Privacy Policy سياسة الخصوصية

1. Who We Are

CAB Jordan ("CAB", "we", "us", "our") operates the CAB mobile application (the "App") — a ride-hailing platform connecting riders and drivers in the Hashemite Kingdom of Jordan.

This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our App. It applies to both Riders and Drivers. By using the App, you confirm that you have read and understood this Policy.

2. Data We Collect

2.1 Information you provide directly

• Account information: your full name, phone number, and optional email address
• Profile photo: an optional photo you upload or take using your device's camera or gallery
• Driver-specific documents (if you register as a Driver): national ID (10 digits), driving licence number and photo, vehicle registration, plate number, plate type (Private or Taxi), vehicle make/model/year/colour, and a selfie photo shown to riders when you are assigned
• Emergency contact: a name and phone number you optionally save locally on your device for SOS use — stored on your device, not our servers
• Support messages: any text you send to our support team through the Help Center
• Ride reports: issue descriptions you submit via the Report Issue feature
• Promo codes you enter in the App

2.2 Information collected automatically

• Location data: GPS coordinates while you use the App. For Riders, location is collected when the App is open and you are booking or tracking a ride. For Drivers, location is collected continuously while you are online — including when the App is backgrounded or screen is locked — so the platform can receive ride requests and navigate to passengers.
• Device information: device model, operating system version, app version, language setting, and IP address
• Usage data: rides requested, completed, or cancelled; in-app actions; SOS events; ratings submitted
• Push notification tokens: collected via Firebase Cloud Messaging to deliver ride-status notifications
• Trip data: origin, destination, route, distance, duration, and fare for each ride

2.3 Payment data

The App currently operates on a cash-only payment model. Riders pay drivers directly in cash upon arrival. Fare amounts and trip records are stored for ledger and tax compliance purposes. CAB does not collect or store credit card numbers or bank account details. If card or digital wallet payments are added in the future, they will be processed through a PCI-DSS-compliant third-party payment processor — not stored by CAB directly.

2.4 Information from other users

When a ride is matched, Drivers receive the Rider's name and pickup location. Riders receive the Driver's name, photo, vehicle details, plate number, and live location. Both parties share trip details (route, duration, fare).

3. Why We Collect Your Location

4. How We Use Your Data

• Provide the ride-matching service (location, profile, fare calculation)
• Verify Driver eligibility (document review, background check if applicable)
• Process fares, maintain ledger records, and produce receipts
• Deliver push notifications about ride status (booking confirmation, driver assignment, arrival, completion)
• Enable the in-app Safety features (SOS, trip sharing, emergency contact alert)
• Handle support requests and issue reports
• Detect and prevent fraud and abuse
• Comply with legal obligations including Jordanian tax law and LTRC requirements
• Improve and develop the App, using aggregated, non-identifying usage data

5. Legal Basis for Processing (Jordan PDP Law 2023)

6. How We Share Your Data

6.1 With matched Riders and Drivers

When a ride is matched, basic trip-relevant information is shared between the Rider and Driver (name, vehicle, location, route). This sharing is limited to what is needed to complete the ride.

6.2 With service providers

• Cloud infrastructure: Supabase and Google Cloud — database hosting and storage
• Mapping: Google Maps — directions, ETA calculation, and live tracking
• Push notifications: Firebase Cloud Messaging (Google) — ride-status alerts
• SMS/OTP: a third-party SMS provider used to deliver phone verification codes during signup
• Payment processors (when card payments are added in future): will be PCI-DSS compliant, not handled by CAB directly

6.3 With legal authorities

We share data with law enforcement, tax authorities, or regulatory bodies when required by law, court order, or subpoena, or when necessary to investigate fraud or safety incidents.

6.4 In a business transfer

If CAB is acquired or merges with another company, your data may be transferred. You will be notified before any such transfer takes effect.

7. Data Retention

8. Your Rights Under the PDP Law of 2023

8.1 Right to Access

You may request a complete export of your personal data at any time by contacting us at support@cab.app. We will respond within the timeframe required by law.

8.2 Right to Deletion (Account Deletion)

You may request deletion of your account. A 30-day cooling-off period applies, during which you may cancel the deletion request. After the cooling-off period, your personally identifiable information is permanently anonymised. Financial records are retained as required by law.

To request deletion: email support@cab.app with your registered phone number and the subject line "Account Deletion Request". See also our Account Deletion page.

8.3 Right to Rectification

You may correct inaccurate personal data at any time via your Profile settings in the App.

8.4 Right to Object / Restrict Processing

Contact our Data Protection Officer at support@cab.app to object to specific processing activities.

8.5 Right to Data Portability

You may request a copy of your data in a portable format by contacting support.

8.6 Right to Lodge a Complaint

If you believe your rights have been violated, you may contact the relevant Jordanian data protection authority or a competent court.

9. Children's Privacy

The App is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us immediately at support@cab.app so we can delete the account.

10. Security

We implement the following safeguards to protect your data:

• Encryption in transit (HTTPS/TLS) and at rest
• Row-level security enforced on the database
• Access logs and audit trails
• Principle of least privilege — employee access is limited to what is required for their role
• Regular security reviews

In the event of a personal data breach affecting your data, we will notify you and the relevant authority within 72 hours of becoming aware, as required by the PDP Law.

11. International Data Transfers

Your data is stored and processed using Supabase and Google Cloud infrastructure. These providers may store data outside Jordan. We ensure that any cross-border transfers are protected by appropriate safeguards as required by the PDP Law of 2023.

12. Device Permissions Summary

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated in the App and will require fresh acceptance before you can continue using the service. The current version and effective date are always shown at the top of this page.

14. Contact Us