Last updated: 20 July 2026

Privacy Policy

VAAI (Pty) Ltd (registration number 2026/435857/07) ("Vaai", "we", "us"), is the Responsible Party for personal information processed through the Vaai rider and driver apps, in terms of the Protection of Personal Information Act 4 of 2013 (POPIA). This policy explains what we collect, why, and your rights over it.

1. Information we collect

You provide directly

  • Name, phone number, email address (optional for riders), profile photo
  • ID document / driver's licence and, for drivers, vehicle registration and roadworthy documents, for identity and eligibility verification
  • Emergency contact details you choose to add
  • Support messages and in-app reports (including safety incident reports)

Collected automatically

  • Real-time and trip-history GPS location, while the app is in use for an active or upcoming trip
  • Device information (model, OS version, push notification token) and app usage/diagnostic data
  • Trip data: pickup/drop-off points, route, fare, timestamps, ratings

From third parties

  • Card verification and payment status from our payment processor (Paystack) — we receive a payment status and a reusable payment token, never your full card number or CVV
  • Identity/document verification results where automated verification is used

2. How we use your information

  • To match riders with drivers and facilitate and track trips
  • To process payments and calculate fares, commissions and driver payouts
  • To verify identity and eligibility (including regulatory requirements such as NPTR)
  • To power safety features: emergency alerts, live trip sharing, route-deviation detection, incident response
  • To provide customer support and investigate complaints or disputes
  • To send trip-related notifications (SMS, push, email) and, where you've opted in, product updates
  • To detect fraud, abuse and safety risks, and to comply with legal obligations

3. Who we share it with

  • Your matched driver or rider sees limited trip-relevant information (name, photo, rating, vehicle details, approximate location) — never your full phone number by default, which is masked/proxied for calls where that feature is enabled
  • Service providers who process data on our behalf: cloud hosting and file storage, payment processing (Paystack), SMS/WhatsApp delivery, push notifications, error monitoring — each under a data processing agreement
  • Your nominated emergency contacts, only when a safety alert is triggered
  • Regulators and law enforcement, where required by law or a valid legal process
  • A successor entity in the event of a merger, acquisition or sale of assets, subject to equivalent privacy protections

We do not sell your personal information.

4. Where your data is stored

Trip and account data is stored on servers located in the AWS Africa (Cape Town) region (af-south-1). Media such as verification documents and vehicle photos are stored in encrypted object storage (AWS S3) with restricted access. Where any processing occurs outside South Africa (for example, a sub-processor with infrastructure elsewhere), we rely on safeguards required by POPIA section 72 for cross-border transfers.

5. How long we keep it

We retain personal information for as long as your account is active, and for 5 years after account closure to meet legal, tax (SARS), regulatory (NPTR) and dispute-resolution obligations — trip and payment records in particular are kept for this period to satisfy tax law. Safety-incident records are kept for as long as needed to resolve any related investigation or legal claim. You can request earlier deletion of information we no longer have a lawful basis to hold — see your rights below.

6. Security

We use encryption in transit (TLS/HTTPS) and at rest, role-based access controls, tokenised payment storage (raw card numbers never touch our servers), and masked calling so drivers and riders can coordinate without exchanging real phone numbers. No system is completely secure; see our data breach procedure for how we respond if something goes wrong.

7. Your rights

Under POPIA, you have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or outdated information
  • Request deletion of personal information we no longer have a lawful basis to hold
  • Object to processing for direct marketing at any time
  • Complain to our Information Officer, and thereafter to the Information Regulator of South Africa, if you believe your rights have been infringed

To exercise any of these rights, contact support@vaai.taxi.

8. Children

The Service is not directed at, and may not be used by, anyone under 18.

9. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email before they take effect.

10. Contact / Information Officer

Information Officer: Jashin Sookdhoo (ISO 27001 Certified)
Phone: +27 64 900 0805
Email: support@vaai.taxi
Postal address: B113-02 Fish Eagle View, 15C Benacre Ln, Modderfontein, Gauteng, 1609

Information Regulator (South Africa): JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001 — complaints@inforegulator.org.za