Privacy Policy

VAYA ("we") operates the VAYA mobile application and website (the "Platform") and is responsible for the processing of your personal data described below.

For any question or request about your data, contact VAYA Support, whose contact details are published on VAYA's App Store and Google Play pages.

The terms Member, Driver, Passenger, Ride, Booking, Trip, Stop and Contribution have the meaning given in our Terms of Use.

We collect what is needed to run a carpooling platform: your account details, the journeys you search for, publish and book, your messages and ratings and, during a Trip, the Driver's location. During pickup, if you agree, we also use the Passenger’s location, until they are on board.

Drivers also provide photos of their licence, insurance and face, which only authorised VAYA staff can see.

Other Members see your name, photo, ratings and, for Drivers, the vehicle's make, model and colour. Your phone number, and a Driver's number plate, are shown only to the other party of an accepted Booking.

We do not sell your data, show advertising, or use third-party analytics or advertising tools.

You can access and correct your data and delete your account from the app.

Account: phone number (phone sign-in), full name, language.

Contact number (optional): a phone number you can enter in the app so that the other party of an accepted Booking can call you. VAYA does not verify it and does not use it to sign you in.

Google sign-in: if you choose "Sign in with Google", we receive from Google your Google identifier, name, email address and Google profile-photo link.

Profile: optional profile photo, chosen from your photo library or taken from Google.

Driver profile: vehicle make, model, colour, number plate, seats and photo; optional biography and languages spoken.

Driver Verification: photos of your driving licence, insurance certificate and face (selfie), taken with the camera inside the app.

Rides you publish: origin, destination, departure time, chosen route, Stops, seats, Contribution.

Searches and bookings: origin, destination, date, time and seats searched; the pickup and drop-off points proposed to you; Booking Requests; "Notify me" alerts (journey and time window).

Messages exchanged with the other party of a Booking Request or Booking, including the message sent with a request; ratings, punctuality indicators and comments you give; the reason you select when cancelling; no-show reports; reports and messages you send to VAYA Support.

Driver location during a Trip: from the moment a Driver starts a Trip and while the Driver's app is open, the app sends the device's GPS position (coordinates, heading, speed, accuracy) about every 7 seconds. We store only the most recent position: each new position overwrites the previous one. We also record once whether the Driver came near the departure point, and whether the vehicle is following or has deviated from the planned route.

Passenger location during pickup: if you agree in the app, around the meeting time (at the earliest 30 minutes before departure) and until you are on board, your app sends the device’s position (coordinates, accuracy) about every 8 seconds. It is used to show the Driver where you are, to detect automatically that you are together and on board, and to know who is waiting for whom at the meeting point. Only the latest position is kept, and it is erased as soon as you are on board.

The pickup moment: we record since when a party has been waiting at the meeting point (from their position, or because they said “I’m at the meeting point”), the “X is waiting for you” message sent to the other party, their answer (“On my way” with a delay, or “I’m not coming”), and the time of boarding and what confirmed it (the Driver, the Passenger or automatic detection).

One-off device location: if you allow location access, your position is used to centre the map, offer your current position as your departure point and, if you choose, accompany a no-show report. It is not stored as a location history.

Booking and Trip records: status changes and timestamps (request, acceptance, expiry, cancellation, start, pickup, drop-off, completion), the pickup and drop-off points and meeting places used, walking distance to the Stop.

Reputation: average rating, number of completed Trips, punctuality and reliability scores, trust level, and reliability points from late cancellations and no-shows.

Co-travel history: how many completed Trips you have made with each other Member, and the date of the last one. It is not shown to other Members.

Recurring journeys: journeys you appear to make regularly, inferred from your history (route, days, time window, confidence score), and your response to a suggestion.

Usage events: for example starting a search, results shown, a result selected, a Stop chosen or a notification opened, with the related journey details (including origin and destination coordinates) and the time. They are stored in our own systems and are not sent to analytics companies.

Notifications sent and whether you have read them; push-notification token and platform (iOS/Android); IP address and request data in server logs; sign-in code requests and failed attempts (codes are stored only in protected, unreadable form); sessions; and, when error tracking is enabled, technical error reports (device model, OS and app version, error details).

Data from other Members and from VAYA staff: ratings and comments about you, no-show or other reports about you, decisions and notes by VAYA staff (Driver Verification outcome, reason given to you, internal notes, suspension).

We do not collect bank details (VAYA processes no payments), your contacts, your location in the background (when the app is closed), or advertising identifiers. We do not use automated facial recognition.

Creating and securing your account, signing you in, showing your profile to other Members: performance of our contract (the Terms of Use).

Searching, matching and ranking Rides, proposing routes and Stops, calculating the Contribution Range, handling Booking Requests, deadlines, acceptance, expiry and withdrawal of duplicate requests: performance of the contract.

Letting the parties to a Booking Request or Booking communicate (messages; once accepted, phone number and number plate): performance of the contract.

