A draft, not a published policy
This proposed policy describes the information a ride and delivery service may handle. It must be checked against Ms. Nayah’s actual data practices before publication. The legal operator, privacy contact, vendors and retention periods are not yet confirmed.
01About this policy
Ms. Nayah brings rides and deliveries together in one app. This draft Privacy Policy outlines the information that may be needed to provide those services, the purposes for using it and the choices that should be available to you.
It is intended to cover the website, app and related support for riders, senders, recipients and prospective partners. The legal entity responsible for your information, its contact details and any partner-specific notices must be confirmed before this policy becomes effective.
02Information you provide
Depending on the features you use, information may be provided when you create an account, request a ride or delivery, contact support or apply to drive or deliver. Only information needed for the relevant purpose should be requested.
- •Account details, such as your name, contact information and account preferences.
- •Booking details, including pickup and destination addresses, recipient contact details and delivery instructions.
- •Support messages, feedback and any photos or documents you choose to submit. Partner identity and vehicle records, if required, should be covered by a specific verified notice.
03Location and service activity
A ride or delivery needs pickup and destination information. If enabled, device location may help identify a pickup point and support trip or delivery tracking. Whether precise location is collected, when it is collected and whether background access is used must be verified against the app.
Service records may include booking times, routes, status updates, transaction references and communications connected to a request. Technical records may include device type, app version, network information, IP address and diagnostic events. The final notice must reflect the actual tools and settings in use.
04How information is used
Information should be used only for specific, explained purposes connected to providing and improving the service. The following proposed uses must be checked against actual operations before publication.
- •Create and manage accounts; arrange, track and complete rides and deliveries.
- •Process payments, issue service communications and respond to support requests.
- •Investigate safety concerns, detect misuse, troubleshoot problems and meet legal obligations.
- •Understand service performance and, only where permitted and with appropriate choices, send optional marketing.
05Legal grounds for processing
Where the law requires a legal basis, it must be identified for each purpose. Depending on the circumstances, processing may be needed to perform a contract, meet a legal obligation, pursue a legitimate interest that does not override your rights, or act on your consent.
Consent must be specific where required, and you should be able to withdraw it without affecting the lawfulness of earlier processing. The applicable legal grounds, any sensitive-data conditions and the jurisdictions where these requirements apply remain subject to legal review.
06When information is shared
A driver or delivery partner may need limited booking information to carry out your request. A sender or recipient may need relevant delivery updates. Personal information should not be shared beyond what is necessary for the task.
Providers supporting hosting, communications, payments or other operations may process information under appropriate arrangements. Information may also need to be disclosed where lawfully required, to address safety or fraud, or in connection with a business change. The final policy must identify actual recipient categories and any legally required disclosures about selling, sharing or advertising uses; none are assumed here.
07Cookies and similar technologies
The website or app may use technologies to keep you signed in, remember preferences, protect the service or understand usage. A verified inventory must describe the technologies used, their providers, purposes and duration.
Where required, non-essential technologies should remain off until you consent. You should be able to change your choices through an accessible control. Browser and device settings may offer additional controls, though disabling some technologies can affect functionality. No specific analytics or advertising provider is asserted in this draft.
08Retention and security
Personal information should be kept only for as long as needed for the stated purpose, including necessary legal, safety, accounting or dispute obligations. Retention periods, deletion triggers and backup handling must be documented for each category before publication.
Appropriate technical and organisational safeguards should protect personal information against unauthorised access, loss and misuse. No system is completely secure. This draft makes no claim about a particular security certification, encryption implementation or guaranteed level of protection.
09Your choices and rights
Depending on the law that applies, you may have rights over your personal information. These rights can have conditions and exceptions. A verified request process must explain how to submit a request, confirm identity where necessary and receive a response within the applicable legal timeframe.
- •Request access to, correction of or deletion of personal information; request a portable copy where available.
- •Object to or restrict certain processing, withdraw consent or opt out of uses where the law provides that choice.
- •Manage device permissions and optional communications. Essential booking or account messages may still be needed.
10International transfers and children
If information is processed outside the place where you live, the final policy must identify relevant transfer arrangements and safeguards required by law, and explain how to obtain more information. Processing locations and transfer mechanisms are to be confirmed; this draft does not assume any.
The service’s minimum age and any rules for children’s information must be confirmed. If you believe a child has provided information inappropriately, raise the concern through the Contact Us page without sending unnecessary identifying documents. Any additional child-privacy notice must be reviewed before launch.
11Requests and privacy concerns
To raise a privacy question in this draft design, use the Contact Us page and choose “Legal or privacy”. Include a short description of your request and the account contact information needed to identify it. Do not include passwords, full card numbers or sensitive identity documents in the initial message.
A verified privacy email or other formal request channel, the responsible legal entity and any required data-protection contact must be added before publication. You may also have the right to complain to your local data-protection authority. The relevant authority and any appeal process depend on applicable law.
12Updates to this policy
This policy should be reviewed when services, providers or data practices change. The approved version must display its effective date and describe how material changes will be communicated. Where consent is required for a new purpose, it should be obtained before that processing starts.
Publication checklist: confirm the legal operator and privacy contact; validate the data and cookie inventory; record recipients, retention periods and processing locations; and review rights, safeguards and notices for each service area. Until then, this remains a draft for legal review.
