Privacy Policy — papaCity Rider
Effective date: 25 August 2025
This Privacy Policy explains how Potponds (U) Limited (“we”, “us”, “our”) collects, uses, discloses, and protects information when you use the papaCity Rider mobile application (the “App”) and related services. By using the App, you agree to this Policy.
1) Who we are & contact
Controller: Potponds (U) Limited, Kampala, Uganda.
Contact: info@papacityug.com
App: papaCity Rider (Android)
2) What we collect
We collect information in three ways: you provide it, the App collects it automatically, and third parties provide it.
a) You provide
• Account info: name, email, phone number, password/OTP.
• Profile & verification (optional): photo, ID info (if KYC is required), vehicle/helmet info (if applicable).
• Support content: messages, attachments, feedback.
b) Automatically collected
• Location data: precise GPS location when you enable location and use features that require it (e.g., pickup/drop-off, live routing). The App does not collect location in the background; collection occurs only while the App is in use.
• Device data & identifiers: device model, OS version, IP address, language, app version, Firebase Instance ID/Push token (if push is enabled).
• Usage & diagnostics: app interactions, performance metrics, crash logs, error traces.
c) From third parties
• Authentication providers (if used): e.g., Google Sign-In (email, display name).
• Analytics & crash services: event metrics and crash reports.
• Maps & places services: map tiles and geocoding results.
We do not collect sensitive categories unless you provide them for a specific purpose (e.g., KYC). We do not knowingly collect data from children (see Section 11).
3) Why we use your data
• Core functionality: create/manage your account; enable trip requests; navigation and ETA; in-ride safety features.
• Location services: show you nearby points, match you to trips, and improve routing when you actively use location-based features (no background location).
• Communications: send confirmations, ride updates, and service messages; respond to support.
• Safety, security & fraud prevention: verify accounts, detect suspicious behavior, enforce Terms.
• Improvement & analytics: understand performance, fix crashes, improve reliability and user experience.
• Legal compliance: comply with applicable laws, tax and accounting obligations, and enforce our agreements.
4) Legal bases (EEA/UK users)
Where GDPR/UK GDPR applies, we rely on performance of a contract, legitimate interests (e.g., to keep the service secure and reliable), consent (for push notifications where required), and legal obligation.
5) Sharing your data
We do not sell your personal data. We may share as follows:
• Service providers/Processors: cloud hosting, analytics, crash reporting, messaging, customer support.
• Maps & location partners: to provide geolocation and routing.
• Legal & safety: authorities or third parties if required by law or to protect rights, safety, and property.
• Business transfers: as part of a merger, acquisition, or asset sale, with appropriate safeguards.
6) Third-party services we use
Depending on your configuration, the App may integrate:
• Firebase (Google) — Analytics, Crashlytics, Cloud Messaging (push notifications).
• Google Maps Platform — Maps, geocoding, places, routing.
• Authentication providers — e.g., Google Sign-In.
Payments are not enabled in the App.
7) Data retention
• Account & profile: kept while your account is active.
• Trip & location records: typically kept for 24 months for safety, dispute resolution, and analytics, unless a longer period is required by law.
• Crash/diagnostic logs: typically kept for 12 months.
When no longer needed, we delete or irreversibly anonymize data.
8) Your choices & rights
• Permissions: you can disable location, camera, or notifications in your device settings. The App may not work correctly without precise location when using ride features.
• Access & correction: request a copy or correction of your data.
• Deletion: request account deletion and data removal (subject to lawful retention).
• Objections & consent withdrawal (GDPR regions): you can object to certain processing or withdraw consent where applicable.
Request any of the above via info@papacityug.com or in-app settings (if available).
9) Security
We use reasonable administrative, technical, and organizational measures to protect data (encryption in transit, access controls, least-privilege). No method is 100% secure; please keep your login credentials confidential and update your app regularly.
10) International transfers
We may store or process data on servers outside your country (e.g., EU/US). Where required, we use lawful transfer mechanisms (such as Standard Contractual Clauses) and implement appropriate safeguards.
11) Children’s privacy
The App is not intended for children under 13 (or under the age required by your country). We do not knowingly collect data from children. If you believe a child has provided data, contact us to delete it.
12) Changes to this Policy
We may update this Policy from time to time. We will post the new version in the App and update the “Effective date”. Material changes may be notified via the App or email.
13) How to contact us
Questions or requests about this Policy?
Potponds (U) Limited
Email: info@papacityug.com
Address: Kampala, Uganda
Appendix — Quick “Data safety” summary for Google Play
Data collected:
• Location: precise, collected only while the App is in use (no background collection).
• Personal info: name, email, phone, profile photo (optional), ID/KYC if required.
• App activity & diagnostics: app interactions, crash logs, performance, device IDs (e.g., Firebase).
• Device or other IDs: push token, Firebase Instance ID.
Purposes: App functionality, account management, ride matching & navigation, safety/security, communications, analytics, and compliance.
Data sharing: With service providers (hosting, analytics, crash, messaging, maps). No sale of data.
Data handling: Data is encrypted in transit; you can request deletion; retention per Section 7.
Background location: Not enabled. Payments: Not enabled.