Privacy Policy

Last updated: June 21, 2026

Mobio is operated by Ikanisa Ltd ("Mobio", "we", "us", or "our"). This Privacy Policy explains what information we collect through the Mobio mobile application and related web pages, why we collect it, how we use it, and how users can control or delete it.

1. Information We Collect

Depending on the features you use, Mobio may collect:

• Account and authentication data: phone number, WhatsApp login verification status, user ID, display name, selected account role, profile photo, vehicle details, and profile preferences.
• Location data: approximate or precise location when you grant permission. Drivers who explicitly go online may share background location while online so passengers can find nearby available drivers. Drivers can stop sharing by going offline.
• Trip and mobility data: pickup or destination labels, optional coordinates, scheduled trip times, vehicle type, availability status, route notes, chat context, and booking or post status.
• BioPay and payment handoff data: MoMo number or MoMo Pay code you provide, BioPay payment request details, QR/NFC payloads, payment request status, wallet token balances, token transactions, redemption requests, subscription status, and related admin audit records.
• Camera, face, QR, and NFC data: camera access is used for BioPay face enrollment, face scan, QR scan, and payment verification. NFC is used for BioPay card or device handoff. Face-related data is used only for BioPay identity/payment verification and security checks.
• Phone and USSD handoff data: when you choose MoMo USSD, Mobio opens the phone app with a tel: USSD code such as *182.... The USSD session happens outside Mobio through your mobile network operator.
• Communication and safety data: in-app chat messages, support requests, reports, blocks, admin actions, moderation records, and notification preferences.
• Device, diagnostics, and security data: device model, operating system, app version, crash logs, performance data, IP-derived network information, fraud-prevention signals, and security audit logs.

2. How We Use Information

• Authenticate users and maintain secure app sessions.
• Show nearby drivers, passengers, scheduled trips, and mobility options.
• Allow drivers to go online, share live location while online, and go offline anytime.
• Create and manage BioPay QR, NFC, face verification, MoMo USSD handoff, wallet, token, subscription, and redemption workflows.
• Send account, trip, chat, subscription, wallet, safety, and support notifications.
• Detect abuse, protect accounts, investigate disputes, enforce policies, and comply with legal obligations.
• Improve app reliability, security, accessibility, and performance.

3. Permissions and User Controls

• Location: used for nearby discovery and driver live sharing. Background location is used only after a driver chooses to go online. You can deny or revoke location permissions in device settings.
• Camera: used for face enrollment, face scan, QR scan, and BioPay verification. You can deny or revoke camera access in device settings.
• NFC: used to read or write BioPay NFC payloads when you choose NFC features.
• Phone: used only for user-initiated MoMo USSD handoff. Mobio does not read call logs or monitor calls.
• Notifications: used for app alerts. You can disable notifications in device settings.

4. Sharing and Third-Party Services

We do not sell personal information. We share or process data only as needed to operate Mobio, provide requested features, protect users, or comply with law. Service providers may include:

• Supabase: authentication, database, storage, realtime features, and serverless functions.
• Firebase and Google services: push notifications, crash reporting, diagnostics, analytics, maps, and Android platform services.
• Cloudflare: public website hosting, security, caching, and network protection.
• AWS Rekognition or equivalent face verification provider: BioPay face verification where enabled.
• WhatsApp / Meta services: OTP and user-requested WhatsApp communication where enabled.
• Mobile network operators and MoMo: external USSD flows that you initiate outside Mobio.

5. Data Retention

We retain account data while your account is active. Security, payment handoff, wallet, subscription, redemption, audit, dispute, and compliance records may be retained as needed for fraud prevention, legal obligations, accounting, safety, and platform integrity. Driver live sharing data is used for current availability and should not be retained longer than needed for the feature, safety, or audit purposes.

6. Account Deletion and User Rights

You may request access, correction, export, or deletion of your personal data. You may also revoke device permissions at any time. Account deletion instructions are available at Account Deletion. We may retain limited records where required for security, fraud prevention, dispute resolution, legal compliance, or accounting obligations.

7. Security

We use TLS encryption in transit, role-based access controls, database access policies, audit logs, and administrative controls designed to protect user data. No method of transmission or storage is completely secure, but we work to protect Mobio systems from unauthorized access, loss, misuse, or alteration.

8. Children's Privacy

Mobio is not intended for children under the age of 16. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy when Mobio features, providers, legal requirements, or security practices change. The latest version is always posted on this page with the effective date above.

10. Contact Us

If you have privacy questions or requests, contact Ikanisa Ltd in Kigali, Rwanda.

Email: info [at] ikanisa.com