Privacy Policy
Last updated: October 5, 2026
1. Information Collection
We collect: company data (name, address, commercial registration, bank name and IBAN for receiving transfers, and company verification documents); administrator data (name, email, phone number); driver data (name, phone number, licence number) and vehicle documents; student data (name, phone number, university email, university ID, an address or pickup and drop-off location when provided, and a bank transfer receipt when uploaded); and trip, booking, payment, boarding and alighting data. We also record the IP address and the browser and device type in the activity log and sign-in sessions, and the browser notification subscription address when you turn notifications on.
2. Location and Tracking (GPS)
With browser location permission, the driver's device sends coordinates and accuracy while tracking is enabled, along with speed and heading when available. We record the update time to show the vehicle's location and follow the trip. We update the trip's last stored location; this path does not keep a complete vehicle movement history. Boarding and alighting scan coordinates may also be stored when supplied by the device, along with a student's pickup location when provided. The operating company can view the location, and holders of a valid ticket or share link can view the trip location subject to access checks. Only share tickets and tracking links with people you want to give location access to. Drivers can stop tracking or revoke location permission; ending the trip stops live tracking. Updates are not guaranteed while the screen is locked or the browser is in the background. Stopping tracking does not delete the last stored location; see Data Retention.
3. Use of Information
We use data to manage trips and bookings, issue tickets and reports, communicate with users, and improve the service.
4. Data Protection
We take care to protect your data and privacy. Company records are kept separate, access depends on user permissions, and data is protected during transmission.
5. Data Sharing and Where It Is Processed
The operating company can see the bookings for its trips and their students. We do not share data with anyone else except with your explicit consent, to comply with legal requirements, or with the service providers that process it to run the platform: Supabase for the database, accounts and uploaded files; Vercel for hosting and running the site; Upstash for request limits, processing the IP address and hashes of phone numbers and links; Mapbox for maps that your browser loads from it directly, so it receives your IP address and map requests; Meta (WhatsApp) for verification codes and trip notifications; Resend for emails such as recovery links and invitations; Moyasar for card payments when enabled; browser notification services (such as Google, Apple and Mozilla) when you turn notifications on; and Sentry for technical error reports when enabled, to which we attach no personal data by default. Data is processed outside Saudi Arabia: the database and servers are in Singapore, and the other service providers are in their own countries.
6. Cookies
We use cookies to manage sign-in sessions and operate the platform. Appearance preferences, such as dark or light mode, are stored locally in the browser.
7. User Rights
Users have the right to: access their data, correct inaccurate data, request deletion of their data (subject to legal obligations), and request a copy of their data in a readable format.
8. Data Retention
We retain account, trip, and booking data to support the service and transaction follow-up. Cancelling a subscription does not automatically delete this data. There is currently no automatic deletion deadline covering all data or stored GPS locations. You can request deletion through the support email below; requests are reviewed manually, taking operational needs and transaction-related obligations into account. The operational audit log is cleaned daily to remove non-financial events older than 90 days, and monthly to remove payment, subscription, and invoice events older than one year. These periods apply only to the audit log; they do not delete the underlying payment, subscription, or invoice records.
9. Contact Us
For any questions about the privacy policy: support@rakb.pro