Privacy Policy
What data we collect, why, who we share it with, and your rights — in plain language.
This policy explains, in plain language, what personal data the Taxi Masr apps (the rider app and the captain app) and the website taximasr.app collect, why, on what legal basis, who can see it, where it is processed, how long we keep it, and your rights and how to use them. It follows Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations, issued by Decree No. 816 of 2025 of the Minister of Communications and Information Technology.
- Who we are and how to reach us
- Data we collect
- Why we use data, and the legal basis
- Location data
- Sensitive data
- What other people see
- Who processes data for us, and transfers outside Egypt
- How long we keep data
- Deleting your account
- Data security and breach notification
- Your rights
- Children
- Promotional messages
- Changes and contact
1. Who we are and how to reach us
- Data controller: Taxi Masr, Arab Republic of Egypt, referred to in this policy as "Taxi Masr" or "we".
- Contact about your data: write to support@taximasr.app with "Privacy" in the subject line.
2. Data we collect
Your account and signing in
- Account: your phone number (it identifies your account), your name, and optionally an email address and a profile photo, plus your notification and language settings. We send receipts by email only when that service is available.
- Signing in: the apps verify your phone number with Google Firebase Authentication. Your number is sent to Google, which texts you a code; our server then receives Google's confirmation that the number is yours. We never see or store the code.
- Captains also give us: national ID number, driving licence number and expiry date, optionally gender (for the "female captain" option), photos of the national ID, driving licence, taxi licence and plate, and optionally photos of the car and its plate.
Trips and payments
- Trips: pickup, stops and destination (address and map position), ride preferences, the time of each stage, distance, duration, the fare and its breakdown, tips, and the payment method and status. When you book for someone else, that person's name and phone number.
- Card and electronic payments: you pay on the checkout page of our payment provider, Paymob. We never receive your full card number. We send Paymob your name and phone number for billing, and we keep Paymob's payment confirmation, which can include a masked card number and the card type.
- Wallet: top-ups, balance and wallet transactions, and for captains, commission, settlements and payouts. For fleet owners: the bank account used to settle their earnings.
Communication and safety
- Chat messages between rider and captain, ratings and rating comments, and complaints (complaints are text only; there are no attachments).
- Trusted contacts: names and phone numbers you type in yourself. The apps do not read your address book.
- SOS: when you press SOS we record the time and your location (see sections 4 and 6).
- Phone numbers of people you invite to split a fare, saved places, home and work addresses, favourite captains and referral codes.
Device and security data
- A push-notification token from Google Firebase Cloud Messaging. The captain app also sends its version number.
- For security and fraud prevention, our server records certain actions (such as signing in, deleting an account, filing a complaint and staff opening a captain document) together with the IP address used.
- The Google Maps SDK built into the apps itself collects diagnostic data to run and improve Google's services: device information and SDK version, crash reports from the SDK, IP address, an SDK-specific identifier, and map panning and zooming events. This data goes directly to Google; we do not hold it.
- The apps contain no advertising, analytics or crash-reporting tools of our own, and do not use advertising IDs.
3. Why we use data, and the legal basis
We process your data only for specific, declared purposes, on one of the bases set out in Article 6 of the Law:
| Purpose | Data | Legal basis |
|---|---|---|
| Creating your account and signing in | Phone number and name | Performing our contract (the Terms) and your consent at sign-up |
| Requesting a ride, sending it to nearby captains, following it and computing the fare | Locations, addresses and trip details | Performing the contract |
| Showing your name and number to the assigned captain | Full name and phone number | Performing the contract |
| Payments, wallet, commission, settlements and receipts | Payment and wallet data | Performing the contract, and our accounting and tax obligations |
| Verifying captains | National ID and licence numbers, document images | Your explicit consent when you upload the documents, and our legitimate right to make sure whoever carries riders is qualified |
| SOS, trip sharing and alerting your contacts | Location, contact names and numbers | Your consent: you switch the feature on |
| Investigating complaints and disputes, preventing fraud, security logs | Trip, chat and payment records, IP address | Our legitimate rights, where they do not override your fundamental rights, and bringing or defending legal claims |
| Notifications about trips, chat, safety and your account | Push-notification token | Performing the contract |
| Answering the authorities | Only what the request specifies | A legal obligation, an order of a competent investigating authority, or a court ruling |
We do not sell your data or use it for advertising, and we do not use it to set individual prices: the fare depends only on the published tariff, distance and time. The only automated decision is that a captain whose average rating falls too low is warned or suspended, and can ask for a human review. You can withdraw your consent at any time; that does not affect anything done before. Some data is needed to provide the service, so withdrawing consent to it means deleting the account. We will not use your data for a new purpose incompatible with these without your prior consent.
4. Location data
- Riders: the app uses your location while it is open to set the pickup point and show nearby taxis. It never tracks you in the background. From the moment a captain accepts your ride until they arrive at the pickup, your current location is shared with that captain so they can find you. When you press SOS, your location is sent to us and to the trusted contacts who are alerted. SOS does not replace calling the police (122) or an ambulance (123).
