01Overview
Mkhaya ("Mkhaya", "we", "us", "our") provides ride-hailing, airport transfer, parcel and courier services through a mobile app, a WhatsApp channel, and a web booking experience (together, the "Services"). This policy applies to riders, drivers and anyone who contacts us through those Services.
We built Mkhaya around a simple rule: collect only what a safe, reliable trip actually requires, and protect it properly. Our data handling is designed against the principles of South Africa's Protection of Personal Information Act (POPIA) — purpose limitation, minimality, and security safeguards — from the ground up.
02Information we collect
What we collect depends on whether you're riding, driving, or simply messaging us.
From every user
- Identity & contact details — name, WhatsApp number or mobile number, used to create your account and verify it by one-time PIN (no passwords are stored).
- Trip information — pickup and drop-off locations, trip times, fare, route, and ride history.
- Payment & wallet data — wallet balance, top-ups, and transaction records. Card numbers are handled by our payment processor and are never stored on Mkhaya's own servers.
- Communications — messages you send us via WhatsApp, in-app chat, or Customer Care, including safety reports.
- Device & usage data — app version, device type, crash logs and general usage patterns, used to keep the Services reliable.
From drivers, additionally
- Vetting documents — ID document, driving licence, vehicle registration and profile photo, submitted for verification before you can drive with Mkhaya.
- Vehicle details — make, model, colour and registration, shown to riders for identification.
- Live location — while online and during trips, so riders and Mkhaya can track the journey.
We do not collect
Mkhaya never asks for your account passwords elsewhere, and we don't request access to your photos, contacts or messages beyond what you choose to share with us directly.
03How we use it
- To create and secure your account, and verify you by one-time PIN.
- To match riders with nearby, verified drivers and calculate fares.
- To track trips in progress for safety, and to generate trip receipts and invoices.
- To operate your Mkhaya Wallet and process top-ups, fares and driver payouts.
- To respond to support requests, safety incidents, and emergency assistance requests.
- To improve the reliability of the app, WhatsApp channel and website, and to detect fraud or misuse.
- To send you trip updates, receipts and, where you've agreed to receive them, service or promotional messages.
04WhatsApp & messaging
WhatsApp is a core channel for booking and support — including trip confirmations, driver details, and verification codes. Messages sent through WhatsApp are processed via the WhatsApp Business Platform (operated by Meta) and are subject to WhatsApp's own terms and privacy policy in addition to this one.
Conversation transcripts are stored so we can resolve support queries and improve how our automated assistant understands requests. Verification codes and account access are never sent by SMS — WhatsApp is the only messaging channel Mkhaya relies on for this.
05Location data
We use precise location to find your pickup point, match you with nearby drivers, plot your route, and track trips in progress for safety.
- Riders — location is used while you're actively booking or on a trip. You can decline location access, but you'll need to enter your pickup address manually.
- Drivers — location is collected while you are online and available for trips, and throughout an active trip, so riders and our safety systems can follow your journey.
Trip routes are retained as part of your trip history for receipts, support, and safety review.
07Storage & security
Structured account, trip, wallet and payment data is held in secure, access-controlled databases. Documents such as ID photos and vehicle images are encrypted, stored separately from everyday application data, and only decrypted for authorised review during driver verification.
- Sensitive fields — including phone numbers and ID documents — are encrypted at rest and access is logged.
- Account access uses short-lived, revocable sessions rather than long-lived passwords.
- Trip invoices are generated on demand and are not left sitting in long-term file storage.
- Access to rider and driver data is limited by role — support, safety and vetting teams see only what their role requires.
No system is completely immune to risk, but we design and review Mkhaya's data handling with these safeguards as a starting requirement, not an afterthought.
08Retention
We keep personal information only as long as it's needed for the purposes described in this policy — typically for the lifetime of your account plus a limited period afterwards to meet legal, tax, safety and dispute-resolution obligations. Driver vetting documents are retained for as long as required by applicable transport and safety regulations. You can request earlier deletion of your account data as described in Section 9, subject to those legal requirements.
09Your rights & choices
Depending on where you live, you may have the right to:
- Access a copy of the personal information we hold about you.
- Correct information that's inaccurate or out of date.
- Request deletion of your account and associated data, subject to legal retention requirements.
- Withdraw consent to marketing messages at any time.
- Object to certain uses of your information, or ask us to restrict processing.
You can manage notification preferences directly in the app under Settings, or reach out using the details in Section 12 to exercise any of the rights above.
10Children's privacy
Mkhaya's Services are intended for users aged 18 and over. We do not knowingly collect personal information from children. If you believe a child has created an account or provided us with information, please contact us so we can remove it.
11Changes to this policy
We may update this policy as our Services evolve or as legal requirements change. We'll update the "Last updated" date at the top of this page, and where a change is material, we'll let you know in the app or via WhatsApp before it takes effect.
12Contact us
If you have questions about this policy or how your information is handled, reach out to our team:
Mkhaya Privacy Team
We aim to respond to all privacy requests within a reasonable time, and always within any timeframe required by law.