Privacy Policy

SHAFFL ("SHAFFL", "we", "our", "the App") is a smart bus and shared mobility application operating in Egypt. We help riders book seats, view schedules, track buses live, and arrive safely and on time.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use SHAFFL, our website, our mobile app, or our customer support channels.

SHAFFL complies with the Egyptian Personal Data Protection Law No. 151 of 2020, which governs consent, data usage, and individual rights such as access, correction, and withdrawal.

This Privacy Policy applies to:

• Riders who use the SHAFFL app to book and take rides.

• Corporate, school, or university accounts using SHAFFL for group transport.

• Drivers and operators who provide transportation through SHAFFL.

• Visitors to our website or social media.

This policy does not apply to any third-party websites, apps, or payment gateways outside SHAFFL's control.

We collect information necessary to operate and improve our transport service.

Identity Data: Full name, mobile number, gender, national ID or passport number (if required), profile photo.

Contact Data: Phone number, email, emergency contact details.

Trip & Mobility Data: Booked routes, pickup & drop-off points, seat reservations, attendance.

Location Data: GPS during app use, pickup and drop-off coordinates, bus GPS for live tracking.

Payment Data: Payment method, transaction reference, billing details.

Device & Technical Data: Device model, OS, app version, IP address, crash logs.

Communication Data: Messages with customer support, complaints, refund requests.

We use personal data to:

1. Operate the service — manage accounts, bookings, and rides.

2. Ensure safety — confirm riders, track vehicles, and assist in emergencies.

3. Handle payments — issue receipts and prevent fraud.

4. Improve performance — analyse routes, fix crashes, and forecast demand.

5. Communicate — send alerts, updates, and offers (you may opt out).

6. Comply with Egyptian law — respond to authorities and maintain required records.

We process your data under one or more of the following legal bases:

• Consent — you agree by creating an account and using SHAFFL.

• Contractual necessity — needed to operate your rides.

• Legal obligation — to meet Egyptian regulatory requirements.

• Legitimate interest — to ensure platform security and prevent misuse.

You can withdraw consent anytime. However, without essential data, SHAFFL cannot function properly.

We do not sell your data. We only share information in specific, lawful cases:

• Drivers/Operators: receive limited rider info (first name, booking code).

• Payment Providers: process payments securely.

• Corporate Accounts: receive attendance summaries and invoices.

• Service Providers: cloud hosting, SMS delivery, analytics (under NDAs).

• Authorities: when legally required or for safety investigations.

• Business Transfers: in case of merger or acquisition, with privacy safeguards.

Location is essential to SHAFFL's service. We use it to show buses nearby, estimate arrival time, and improve route planning.

• You control GPS permissions via your phone settings.

• 'While using the app' means location is only active in foreground.

• Background use is requested explicitly (e.g. 'alert me when to leave now').

Children's data is treated as sensitive under Egyptian law.

For school or youth routes, we collect limited information (child's name, guardian contact, pickup/drop-off) — always with parental or institutional consent.

We never use children's data for marketing.

We keep your data only as long as necessary or required by law.

• Trip data: kept for operational, tax, and safety purposes.

• Payments: kept for financial auditing.

• Complaints: retained longer if related to investigations.

• Technical logs: stored temporarily for debugging.

After that, data is deleted or anonymised permanently.

We use administrative, technical, and physical safeguards to protect your data:

• Encrypted communication between device and servers

• Limited staff access to personal records

• 24/7 monitoring for suspicious activity

If a breach occurs, we'll follow Egyptian PDPL reporting rules and notify affected users.

Under Egypt's Personal Data Protection Law (PDPL), you have the right to:

• Access your data

• Correct or update inaccurate information

• Request deletion of personal data

• Withdraw consent for optional processing

• File a complaint with the Egyptian Personal Data Protection Centre

To exercise these rights, email our Data Protection Officer (DPO) at: privacy@shaffl.app

Data Protection Officer (DPO)

SHAFFL

📧 privacy@shaffl.app

📍 [Company Address – Cairo, Egypt]