- Captains: while you are online or on a ride, the captain app sends your precise location every few seconds, including when the app is in the background, or closed and not in use (Android shows an ongoing "you are online" notification; iOS shows the blue location indicator). That is how nearby requests reach you and how your rider sees you approaching. The app explains this and asks your permission before first use, and sending stops when you go offline or sign out.
- What we store: only the latest position, overwritten with each update — the captain's latest position, the captain's latest position on each trip, and the rider's latest position until pickup (erased as soon as the captain arrives or the ride ends or is cancelled) — plus each trip's pickup, stops and destination. We do not keep a history of anyone's movements.
5. Sensitive data
The Law (Article 1) treats some categories of data as sensitive, including financial data and children's data. They may be processed only under a licence from the Personal Data Protection Center and with explicit written consent, on paper or electronic (Article 12).
- Financial data: payment, wallet, commission and settlement records, the masked card number from Paymob, and fleet owners' bank accounts. We use them only for payments and accounting, and only authorised staff can see them.
- Captain document images: an image of the national ID card can show sensitive data such as religion. We do not extract or use it, and we keep the images in private storage (section 10).
- We do not collect health or biometric data (no fingerprints, no face recognition) or political opinions. A captain's gender (for the "female captain" option) is optional.
- Children's data: see section 12.
6. What other people see
- Captains who are offered your ride: the pickup and destination, the fare and your ride preferences. Not your name, phone number or rating.
- The captain you choose: your full name and phone number (so you can call each other), the pickup, stops, destination and your preferences, and your live location until pickup. Your name and number are sent to the captain only from acceptance until the ride ends. If you booked for someone else, the captain also sees that person's name and number.
- Riders (what captains share): your rider sees your full name, photo, phone number, rating and number of trips, the year you joined, the make, model, colour and plate of your car, the car and plate photos once approved, up to three recent rider comments (without who wrote them), and your live location. Riders who receive your offer see your profile, but never your phone number, ID or licence documents.
- Anyone you send a trip-share link: the captain's first name, the car's make, model, colour and plate, the pickup and destination on a map, and the car's live position while the ride is in progress. Not your name, any phone number or the fare. A link stops working 2 hours after it is created (for a scheduled ride, 2 hours after its start time), or 15 minutes after the ride ends if that is sooner. SOS links last up to 6 hours. You can cancel a link at any time.
- Your trusted contacts: contacts with SOS alerts switched on (up to 5) receive a message with your name and a live tracking link, or a map link with your location, when you press SOS. Contacts with night-ride sharing switched on receive a message with your name and a tracking link when you share a trip with them, and automatically for rides between 10 pm and 6 am; they also receive a message with your name and destination address when you are about to arrive. A contact who uses Taxi Masr gets these as an app notification; anyone else gets an SMS.
- People you invite to split a fare: a message with your name and their share, by app notification or SMS.
- Our staff: authorised staff (administrators, support, and fleet supervisors for their own fleet) can see account and trip data to run the service and handle complaints. Captain documents are visible only to the captain and these staff, and every time staff open one it is logged.
- Authorities: upon a valid legal request or to protect user safety, within the limits of Egyptian law.
- Affiliates or successors in a merger or acquisition, bound by this policy.
7. Who processes data for us, and transfers outside Egypt
- Google (United States and other countries): Firebase Authentication (phone sign-in), Firebase Cloud Messaging (notifications) and Google Maps Platform (maps in the apps; address search, directions and route estimates through our server). Choosing a point on the map also uses your phone's built-in address lookup (Google on Android, Apple on iOS).
- Paymob (an Egyptian payments company): card and electronic payments and wallet top-ups.
- Twilio (United States): SMS messages to people who do not use the app (trusted contacts and fare-split invitations).
- Amazon Web Services (data centres outside Egypt): hosting for our servers, database and captain documents.
- Sentry (outside Egypt): only if we turn on server error reporting; it is set up to remove personal data from error reports.
Transfers outside Egypt: because our servers and some of these providers are outside Egypt, your data is transferred and stored outside Egypt. We do this only as Articles 14 and 15 of the Law and Article 16 of the Executive Regulations allow: under a licence or permit from the Personal Data Protection Center that names the permitted countries, with your consent, and to providers bound by contract to process data only on our instructions and with protection no lower than this policy, with the data encrypted in transit.
We do not sell personal data and do not share it for advertising.
