Privacy Policy

Last updated: 17 July 2026

This policy explains what we collect, why we collect it, and who can see it. It applies to your use of LiftClub in South Africa and is written to align with the Protection of Personal Information Act (POPIA).

1. Information we collect

• Account: name, email, phone, password (hashed by our auth provider).
• Identity documents: ID number, ID photo/scan, and a selfie holding your ID (riders and drivers).
• Driver KYC: driver's licence, vehicle registration document, vehicle photos, plate number, banking details (for future payouts).
• Location: approximate location for search; precise live location only during an active accepted ride, and briefly when you tap "Use my location."
• Ride data: routes posted/requested, messages between rider and driver, reviews.

2. Who can see what

• ID documents & driver KYC: only you and platform administrators. Never other users.
• Live location during a ride: only the other participant of the same accepted ride.
• Profile name, photo, verified badge, reviews: visible to signed-in users.
• Contact details (phone, home address): stored in a private table and never exposed on public profile pages.

3. How long we keep it

• KYC documents: kept while your account is active + 12 months after last use, for fraud investigation.
• Ride logs and messages: kept for 3 years for safety and dispute resolution.
• Live location pings: rolling window, oldest deleted after 30 days.
• When you delete your account, personal data is removed within 30 days except where retention is legally required.

4. Sharing with third parties

We share data with: our authentication and database provider (Supabase); map/routing providers (OpenStreetMap tiles, OSRM routing); email delivery when enabled. We do not sell your personal data.

5. Your rights (POPIA)

You may request access to, correction of, or deletion of your personal information. Use Contact us or Settings → Delete account.

6. Security

Passwords are hashed. KYC uploads live in a private storage bucket accessible only to the uploader and admins via short-lived signed URLs. Database access is enforced with row-level security.

7. Children

LiftClub is not for anyone under 18.

8. Changes

Material changes will be notified in-app before they take effect.