Tayer Driver Privacy Policy

Controller and scope

Otlob Tech, the operator of Tayer ("Tayer", "we", "us"), determines how personal data is used for driver applications, accounts, trips, safety, support, compliance, and the Tayer Driver app, and is the data controller unless a provider acts independently under its own notice.

This policy applies from application through account closure and relevant post-trip/legal retention. Rider data you receive remains controlled by the applicable parties and may be used only for the assigned trip, safety, support, or a legal duty.

Application, identity, and document data

We collect your name, date of birth, residential address, national ID number, phone, email, preferred language, motorcycle make/model/year/plate, application status, declarations, and terms/privacy acceptance timestamps.

Mandatory uploads currently include national ID front and back, motorcycle driving license, motorcycle registration/license, and criminal-record certificate. We store the file, type, filename, upload time, review status, expiry date where applicable, and rejection reason. The current Driver product does not request or store medical records, medical-fitness results, or drug/alcohol-test results.

Where legally required and implemented, Tayer may later process evidence of training, medical fitness, drug/alcohol checks, insurance, social insurance, tax registration, operating cards, or vehicle inspection. Before collecting a new sensitive category, we will update this notice, identify the data and retention period, provide an appropriate secure collection method, and establish the required lawful basis and explicit consent where applicable.

Identity and criminal-record documents require heightened protection. We process them only where necessary for transport eligibility, safety, fraud prevention, legal compliance, or a documented claim and subject to explicit consent or another basis permitted by Egyptian law.

Account, trip, payment, and performance data

We process your verification and onboarding state, online/helmet status, rating and count, completed trips, acceptance and cancellation metrics, rank, block/rejection reasons, active session, random installation identifier, push token, and account timestamps.

Trip data includes request and acceptance, rider first name and assigned contact details, exact pickup/destination after assignment, route and status timeline, fare and cash settlement, distance/duration, ratings, cancellations, incident/support records, and order events. We may retain records showing which driver and motorcycle were displayed for each trip.

Location, including active-trip background operation

When you choose to be online and available, Tayer Driver periodically processes an approximate or reduced-precision availability location to offer nearby requests. The update frequency may vary with movement, device conditions, and service state. Idle availability updates pause when the app is backgrounded. Riders receive a reduced-precision nearby view rather than your exact idle coordinates.

From acceptance of an active trip through completion or cancellation, the app periodically processes precise location together with time and motion-related accuracy data. Active-trip updates may continue while the app is in the background using the operating system’s visible location mechanism. The assigned rider, you, and authorized Tayer personnel can access active-trip location only as needed for pickup, trip progress, safety, support, and legal compliance.

You control online availability and Android permissions, but precise active-trip location is necessary to perform and secure an accepted trip. If you revoke it, go offline or safely end/cancel the trip through the proper process rather than concealing the trip.

Diagnostics, analytics, and security data

Our analytics, crash-reporting, and monitoring providers, currently including Google/Firebase and Sentry, process limited product events, errors, performance information, logs, app/device/operating-system context, and service-generated identifiers. We configure these services to reduce unnecessary personal data, although technical reports may still contain relevant context.

Our security and app-integrity services process signals indicating possible tampering, rooting, hooking, emulation, session abuse, or similar threats. We use these signals to protect accounts and trips; a signal is not by itself conclusive proof and should be reviewed before serious adverse action where practicable.

Purposes and legal bases

We use data to evaluate eligibility; verify documents; activate and protect one device session; display the correct driver and motorcycle; offer, operate, track, settle, and support trips; communicate with you; calculate ratings and operational metrics; investigate incidents and complaints; prevent fraud and account sharing; maintain service quality; enforce terms; and meet transport, traffic, tax, social-insurance, consumer, privacy, insurance, court, and lawful authority requirements.

Depending on the activity, processing is necessary to take steps at your request or perform the driver agreement, comply with law, protect life or vital interests, pursue a documented legitimate interest that does not override your rights, establish or defend claims, or act on explicit consent—particularly where sensitive records or cross-border transfer require it. You may withdraw consent, but that will not invalidate earlier lawful processing and may make you legally ineligible to drive where the data is mandatory.

