Privacy Policy
Fasta operates a ride-hailing and delivery service in Nyeri and Nanyuki, Kenya. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it.
What we collect
| Data | Why |
|---|---|
| Name and phone number | To create your account, sign you in, and let riders and drivers contact each other about a trip. |
| Email address (optional) | Account recovery and service notices. |
| Profile photo (optional) | So riders and drivers can recognise each other. |
| Precise location | To find nearby drivers, calculate fares and show the trip on the map. The driver app collects location while you are online so riders can be matched to you. |
| Trip history | Receipts, support enquiries and dispute resolution. |
| Payment references | M-Pesa transaction and receipt numbers, to confirm a trip has been paid. We never see or store your M-Pesa PIN, and we do not store card numbers. |
| Device push token | To notify you when a driver accepts, arrives, or a trip completes. |
| Driver documents | Drivers only: licence, ID and vehicle records, to verify who is carrying passengers and parcels. |
How location is used
Riders' location is collected when you are booking or on a trip. Drivers' location is collected while they are online and available for work, and stops when they go offline. Location is used to match trips, price them by distance and show live progress. We do not sell location data and we do not use it for advertising.
Who we share data with
- The other party on your trip. Riders and drivers see each other's name, rating and the phone number needed to coordinate pickup.
- Supabase — hosts our database and handles sign-in.
- Safaricom (M-Pesa) — processes payments you choose to make by M-Pesa.
- Africa's Talking — delivers the one-time codes we send by SMS.
- Google Maps — provides the maps and address lookup shown in the apps.
We do not sell your personal data to anyone.
How long we keep it
Account details are kept while your account is open. Trip and payment records are kept for seven years, as financial records generally must be. If you close your account we delete or anonymise whatever we are not legally required to retain.
Your rights
Under Kenya's Data Protection Act 2019 you may:
- ask for a copy of the personal data we hold about you;
- ask us to correct anything inaccurate;
- ask us to delete your account and data, subject to records we must keep;
- object to how we use your data, or ask us to restrict it;
- complain to the Office of the Data Protection Commissioner.
To exercise any of these, email privacy@fasta.site.
Security
Data is transmitted over encrypted connections and stored in a database with row-level access rules, so each account can reach only its own records. Payment and messaging credentials are held server-side and are never included in the apps.
Children
Fasta is not intended for anyone under 18, and we do not knowingly collect their data.
Changes
If this policy changes materially we will update the date above and notify you in the app before the change takes effect.
Contact
Questions about this policy: privacy@fasta.site
General enquiries: hello@fasta.site