8. How long we keep data
We keep data no longer than its purpose requires (Article 3 of the Law). These are the periods we apply:
| Record | How long | Reason and legal basis |
|---|---|---|
| Account data (name, phone, email, photo, settings, saved places, trusted contacts) | While the account exists; deleted or anonymised straight away when you delete it | Providing the service |
| Live location | Latest point only, overwritten with each update; the rider's is erased at pickup or when the ride ends or is cancelled | No movement history is needed |
| Trip records (pickup, stops, destination, times, distance, fare) | 5 years from the end of the financial year of the trip | Documents supporting the accounts: Article 26 of Commercial Law No. 17 of 1999 and Article 38 of Unified Tax Procedures Law No. 206 of 2020 |
| Name and number of a person a ride was booked for | 180 days from the ride | Safety and investigating reports, and the retention period in Article 10 of Law No. 87 of 2018 regulating land passenger transport services using information technology |
| Payments and Paymob confirmations (masked card number), wallet, commission, settlements, payouts and fare splits | 5 years from the end of the financial year | Accounting and tax: the two articles above |
| Chat messages | 180 days from the end of the ride | Settling complaints and reports, and Article 10 of Law No. 87 of 2018 |
| Ratings and comments | While the rated captain's account exists, and no longer linked to you after you delete your account | Service quality and rider safety |
| Complaints | 3 years from closing the complaint | The limitation period for damages claims (Article 172 of the Civil Code) |
| SOS records | Location and the contacts alerted: 365 days from closing, or straight away when you delete your account. The record that the incident happened and how it was resolved: 3 years from closing | Investigating incidents and claims (Article 172 of the Civil Code) |
| Captain verification documents | While the account exists, then 3 years from its deletion or closure | Proving the captain was verified in any claim or investigation (Article 172 of the Civil Code) |
| Security logs (actions and IP address) | 1 year; the log of staff opening captain documents for as long as the documents are kept | Fraud prevention and demonstrating data protection (Article 4 of the Law) |
| In-app notifications | Read: 30 days; unread: 90 days | No longer needed |
| Sign-in sessions | 1 year at most | Account security |
| Your requests to exercise your rights, and your consent records | 3 years from the last action | Demonstrating compliance to the Center (Articles 2 and 3 of the Executive Regulations) |
When a period ends, the records are deleted or anonymised so they no longer identify you (Article 4 of the Law). If an investigating or competent authority asks us to keep a record, or it is tied to an ongoing dispute or investigation, we keep it until that ends.
9. Deleting your account
In either app, go to Settings → Delete account and confirm. Deletion is immediate. You can also ask us to delete your account without the app. Deletion is not possible while you have an active or unpaid trip, a wallet balance you can withdraw or that you owe, or a pending captain payout. What is deleted, what is kept and why, and how to ask by email are all on the Delete your account page.
10. Data security and breach notification
All traffic between the apps, the website and our servers is encrypted in transit (HTTPS, and secure WebSockets for live updates). Captain documents are kept in private storage that cannot be reached from the internet: only the captain and authorised staff can open them, and every staff view is logged. Staff access depends on their role, sensitive administrative actions are recorded in an audit log, and the number of requests is limited to prevent abuse. No system can guarantee absolute security.
If a personal data breach happens, we notify the Personal Data Protection Center within 72 hours of becoming aware of it (immediately if it concerns national security), and we notify you within 3 working days of notifying the Center, telling you what happened and what we have done (Article 7 of the Law and Article 5 of the Executive Regulations).
11. Your rights
Under Article 2 of the Law, you have the right to:
- Know what data we hold about you, access it and obtain a copy.
- Withdraw your consent to our keeping or processing your data.
- Have your data corrected, changed, deleted, added to or updated (name, email and photo directly in the app; to change your phone number, write to us).
- Restrict processing to a specific scope.
- Be told of any breach of your data.
- Object to the processing of your data, or its results, where it conflicts with your fundamental rights and freedoms.
You can also delete your account (section 9), and withdraw permissions such as location in your device settings, noting that some features will not work without them.
How to use your rights: write to support@taximasr.app from your registered email or including your registered phone number. We verify your identity and reply within 6 working days of receiving the request (Article 32 of the Law), free of charge; if we refuse a request, we tell you why.
Complaints: if you are not satisfied with our answer, or believe your rights have been breached, you can complain to the Personal Data Protection Center (www.pdpc.gov.eg), which decides within 30 working days (Article 33 of the Law). This does not affect your right to go to court.
12. Children
The service is for people aged 18 and over (21 for captains); younger people may not create an account. The Law treats children's data as sensitive, so we do not knowingly collect it, and if we learn that an account belongs to a child we delete it. An adult may book a ride for a child using "Ride for someone else" and remains responsible for the trip; in that case enter your own number or a guardian's, not the child's.
13. Promotional messages
We do not currently send promotional messages. If we do in future, it will only be with your prior explicit consent, and every message will identify us and give an easy way to stop them (Articles 17 and 18 of the Law). You can turn off promotional notifications at any time in Settings → Notifications.
14. Changes and contact
We may update this policy from time to time. We will publish the new version here with its update date, notify you in the app of material changes, and ask for your consent again where a change requires it. Questions: support@taximasr.app.