Privacy Policy

1. Who we are

dropCab is a ride-sharing platform that pairs commuters travelling the same way with verified drivers who are already making the trip. It is operated by Deinox Ltd. ("Deinox", "we", "us"), a company registered in Ghana, with its office at HP 1385, Ho, Ghana. Deinox is the data controller for the personal data described in this policy.

2. What this policy covers

This policy applies to personal data we collect through:

• the dropCab website at dropcab.app (the "Site"), including its enquiry and newsletter forms;
• the dropCab web app at ride.dropcab.app (the "App"), whether used in a browser or installed on your home screen;
• email, phone and in-app support conversations with our team.

It is written to comply with the Data Protection Act, 2012 (Act 843) of Ghana. If you use dropCab from outside Ghana, you accept that your data is processed in Ghana under Ghanaian law.

3. What we collect

3.1 Information you give us

3.2 Information generated when you use dropCab

• Trips and bookings — trips you publish or book, pickup and drop-off points, seats, agreed fares, boarding-code scans, cancellations and no-shows.
• Location — see section 7. Drivers' live position during an active trip; riders' pickup and drop-off locations; searches you make on the map.
• Payments — for cash fares we record only that a fare was agreed and marked as paid. If you use the in-app wallet or pay by card or mobile money, we keep the transaction reference, amount, status and wallet balance. Card and mobile-money details are handled by our payment processor (Paystack) and never reach our servers.
• Safety — if you trigger an emergency SOS, we record the time, your location trail while the alert is active, the trip involved and what was shared with your contacts and our safety team.
• Device and technical data — IP address, browser and device type, session identifiers, login history and failed attempts, push-notification subscription, and the version of the App you are using.
• Audit records — actions taken on your account by you or by our support and admin staff.

3.3 Information from others

• Ratings and reports about you from other riders or drivers.
• Confirmation from Paystack that a payment succeeded or failed.
• If someone refers you, the referral code that linked you to them.

We do not collect data from social networks, data brokers or advertising networks.

4. How we use it

• Running the service — creating your account, matching riders with trips heading the same way, showing pickup points, confirming who boards, and recording fares.
• Verification and trust — reviewing driver and vehicle documents before a driver can publish a trip, showing ratings, and showing riders a verified driver's name, photo, vehicle and plate.
• Safety — operating live tracking and trip sharing, responding to SOS alerts, investigating incidents and abuse reports, and suspending accounts that put others at risk.
• Payments — processing wallet top-ups, in-app fares, driver payouts, vouchers, referrals and receipts, and detecting payment fraud.
• Communicating with you — verification codes, booking and trip updates, safety alerts, support replies and, where you have opted in, product news.
• Improving dropCab — understanding which routes and pickup points are used, fixing bugs, and planning where to open next. Where possible we use aggregated or de-identified data for this.
• Legal and compliance — meeting our obligations under Ghanaian law, responding to lawful requests, and enforcing our Terms & Conditions.

We do not use your data for automated decisions that have a legal or similarly significant effect on you without human review.

5. Our legal basis

Under Act 843 we process your personal data on one or more of these grounds:

• Performing our contract with you — most processing exists simply so the App can work for you.
• Your consent — for optional things such as marketing emails, sharing a live trip with a contact, and emergency contacts. You can withdraw consent at any time in your settings or by contacting us.
• Our legitimate interests — keeping the platform safe, preventing fraud, and improving the service, balanced against your rights.
• Legal obligation — record-keeping and responding to lawful requests from authorities.

6. Who we share it with

6.1 Other dropCab users

• When a rider books a trip, the driver sees the rider's first name, photo or avatar, rating, pickup point and, once boarded, the boarding-code confirmation.
• The rider sees the driver's name, photo, rating, vehicle make, model, colour and plate number, and the driver's live position during the trip.
• Riders sharing the same trip can see each other's first names and pickup points.
• If you share a trip with a contact, that person receives a link showing the trip route, driver details and live position until the trip ends or you stop sharing.
• If you trigger an SOS, your chosen emergency contacts and our safety team receive your location and trip details.

Phone numbers and email addresses are never shown to other users unless you choose to share them yourself.

6.2 Service providers who work for us

We use a small number of providers who process data only on our instructions:

• Paystack — card and mobile-money payments, wallet top-ups and payouts.
• Hosting and database providers — where the App, Site and our data are stored.
• Email and SMS delivery providers — verification codes, notifications and support replies.
• Map tiles from OpenStreetMap — your browser requests map images directly, which means the tile server sees your IP address and the map area you are viewing.
• Avatar service — if you have not uploaded a photo, a generated placeholder avatar is fetched from a third-party image service using a non-identifying seed.

6.3 Authorities and legal requests

We disclose personal data where the law requires it, in response to a valid order from a court or regulator, or where it is necessary to protect someone's life or safety — for example in an emergency escalated to the police.

6.4 Business changes

If Deinox merges with, or transfers dropCab to, another organisation, your data may transfer with it. The new operator would be bound by this policy unless you are told otherwise and given a choice.

We do not sell personal data and we do not share it with advertisers.

7. Location data

• Drivers — the App collects your live position only while you have an active trip and have tracking turned on. It is used to show riders where you are, to estimate arrival times, and to keep a record of the route in case of a dispute or incident. Tracking stops when the trip is completed or cancelled.
• Riders — we use your position, if you allow it, to suggest nearby pickup points and to confirm boarding. Your position is not tracked continuously.
• SOS — while an emergency alert is active we record a location trail so our safety team and your contacts can find you.
• You can turn location access off in your browser or device settings at any time. Some features — live tracking for drivers in particular — will not work without it.

8. Cookies and local storage

The Site and App use a small number of strictly necessary cookies and browser storage entries: to keep you signed in, to remember preferences such as language and notification settings, and to protect against cross-site request forgery. We do not use advertising cookies or third-party analytics trackers. Clearing your browser storage signs you out but does not delete your account.

9. How long we keep it

10. How we protect it

We encrypt data in transit (TLS 1.2 or higher), store passwords only as salted hashes, restrict access to personal data to staff who need it for their role, log administrative actions, and have had the platform independently penetration-tested. No system is perfectly secure; if we discover a breach that is likely to affect you, we will tell you and the Data Protection Commission as the law requires.

11. Your rights

Under Act 843 you have the right to:

• Access — ask for a copy of the personal data we hold about you.
• Correction — fix inaccurate or incomplete data. Most profile fields can be edited in the App; identity-sensitive fields (legal name, ID number, phone) can be changed once in-app and afterwards by written request with proof of identity, to protect you from account takeover.
• Deletion — ask us to delete your account and data, subject to the retention periods above.
• Objection and restriction — object to processing based on our legitimate interests, or ask us to restrict it while a dispute is resolved.
• Withdraw consent — for anything we do based on consent, at any time, without affecting what was done before.
• Portability — receive the data you gave us in a commonly used, machine-readable format.
• Complain — to us first, and if you are not satisfied, to the Data Protection Commission of Ghana.

To exercise any of these, email info@dropcab.app from the address on your account. We respond within 30 days and may ask you to confirm your identity first.

12. Children

dropCab is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, tell us and we will remove it.

13. Changes to this policy

We may update this policy as dropCab develops — for example when we leave beta or add features. We will post the new version here with a new effective date and, for significant changes, notify you in the App or by email before they take effect.

14. Contact us

Data Protection Commission of Ghana: dataprotection.org.gh