Privacy Policy

We collect information that users provide directly, information generated by marketplace activity, and limited technical information needed to operate, secure, and improve Your Rahi.

This may include account details, profile details, provider and route information, vehicle information, verification material, inquiries, route requests, reviews, reports, subscription payment proof, device information, and consent-based analytics data where enabled.

Account information may include name, email address, phone number, account role, authentication identifiers, profile photo, and profile settings.

Passenger profile photos are optional. Provider profile photos are required for provider onboarding where the current product requires them.

Provider verification may involve business profile information, CNIC or identity documentation, driving licence information, vehicle registration, vehicle documents, vehicle details, route details, verification status, and admin moderation records.

Provider verification documents are treated as private verification material. They are not intended to be displayed publicly through public route cards or search results. Public users may see only appropriate provider profile, route, vehicle summary, trust, rating, or verification-status information supported by the product.

Provider selfie-presence checks may collect a still selfie image, challenge result, status, method, review note, and related moderation information. This check supports marketplace trust and presence review; it does not replace CNIC, vehicle, or legal identity verification.

Profile photos and provider selfie evidence are stored in private storage areas. Public provider profile photos, where shown, are served through controlled signed access rather than exposing raw private storage paths.

Your Rahi does not store raw challenge video, face embeddings, or biometric templates for the provider selfie-presence check.

Rahi Pass may process pickup areas, destination areas, route stops, route titles, commute timing, working days, seat availability, route map coordinates, route preview data, search radius, and current device location if a user grants browser or device permission for that feature.

A saved commute route is different from live device location. Using Rahi Pass does not by itself mean that Your Rahi continuously tracks a user's live location in the background.

Location permission is requested only where required by the applicable map, current-location, or route-search feature. Users can manage device or browser location permissions through their browser or operating system settings.

Rahi Pass may process route requests, provider inquiries, contact preferences, pickup notes, messages, status changes, notifications, duplicate-prevention signals, and inquiry audit information to operate the marketplace and reduce misuse.

A provider inquiry or route request helps users communicate about a monthly commute. It does not by itself process passenger fare payment or mean Your Rahi is providing the transport service.

Where supported by the product, ratings, reviews, route requests, reports, trust indicators, verification indicators, and moderation decisions may be processed to operate marketplace trust, prevent abuse, support admin review, and help users make informed choices.

Reviews may be submitted by authenticated users and may be held for administrator review before publication.

Your Rahi may process provider subscription plan selections, transaction references, payment screenshot uploads, review status, rejection reasons, subscription status, payment notifications, and administrator review records.

Provider subscription payments are separate from passenger transport fares. Your Rahi does not currently collect, hold, escrow, settle, or take commission from passenger transport fares through Rahi Pass.

We may process technical information such as browser user-agent, IP-derived network information, request origin, timestamps, security logs, rate-limit signals, audit logs, authentication state, and error information to protect accounts, prevent misuse, operate admin controls, and troubleshoot the platform.

Some admin and security logs are restricted to authorised administrative roles.

The website uses essential browser storage and cookies for security, authentication sessions, language preference, visitor counting, and basic operation.

Optional analytics is loaded only after a visitor chooses Allow analytics in the consent notice. Analytics may record page-view information such as page path, session and visitor identifiers, referrer host, device type, and approximate location data where supported by the analytics implementation.

Users can clear the website's stored data in their browser to reset local choices.

We use information to create and secure accounts, operate Rahi Pass, display provider and route listings, support passenger and provider communication, manage provider onboarding, review verification material, process provider subscription proof, send notifications, respond to support requests, improve the website, prevent fraud or misuse, and meet legal obligations.

We aim to collect and expose only the information reasonably needed for account operation, marketplace matching, provider verification, safety, fraud prevention, support, subscriptions, and legal obligations.

Marketplace users may see public or marketplace-facing information such as display name, provider profile image, provider or vehicle summary, route title, pickup and destination area, route stops, timing, available seats, rating, trust score, verification indicator, and other intentionally published listing information.

Private information includes authentication credentials, private verification documents, driving licence documents, vehicle document images, raw selfie evidence, administrative notes, security logs, audit logs, private storage paths, and information not intentionally exposed through the marketplace.

Phone and email visibility follows the current contact-sharing behaviour in the product and should not be assumed public unless displayed by the relevant feature.

We may share information as reasonably required with the passenger or provider counterpart for a marketplace interaction, hosting and database providers, authentication providers, maps and location providers, consented analytics providers, communications or notification providers, payment processors for provider subscriptions, security or fraud prevention providers, and legal authorities where lawfully required.

Your Rahi does not sell personal information to advertisers or data brokers.

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, alteration, disclosure, or loss. Current controls include Supabase authentication, role-based access, Row Level Security policies, private storage buckets, signed URLs for sensitive file access, server-side service credentials, admin authorisation checks, and audit or moderation records where implemented.

No internet service can be guaranteed to be 100% secure. Users should keep account credentials private and report suspicious activity.

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including account operation, safety, fraud prevention, dispute handling, security, legal compliance, and legitimate business requirements.

Some information may remain after account deletion where retention is reasonably necessary for security, legal, billing, audit, dispute, or abuse-prevention purposes.

Users may update supported profile information, change certain account details, manage browser or device permissions, manage cookie and analytics choices, request correction, request account or data deletion where applicable, or contact Your Rahi about personal information.

Some requests may be limited where information must be retained for security, legal, dispute, billing, or abuse-prevention purposes.

Current-location features depend on browser or device permission. If permission is denied or unavailable, users may use supported manual or map-based alternatives where the product provides them.

Users can revoke location permission through browser or device settings.

Your Rahi may rely on third-party providers for hosting, database, authentication, storage, maps, email or communication delivery, analytics where consented, payment proof workflows, security, and operational tooling.

These providers process information only as reasonably required for the service they support.

Your Rahi may preserve or disclose information where reasonably necessary to comply with applicable law, respond to lawful legal process, protect the platform or users, investigate fraud or abuse, enforce Terms, or address a serious safety or security issue.

If a user believes they are in immediate danger, they should prioritise personal safety and contact the appropriate local emergency or law-enforcement service.

This Privacy Policy may be updated as Your Rahi develops. The latest version will remain available on this page.

Questions about this Policy or personal information may be sent to info@yourrahi.com.