Privacy Policy

Effective: TBC · Version 0.1 (draft) · Last updated 9 May 2026

Draft notice. This document is a working draft structured to satisfy POPIA s18. The version that takes legal effect on launch will be finalised with a SA privacy attorney.

1. Who we are

Responsible party: LOGiiC Group (Pty) Ltd ("MyRyd", "we", "us").

Information Officer: info-officer@myryd.app

Registered with: The Information Regulator of South Africa (registration in progress).

2. What we collect

Identity & contact: name, phone, email, date of birth, gender (optional), home district, profile photo, ID or passport number for KYC tier 2.

Biometric (special personal information under s27): baseline selfie + on-the-day selfie for face match. Captured with explicit consent at signup. Stored encrypted in the kyc-selfies bucket. Used solely for identity verification at sign-up and at start of trips that cross your home district.

Trip data: pickup + dropoff locations, route, fare, payment method, ratings, in-trip messages, SOS events.

Driver-only: Driver's Licence, PrDP, PRE Operating Licence, vehicle registration, roadworthy, insurance schedule, banking confirmation, vehicle photos, police clearance.

Device & usage: device type, browser, IP address, app version, crash reports (via Sentry, anonymised).

3. Why we collect it

To provide the e-hailing service (matching, routing, fares).
To verify your identity (POPIA s11 + the National Land Transport Act).
To process payments and produce SARS-compliant invoices for corporate accounts.
To enable safety features (SOS, trusted contact alerts).
To comply with our regulatory obligations (NLTA, SARS, POPIA).
To prevent fraud, abuse, and unauthorised account access.
To improve the platform via aggregated, anonymised analytics.

4. Lawful basis for processing

We rely on (a) your consent at signup for biometric data, (b) performance of the contract with you for trip-execution data, (c) compliance with legal obligations for KYC, NLTA, and SARS data, and (d) our legitimate interest for fraud prevention and service improvement.

5. Who we share with

Your matched driver / rider — name, photo, rating, last 4 digits of phone (for in-app contact).
Payment processors (PayFast, Paystack, Yoco) — encrypted payment tokens only.
SMS / email providers (Twilio, Resend) — recipient phone / email + message body.
KYC verification (Smile ID) — selfie image for face-match check.
Cloud infrastructure (Supabase, Vercel) — all data, encrypted at rest and in transit. EU-hosted (Frankfurt) with standard contractual clauses for any cross-border flow.
Regulators / law enforcement on lawful request (NLTA inspectors, SAPS, SARS, the Information Regulator).
Partnership co-funders (e.g. NWU for student discount reconciliation) — aggregated, de-identified trip counts only. Never individual rider data.

6. How long we keep it

Account profile — for the duration of your account, plus 5 years after closure for SARS / NLTA records.
Trip records — 5 years (POPIA s14 + SARS retention).
Biometric (selfie) — until account deletion or 12 months after last activity, whichever is sooner.
Driver documents — for the duration of the driver relationship, plus 7 years (regulatory).
Audit logs — 12 months rolling window for operational records, longer for incident investigations.

7. Your rights under POPIA

Access — request a copy of all personal information we hold about you. Use Account → Download my data or email info-officer@myryd.app. We respond within 14 days.
Correction — update inaccurate data via your profile or by emailing the Information Officer.
Deletion — request account deletion. Trip records and audit logs are anonymised but retained per s14.
Withdraw consent for non-essential processing (marketing, analytics) at any time without affecting the ride service.
Complain to the Information Regulator at inforegulator.org.za.

8. Security

We use industry-standard measures: encryption at rest and in transit, role-scoped access via Postgres RLS, audit logging of all administrator actions, strict separation of biometric and general personal information, and incident response procedures aligned with POPIA s22 breach-notification requirements.

9. Children

MyRyd is not for use by anyone under 18. We do not knowingly collect personal information from minors. If you believe a minor has registered, email info-officer@myryd.app and we will delete the account.

10. Changes to this policy

We will notify users of material changes at least 14 days before the new version takes effect.