Recipients and disclosures

We limit disclosure by purpose and role. Riders receive your display name, rating, motorcycle details/plate and active-trip location needed to identify you and complete the assigned ride. Your phone or other contact data is disclosed only where needed after assignment. Do not put unnecessary identity details in public profile fields.

• Cloud, identity, database, document-storage, messaging, maps, analytics, crash-reporting, and integrity providers—currently including Google/Firebase, Google Maps Platform, and Sentry—process data needed to provide their configured services.
• Authorized Tayer reviewers, support, safety, security, legal, audit, and finance personnel and professional advisers receive only data needed for their role.
• Police, courts, transport and traffic bodies, the Personal Data Protection Center, Consumer Protection Authority, tax, social-insurance, and insurance bodies may receive records where lawfully required. Ride-hailing rules require certain driver/vehicle reporting and at least six months of trip/route records.
• A business successor may receive protected records in a merger, financing, restructuring, or asset transfer, subject to applicable law.

International processing

Firebase, Google, Sentry, and related support infrastructure may process data outside Egypt, including in the United States, European Economic Area, and other provider locations. Exact destinations depend on service configuration, routing, backup, and support access.

Where required, we will rely on the relevant Personal Data Protection Center license or permit, explicit consent, and contractual and technical safeguards providing an adequate level of protection. Because driver documents are high-risk records, their hosting location and transfer path require stricter documented approval and access controls.

Retention, account closure, and deletion

We retain application documents while reviewing eligibility and, if approved, while they remain necessary to prove legal qualification, perform re-checks, investigate safety, or meet transport, limitation, tax, insurance, and court requirements. Trip and route records must be kept for at least six months under Egyptian ride-hailing rules; incidents, financial records, consent evidence, and disputed matters may be kept longer where justified.

You can request account closure and deletion in the Driver app under Settings → Delete account, through the public Driver deletion resource at https://www.otlobtech.com/projects/tayer/driver/account-deletion, or by contacting support. An authenticated in-app request immediately disables service access and starts a tracked, asynchronous workflow that deletes or anonymizes eligible records and records completion.

After verification, we will delete or irreversibly anonymize eligible account data and preserve only records supported by a documented legal or safety reason. We will tell you what action was taken, the expected completion timing if processing is not immediate, and the categories retained where disclosure is permitted. Backups may remain for a limited, protected restoration cycle and are not returned to ordinary use.

Your rights and review of decisions

Subject to Egyptian law and lawful exceptions, you may request confirmation, access or a copy, correction or completion, erasure, restriction or cessation, objection, and withdrawal of consent. You may ask for human review of an application rejection, suspension, or other significant action influenced by ratings, document status, integrity signals, or operational metrics, and may complain to the Egyptian Personal Data Protection Center.

Submit the request from your registered email or phone. We may require proportionate identity verification and may protect rider information, investigations, security methods, legal privilege, or another person’s rights. We will explain a refusal where permitted.

Security and breach response

Driver documents, profiles, orders, private contact data, and active-trip location are protected with role-based access controls and restricted storage. We also use encrypted transport, secure on-device token storage, controlled sessions, app-integrity monitoring, logging, and need-to-know review access.

No system is completely secure. Protect your phone and credentials, do not share downloaded rider or driver documents, and report suspected compromise immediately. If a breach requires notice, we will notify the Personal Data Protection Center and affected people within applicable legal periods and take containment and remediation steps.

Children and changes

Driver applicants must be legally old enough and licensed to provide the service. We do not knowingly accept children as drivers. If ineligible child data is submitted, we will restrict it and take lawful deletion or protection steps.

We may update this notice as onboarding documents, payments, support, providers, data locations, or law change. We will publish a new effective date and provide prominent notice or seek new consent where required. We will update the policy before enabling a materially new collection such as medical or fitness information, drug/alcohol-test results, biometric data, payment-card data, or additional support uploads.