Privacy policy

1. What we collect

Your phone number, chosen language, the trusted contacts you add, and, only with your consent, your location while using rank finding. Section 3 explains live location in full. If you turn on the daily interview tip, we keep the time you picked until you turn it off.

Signing in. You sign in with a one-time code sent to your number by SMS or WhatsApp, as you choose. For each code you ask for, we keep your number and a scrambled id for your phone for 24 hours, to stop anyone flooding a number with codes; the code itself is not kept once it is sent. Your account is created only after you agree to this notice. Before real messages are switched on, we will name here the SMS and WhatsApp providers that carry them and where they are.

Driver codes. If you drive for an association, your QR code is shown to passengers so they can check you. Anyone who scans or types it sees your first name (never your surname or number), your association, the taxi you are driving today, whether the association verified you, and whether your PrDP is valid and until when. A check from the website is not recorded; a check from the app is kept for 30 days so an SOS can name the taxi.

2. How we use it

To sign you in, show accurate rank status, verify drivers, and keep you safe. If you ask to work for an association as a driver, marshal or taxi owner, that association's admins see your name, your number and your note so they can check who you are. Route intelligence is always anonymised and aggregated; it never follows an individual.

3. Live location: when, and who sees it

• The taxi, during a trip. When a driver starts a trip, the taxi's position is shared live with the passengers on board, the people those passengers choose to send a link to, the vehicle owner and the association. Only while the trip is active, and only after the driver agreed. It stops when the trip ends; off duty, nothing is recorded.
• Your phone, during an SOS. While an SOS is active, your phone shares its position every 10 seconds with your association's safety ops room and with the trusted contacts you chose. It stops when the SOS is closed.
• Your phone, if you turn it on. On a taxi that is not on eRanki you can share your own location with people you choose. It stops when you arrive, when you turn it off, or after 4 hours, and only your latest position is kept.
• On your phone only. To find the nearest ranks without data, the app keeps the last position your phone measured on the phone itself, and shows how old it is. It is never sent to eRanki and is deleted when you sign out. The fare helper keeps nothing at all.
• Share links show a first name and a position only while sharing is active, never a phone number. 30 minutes after a trip or SOS ends, a link shows nothing.
• How long we keep it. Taxi positions: 30 days. Positions linked to a safety incident: until the incident is anonymised, 90 days after it is closed. Driver checks: 30 days. Trips you joined: 90 days.

4. Lost and found

• When you report something lost we keep your description, roughly when and where you lost it, and the taxi, if you choose a trip you joined or a driver you checked. The association's marshals and admins see the report, but not who made it.
• Your private detail (something only the owner would know) is seen by you, and by the marshal only at handover, after you have said an item is yours. It is never shown to anyone else.
• Photos of found items are private. Staff see them; you see one only when the item may be yours, and never for an ID document or a wallet. A photo is deleted when the item leaves the rank.
• Phone numbers are never shown to drivers, marshals or other passengers through lost and found.
• How long we keep it. An open report closes 90 days after the loss. 90 days after a report or item closes, the private detail is deleted and the descriptions are removed. A record that an item was handed over, or handed to SAPS, is kept for the association's records.

5. Driver chat

• Who uses it. Drivers, marshals and admins of one taxi association. Passengers have no chat. Nobody outside the association can read it.
• The driving notice. Before chat opens, a driver or marshal accepts a notice not to text while driving. We keep a record of that acceptance and the notice version, shown in Download my data.
• Messages and voice notes are deleted 30 days after they are sent. Direct messages are read only by the two drivers, unless one of them reports a message: then the association's admins see that message to decide whether to hide it.
• Read aloud uses your phone's own speech engine; eRanki sends nothing extra anywhere for it.

6. Bookings

• What we keep. The trip you ask for (type, pickup, destination, dates, number of people and taxis, your notes) and your name and phone number, plus an email address if you give one.
• Who sees your contact details. Operators of the association nearest your pickup see the trip without your name or number. Only the operator whose quote you accept sees them, and you then see theirs. The association's admins see bookings in their association.
• Without an account (the website form), your booking is reached through a private link. Anyone with that link can see and manage the booking, so keep it to yourself. We text you about it on the number you gave.
• Live tracking. On the day, the taxi's position is shown on your live link only while the driver's booking trip runs. The link names no one.
• Payment is between you and the operator. eRanki does not handle payments and never asks for card or bank details.
• How long. Your name, number, email, notes and rating comment are removed 12 months after the booking ends. Texts we sent are deleted after 30 days.