Live Trip tracking, arrival estimates and automatic Trip progress: performance of the contract with the Driver and the Passengers, and our legitimate interest in the safety and reliability of Trips.

Driver Verification: performance of the contract with the Driver and our legitimate interest in protecting Passengers.

Ratings, trust levels, handling of cancellations and no-shows (including automatic no-show recording): performance of the contract and legitimate interest in a reliable platform.

Notifications (push, in-app, SMS codes, emails): performance of the contract. Push notifications are sent only if you allow them on your device.

Recurring-journey suggestions and proactive matches: legitimate interest in offering relevant journeys; you can dismiss any suggestion.

Safety, handling reports, moderation, enforcing the Terms, preventing fraud and abuse, information security: legitimate interest and, where applicable, legal obligations.

Statistics and service improvement (for example understanding demand by route) and error diagnosis: legitimate interest; reports seen by staff are aggregated.

Complying with the law, responding to authorities, establishing or defending legal claims: legal obligation and legitimate interest. Protecting someone's life in an emergency: vital interests, only where genuinely necessary.

Where the applicable law requires your consent for a processing activity, we ask for it and you can withdraw it at any time. You can object to processing based on our legitimate interests (section 14). Data marked as required in the app is needed to provide the service; profile photo, biography and languages are optional.

The photos are taken live in the app; library uploads are not accepted.

They are stored in a private area that is not publicly accessible. Only VAYA staff responsible for verification can view them, through the internal administration tool.

A staff member compares them manually. We do not use automated facial recognition or automated document reading.

They are never shown to other Members, who see only that you are a verified Driver.

Anyone viewing your profile: your full name and photo; the month you joined; your average rating, the number of ratings and their spread from 1 to 5 stars, number of Trips, punctuality and reliability scores and trust level; for a Driver, that VAYA verified them, the vehicle's make, model, colour and photo, biography and languages.

Anyone searching for a journey: the Rides you publish (origin, destination, route, Stops, time, price, seats). If you prefer, choose a departure point that is not your exact address.

Anyone viewing a Ride: the first name, photo and rating of Passengers already accepted on that Ride.

Your phone number and, for a Driver, the vehicle's number plate (to identify the right car): only the other party of an accepted Booking, and only while it remains accepted.

The Driver of a Ride: your pickup and drop-off points, your Booking Request and the message sent with it. Messages: only the two parties of the Booking.

The Driver’s live position: the Driver, and the Passengers of that Trip once on board. Before boarding, a Passenger sees the car only once the Trip has started and the car is within 3 km of their pickup point; further away, they see the estimated arrival time and the route, not the live position.

The Passenger’s location during pickup: only the Driver of that Trip, and only until boarding.

Rating comments: the rated Member. Reliability points, verification documents and internal notes are not visible to other Members.

We use providers that process data on our behalf and on our instructions: our cloud hosting and file-storage providers (servers, databases, photos and documents); Twilio (sending sign-in codes by SMS: phone number and code); Google Maps Platform (place search, routes and travel times: searched text and coordinates, without your identity); Expo, with Google Firebase Cloud Messaging and Apple's push notification service (delivering push notifications: token and notification content, which can include the other Member's first name and photo, places, times, a price and the message sent with a Booking Request); Resend (transactional emails for Google accounts: email address, name, email content); Sentry, when enabled (error diagnosis: technical data); and, where used, OpenStreetMap services (fallback place search, map checks of Stops and finding suitable meeting places along published Rides: searched text, coordinates and map areas, without your identity).

Google, when you use Google sign-in and when the app displays Google Maps on your device, and Apple and Google for the app stores and operating systems, process data under their own privacy policies.

We disclose data to courts, police or other competent authorities when the law requires it, in response to a valid legal request, or where necessary to protect someone's life or physical safety. We may also use or disclose data to establish, exercise or defend legal claims. We assess each request and disclose only what is necessary.

If VAYA is reorganised, merged or sold, data may be transferred to the new operator, who must respect this policy; we will inform you.

We do not sell personal data and do not share it for advertising.

Some of these providers process data outside your country, in particular in the United States. These transfers are made with the safeguards and, where required, the authorisations required by the applicable data-protection law. You can obtain information about these safeguards from VAYA Support.

A small number of VAYA staff use an internal administration tool, each with an individual account. Depending on their role, they can: search for and view Member accounts (including phone number and email), driver profiles, vehicles, and recent Rides and Bookings, to support Members, handle reports and enforce the Terms; view Driver Verification documents and approve or decline them; handle reports; cancel a Ride, restrict a Driver, suspend or reactivate an account; and view aggregated statistics on searches and demand.

Every action that changes an account, a Ride, a verification or a report is recorded in an audit log showing the staff member, the time and the reason.

The administration tool gives no access to message content. Staff are bound by confidentiality and access data only when their tasks require it.

We apply measures appropriate to the risk, including: encryption of data in transit (HTTPS); sign-in codes stored only as one-way cryptographic values, with limits on attempts; short-lived access tokens; rate limiting; verification documents in private storage accessible only through authenticated staff access; server-side checks on every action; and an audit log of staff actions.

