contractual Clauses or equivalent mechanisms. You can request a copy of those safeguards by emailing [email protected].
9. How long we keep your information
We keep personal data only for as long as necessary for the purpose it was collected, or for as long as we are legally required to keep it. In general:
| Data | Retention |
|---|---|
| Account data | While your account is active, and for a reasonable period after closure to handle disputes, fraud and final billing |
| Trip and payment records | For the period required by applicable tax, accounting and transport regulations in your jurisdiction |
| One-time codes and short-lived tokens | Deleted automatically within minutes |
| Live driver location | Kept only briefly and overwritten by each new update; not retained as a continuous track outside of an active trip |
| Logs | Only for as long as needed to operate, secure and debug the Service and to investigate and prevent abuse |
When you delete your account, we delete or irreversibly anonymise your personal data, except records we are legally required to retain.
10. Security
We protect your information using industry-standard measures, including:
- encryption of communications between the app and our servers;
- passwords stored only in hashed form (we never see your plain password);
- short-lived authentication tokens that can be revoked;
- role-based access controls and need-to-know access for staff;
- rate limiting and anti-abuse controls on sensitive actions.
No system is perfectly secure. If a personal-data breach affects you, we will notify you and the relevant authority as required by law.
11. Your rights
11.1 Rights available to all users
- Access a copy of the personal information we hold about you.
- Correct information that is inaccurate or incomplete.
- Delete your account and personal information (subject to records we must keep by law — see section 9).
- Withdraw consent at any time for processing based on consent.
- Object to processing based on legitimate interests, or restrict processing while a request is reviewed.
- Lodge a complaint with the competent data protection authority — for Albania, the Information and Data Protection Commissioner (www.idp.al); for users elsewhere, your local supervisory authority.
11.2 Additional rights for California residents
California residents have the right to know what personal information we collect, why we collect it and with whom we share it; the right to delete and correct personal information; and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under California law. We will not discriminate against you for exercising your rights.
11.3 How to exercise your rights
- In the app: open Settings → Account → Delete Account.
- By email: [email protected], for access, correction or any other request. We will respond within the timeframe required by applicable law and may need to verify your identity first.
12. Apple App Store users
If you obtained the app from the Apple App Store:
- The privacy practices described here align with the App Privacy disclosures shown on the App Store listing.
- We do not track you across other companies' apps or websites for advertising or analytics. We do not engage in any activity that would require an App Tracking Transparency prompt.
- You can request account and data deletion in-app or by emailing us, as described in section 11.
13. Children
The Service is not intended for users under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, contact [email protected] and we will delete it.
14. Mobile app permissions
| Permission | Why we need it |
|---|---|
| Location (precise) — foreground | Show your position on the map, capture pickup/dropoff (riders), capture position for trip dispatch (drivers) |
| Location (precise) — background (drivers only) | Keep drivers online and routable while the app is minimised or closed; without it, drivers cannot receive trip requests |
| Notifications | Send trip status updates |
| Internet / network state | Communicate with our servers |
| Foreground service (Android) | Run the location updater for drivers with a persistent notification, as required by Android |
You can revoke any permission at any time in your device settings. Some features of the Service depend on specific permissions (especially location for drivers).
15. Automated decision-making
We use automated processes to match riders with the nearest available driver, calculate fares and ETAs from route geometry, and detect suspicious activity. These do not produce legal or similarly significant effects on you. If you believe an automated decision has materially affected you (for example, you believe an account suspension was wrong), email [email protected] for a human review.
16. Changes to this Privacy Policy
We may modify this Privacy Policy at any time. When we do, we will post the updated version here and update the version date at the top. For material changes, we will provide reasonable advance notice through the app, by email, or both, where required by law.
Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the changes. If you do not agree with the updated Privacy Policy, you must stop using the Service and may delete your account. It is your responsibility to review this Privacy Policy periodically. To the maximum extent permitted by law, we are not liable for changes to this Privacy Policy that you fail to review.
17. Governing law
This Privacy Policy and our processing of your personal data are governed by the laws of the Republic of Albania, without prejudice to any mandatory protections you may have under the laws of your country of residence (in particular, the EU/UK GDPR for users located in the European Economic Area or the United Kingdom).
18. Contact us
Questions, requests or complaints about this Privacy Policy or our data practices:
- Email: [email protected]
- Postal address: Ish-Fusha e Aviacionit, Rruga e Dafinave, Tiranë 1023, Albania