Privacy Policy

Last updated: 5 October 2026

This policy explains what personal data Sari collects when you use the Sari rider app, the Sari Driver app and taxi.qabaa.org, why we collect it, who we share it with, and the rights you have. "We" and "us" mean the operator of Sari.

1. Who is responsible

The operator of Sari is the data controller for the personal data described here. For any privacy question or request, email privacy@qabaa.org.

2. The data we collect

Everyone with an account

• Account details: name, email address, username, phone number (if you add one), preferred language and a securely hashed password. If you sign in with Google we receive your name, email address and Google account identifier. We never receive your Google password.
• Profile photo, if you upload one. Photos are reviewed before they are shown to others.
• Ratings and comments you give and receive after a ride.
• Support messages and safety alerts you send us. If you press the SOS button during a ride, we record the alert and your location at that moment.
• Device and security data: push notification tokens, the IP address and browser or app identifier used when you sign in, and failed sign-in attempts (used to protect your account).
• Referral codes, promo codes and points you earn or use.

Riders

• Ride details: pickup, stops and destination addresses, the route, times, fare, tip, discounts and the status of each ride.
• Location: when the app is open we use your device location to set your pickup point and show nearby cars. The location used to show nearby cars is kept in memory only and is not stored.
• Saved addresses such as "Home" or "Work".
• Payment details: card payments are processed by Stripe. We never see or store your full card number. We store the card brand, the last four digits, the expiry date and a Stripe reference, plus a record of every payment, refund and receipt.

Drivers

• Verification details: driving licence number and expiry date, national identity number, vehicle details (make, model, colour, registration plate), insurance details, and the documents you upload so we can approve you.
• Location while online: your current location while you are online, and a GPS trail of each ride.
• Earnings and ride history.

3. What other people can see

• Before booking, riders nearby can see an online driver's name, photo, rating and vehicle. A driver's internal account identifier is never shared.
• During a ride, the rider and driver see each other's name, photo and rating, and the rider sees the vehicle and the driver's position.
• If you share a ride link, anyone with that link can see the ride's progress. The link stops working 15 minutes after the ride ends.

4. Why we use your data, and our legal basis

• To provide rides: matching riders and drivers, navigation, fares, payments, receipts and ride history. Legal basis: performance of our contract with you.
• Safety and security: approving drivers, handling SOS alerts and support reports, preventing fraud and protecting accounts. Legal basis: our legitimate interest in a safe service, and in some cases the vital interests of a person in danger.
• Accounting: keeping payment and ride records. Legal basis: legal obligation under accounting law.
• Notifications: ride updates and account messages by push notification and email. Push notifications and location access can be turned off in your device settings.
• Improving the apps: crash reports that help us fix errors. Legal basis: our legitimate interest in a working service.

We do not sell your personal data and we do not use it for advertising.

5. Service providers we share data with

We only share what each provider needs to do its job:

• Stripe processes card payments.
• Google provides Google Sign-In, push notifications and crash reports (Firebase), and address search (Google Places). Address searches send the text you type, not your identity.
• Mapbox provides maps and route calculation.
• Brevo sends our emails, such as verification messages, password resets and receipts.
• Cloudflare carries network traffic to our servers securely.
• Backblaze stores our encrypted backups.

Some of these providers are based in or process data in the United States. Where data leaves the EU/EEA, the transfer is protected by the EU–U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses. We may also disclose data when the law requires it, for example to the police.

6. How long we keep data

• Your account is kept until you delete it.
• Ride GPS trails are deleted automatically after 90 days.
• Sign-in sessions are removed 30 days after they expire.
• Data export files can be downloaded for 72 hours.
• Ride and payment records are kept for as long as accounting law requires. After an account is deleted they are no longer linked to your name or contact details.
• Backups are encrypted and replaced on a rolling schedule. Deleted data disappears from them within 12 months.

7. Deleting your account

You can ask to delete your account in the app under Profile → Privacy & Security, or by emailing us. We respond within 30 days. Deletion removes your name, email address, phone number, photo, password, saved addresses, stored cards, devices, notifications and the GPS trails of your rides. Ride and payment records stay for accounting, with your identity removed. A ride that is in progress must finish first, and rides booked for later are cancelled. Driver accounts contain licence and vehicle records with their own legal requirements, so drivers should email us and we handle the request individually.

8. Your rights

Under the GDPR you have the right to:

• access your data. You can request a copy in the app under Profile → Privacy & Security.
• correct inaccurate data.
• have your data erased.
• restrict or object to certain processing.
• receive your data in a portable format.
• withdraw consent at any time, where processing is based on consent.

To use these rights, email privacy@qabaa.org. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or your local data protection authority.

9. Security

Connections are encrypted, passwords are stored as one-way hashes, accounts are locked after repeated failed sign-ins, and backups are encrypted. No system is perfectly secure, but we work to protect your data and will tell you and the authorities about a breach when the law requires it.

10. Age

You must be at least 18 years old to create an account.

11. Changes to this policy

If we change this policy, we will update the date at the top. For significant changes, we will also tell you in the app or by email.