7. Supplier marketplace

• Reviews. A buyer who received a delivered order can rate the supplier. Other buyers see the rating and comment with the buyer's association, never the buyer's name. The supplier reads the reviews it received.
• Disputes and photos. Delivery photos and dispute evidence are private: only the two sides of the order and the association's admins can open them, through links that last 5 minutes. They are deleted 12 months after the order is closed. Who raised, answered and resolved a dispute is kept in the audit record.
• Invitation emails go to the email address the supplier signs in with. We keep a record that an email was sent for 30 days.
• Payment is agreed between buyer and supplier. eRanki does not handle payments.

8. Adverts in Vibe (Straatmedia)

• Where they appear. Adverts from our media partner Straat Africa can appear in the Vibe hub only: a short audio advert when you start the radio, a video at the top of What to Watch and a sponsored card. Every one is labelled as an advert with the advertiser's name. eRanki reviews every campaign before it can play. Adverts never appear on safety screens or while an SOS is being raised or is open.
• No profiling. Which advert you see depends only on the place (the nearest rank and its city, from your phone's location if you allow it), the route of a trip you are on, your app language and the time. We do not use who you are, what you do in the app or anything else about you.
• Counting plays. When an advert plays we record when, where (if known) and how much of it played, under a pseudonymous key instead of your account, so we can show how often an advert ran and to how many different people. Media partners see totals only, and places with fewer than five people are grouped together. These records are deleted after 13 months; if you delete your account, the link to you is removed straight away. Settings > My data shows how many adverts were shown to you.
• Your data. Video adverts download on Wi-Fi only, and data saver uses the smaller version or skips them. Links in adverts open only when you tap them.

9. Where your information is kept

• Stored in the European Union. eRanki's database and files (your account, trips, SOS records, messages, photos and documents) are stored by Supabase, on Amazon Web Services in Paris, France. That is a transfer of personal information outside South Africa. Section 72 of POPIA allows it here because Supabase is bound by the EU's General Data Protection Regulation, which protects information in ways that are substantially similar to POPIA, and by a data processing agreement with us. We will review where eRanki is hosted as we take on associations and other organisations.
• The website and the association dashboard run on Vercel's servers in Cape Town. They read from and write to the database in Paris.
• Notifications on your phone. To deliver a notification, we send Expo (a United States company) your phone's push address, a notification number, its type and a fixed sentence such as "Open eRanki to see an update about your trip": never your name, a place, a number or what the notification says. Expo passes it to Apple or Google, who deliver it. The app then fetches the details from eRanki itself. That is also a transfer outside South Africa, under section 72, on the basis of a data processing agreement with Expo.

10. Error reports, and why they leave South Africa

• What is sent. When the app, the association dashboard or this website hits an error, we can send a short report to Sentry, an error monitoring service, so that we can find and fix it. A report says what kind of error it was, where in our code it happened, and when.
• What is removed first. Our code never puts what you typed, such as a message or your name, into an error. As a second safeguard, before a report leaves we remove phone numbers, email addresses, locations, links, account numbers and any quoted text (which is where names and messages would appear in an error from the database or the app). Reports from your phone or browser carry no account at all. Reports from our servers may carry a scrambled code in place of your account, which cannot be turned back into it, so we can tell when one person meets the same error twice. Your IP address is not sent, and we ask Sentry not to record it.
• Where it is stored. Sentry keeps these reports in its European Union data region, in Frankfurt, Germany. That is a transfer of personal information outside South Africa, which section 72 of POPIA allows here because Sentry is bound by the EU's General Data Protection Regulation, which protects information in ways that are substantially similar to POPIA, and by a data processing agreement with us.
• How long. Error reports are deleted after no more than 90 days.
• Right now. Error reporting to Sentry is switched off: errors are recorded on our own servers only and are not sent anywhere.

11. Your rights

You can view, download or delete your data any time from Settings → Privacy, or by contacting our Information Officer.

12. Deleting your account

• How to ask. In the app: Settings → Privacy → Delete my account. Without the app: email our Information Officer at privacy@eranki.co.za with the cellphone number of the account. We check it is you before we act or send you anything.
• When. We delete your account and your information 14 days after you ask, and within 30 days. For those 14 days nothing is deleted, you can keep using eRanki, and you can cancel in the app. The app tells you the date.
• What goes. Your name, number, trusted contacts, inbox, consents, answers, points, trips, locations, lost reports, messages and voice notes, and your phone's notification address. Your sign-in stops working.
• What stays, without your name. An SOS or safety report stays with the association as an anonymous record: no name, no description, and the place only to about a kilometre. A finished booking stays with the operator without your name, number, email, notes or addresses. If you worked as a driver, owner or marshal, the association keeps the work record (vehicles, trips) without your name, number or PrDP, and your documents are deleted. Records of what our staff did keep what happened, not who it was about.
• Not yet. We cannot delete an account while an SOS or report it raised is still open, a booking is still open, or a trip is in progress. We do it once that is closed, and still within 30 days where we can.