Privacy Policy

This Privacy Policy explains how CabConnect (“we”, “us”, or “our”) collects, uses, shares, and protects your personal information when you use our mobile applications (the CabConnect rider app and the CabConnect driver app), our website, and related services (together, the “Services”). CabConnect is a mobility platform operating in Lesotho that connects riders with drivers for transport and delivery.

By using the Services, you agree to the practices described in this Policy. If you do not agree, please do not use the Services.

1. Information We Collect

a. Information you provide

• Account details: name, email address, phone number, and password when you register. If you sign in with Google, we receive your name, email, and profile photo from your Google account.
• Profile information: profile photo and, for drivers, vehicle and document details you upload.
• Trip and booking details: pickup and drop-off locations and addresses, ride category, and notes you enter.
• Payment details: the mobile money (M-Pesa) phone number you use to pay and the resulting transaction reference. We do not collect or store your M-Pesa PIN or bank card numbers — these are entered directly with the payment provider.
• Communications: messages you send to support and feedback you provide.

b. Information collected automatically

• Location information: with your permission, we collect precise (GPS) location from your device to show nearby drivers, set pickup points, calculate routes and fares, and track trips in real time. Drivers’ location may be collected while a trip is active so riders can follow the vehicle. You can disable location access in your device settings, but core features will not work without it.
• Device and usage data: device model, operating system, app version, unique identifiers, and app activity/log data used for security and troubleshooting.

2. How We Use Your Information

• Create and manage your account and authenticate you.
• Provide the core service: matching riders and drivers, routing, fare estimation, and live trip tracking.
• Process payments through our mobile money provider.
• Send service messages such as booking and payment updates.
• Maintain safety and security, prevent fraud, and resolve disputes.
• Provide customer support and improve the Services.
• Comply with legal obligations.

3. How We Share Your Information

We do not sell your personal information. We share it only as needed:

• Between riders and drivers: to complete a trip we share limited details (e.g. first name, location, and the phone number needed to coordinate the ride) with the matched party.
• Service providers (processors) who help us run the Services, including:
  • Google — Maps, Sign-In, and Firebase Authentication;
  • Vodacom M-Pesa — payment processing;
  • MongoDB and Supabase — database and backend hosting;
  • UploadThing — secure file/photo uploads;
  • our cloud hosting and analytics providers.
• Legal and safety: when required by law, court order, or to protect the rights, property, or safety of users and the public.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. Data Retention

We keep your information for as long as your account is active and as needed to provide the Services. We may retain certain data for longer where required for legal, tax, accounting, safety, or dispute-resolution purposes. When no longer needed, information is deleted or anonymised.

5. Your Rights & Choices

Subject to applicable law, you may:

• access and update your account information in the app;
• turn off location and notification permissions in device settings;
• request a copy of your personal data;
• request correction or deletion of your data.

Account & Data Deletion

You can request deletion of your account and associated personal data at any time by emailing info@cabconnect.co.ls from the address linked to your account, or by using the delete option in the app where available. We will verify your request and delete your data within 30 days, except information we must retain for legal or fraud-prevention reasons.

6. Data Security

We use reasonable technical and organisational measures — including encryption in transit, access controls, and trusted hosting providers — to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Children’s Privacy

The Services are not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

8. International Transfers

Some of our service providers store and process data outside Lesotho. Where this happens, we take steps to ensure your information remains protected in line with this Policy.

9. Changes to This Policy

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date. Significant changes may be notified in the app. Continued use of the Services after changes take effect means you accept the updated Policy.

10. Contact Us

If you have questions about this Policy or your data, contact us at info@cabconnect.co.ls.

CabConnect — Maseru, Lesotho.