No system is completely secure. If a personal-data breach is likely to put your rights at risk, we notify the competent supervisory authority and, where the risk is high, the people affected, as required by law.

We keep your account and profile data for as long as your account exists, and other data for as long as needed for the purposes in section 5, based on these criteria: the life of your account, the need to keep a consistent history for other Members, the security of the Platform, and the time needed to handle a dispute or meet a legal obligation.

The Driver's latest position during a Trip is kept with that Trip's record. Driver Verification documents are kept while you are a Driver and deleted when you delete your account. The Passenger’s location during pickup is erased as soon as they are on board; information about the pickup moment (waiting, answer, boarding) is kept with the Trip’s record.

We may keep data longer if the law requires it, or for as long as needed to handle an ongoing dispute, investigation or legal claim.

Search ranking and pickup/drop-off proposals: Rides are ordered by how well they fit your journey (walking distance, detour, departure time), and for each Ride the Platform chooses the pickup and drop-off points from the Driver's route and offered areas, taking into account walking distance, the Driver's detour and the kind of place. This does not decide your access to the service.

Contribution Range: calculated from the route's distance and estimated duration. Trust level: calculated from your number of completed Trips, average rating and account age. Recurring-journey suggestions: inferred from your history, and you can dismiss them.

Automatic Trip progress: arrival at the pickup point, boarding and the end of a Trip may be inferred from location data; Trips left open long after their expected end are closed automatically, as are Rides never started, a few hours after their expected arrival. Boarding can also be inferred when the Driver’s and Passenger’s phones stay close and then move together; conversely, it is never inferred or accepted when both phones clearly show you are not together. When in doubt, the app asks you rather than deciding.

Automatic no-show recording: when location data and Trip status clearly show that a party never came to the meeting point, the Platform may record a no-show, with reliability points and a 1-star rating for the absent Member. You can ask for review by a person, give your point of view and contest the decision by contacting VAYA Support (Terms, Article 10).

VAYA does not suspend or close accounts based solely on automated processing: those decisions are taken by a member of staff.

Under the conditions of the applicable law, you have the right to access your data and obtain a copy; to rectification (name, photo and language can be changed in the app); to erasure (section 15); to restriction; to object to processing based on legitimate interests, including profiling; to portability of the data you provided; to withdraw consent where processing is based on it; and not to be subject to a decision based solely on automated processing with significant effects, as described in section 13.

To exercise these rights, contact VAYA Support from the phone number or email address linked to your account, or use the in-app tools where available. We may ask you to confirm your identity, and we reply within the time limits set by law.

You can also lodge a complaint with the competent data-protection authority: in Tunisia, the Instance Nationale de Protection des Données Personnelles (INPDP), or the authority of your country of residence.

In the app: Profile → Terms & Privacy → Delete my account.

Deletion is not possible while you have a pending or accepted Booking, or a Ride that is published, full or in progress: the app tells you what to cancel first, so that no other Member is left without a Driver or a Passenger.

Immediately: your name is replaced with a neutral placeholder; your phone number, contact number, email address, Google identifier, profile photo and push-notification tokens are removed; your Driver Verification documents and profile photo are erased from storage; all your sessions are signed out. Deletion is permanent.

What is kept: the history of your past Rides, Bookings, Trips and ratings, so that other Members' histories and reputations stay accurate; and, at present, vehicle details, messages exchanged, rating comments and usage events already recorded, which are no longer linked to your name, phone number or email address. You can ask VAYA Support to erase these items; we will do so unless keeping them remains necessary for another Member, a dispute or a legal obligation.

Push notifications are sent only if you allow them; you can turn them off at any time in your device settings, and they remain visible in the app's inbox. SMS are used only to send sign-in codes. Emails (Google accounts only) relate to your Rides, Bookings, Driver Verification and ratings; we do not send marketing emails.

The app asks for location access only "while using the app". You can refuse or withdraw it in your device settings and still search by typing places. During a Trip, the Driver needs location access so that Passengers can follow the Trip; without it, Passengers see that live tracking is unavailable. Sharing your location during pickup is based on your consent, asked in the app when it is useful: you can refuse or change your mind at any time, and the Trip then works without it (you can still say yourself that you are at the meeting point or on board).

The app securely stores your sign-in session and preferences (language, appearance) on your device; these are strictly necessary for the service. It contains no third-party advertising or analytics trackers; Google Maps components may collect technical data under Google's policy. Our website uses no cookies or analytics tools.

VAYA is only for people aged 18 and over. We do not knowingly collect data about children. If we learn that an account belongs to a person under 18, we close it and delete the data. A Passenger travelling with a child does not create an account for the child, and we do not collect the child's data.

We update this policy when our processing changes. Each new version is published in the app and on our website with a summary of what changes, and we notify every Member in the app. A change that reduces your rights or uses your data more widely takes effect at least 30 days after that notification (Terms, Article 20). The version and its effective date are shown at the top of this document.