Privacy Policy

Last updated: 29 September 2026

This policy explains what personal data Zyra (Bytes Developers, the data controller) collects when you use the Zyra app and website, why, who we share it with, how long we keep it, and your rights under Kenya's Data Protection Act, 2019. It applies to riders, customers, guests, job seekers, Drivers, Merchants and businesses.

1. What we collect

• Account details: name, phone number, email, password (stored only in a scrambled form), profile photo, and your role on Zyra.
• Location: your device's precise location when you allow it — to show what's near you, work out real road distances and times, set pickups and drop-offs, and pick the currency prices are shown in. For Drivers, live location while online and during a trip or delivery.
• Trips, orders and bookings: addresses, routes, times, items, fares, ratings, reviews, messages with Drivers and Merchants, and support conversations.
• Payments: your M-Pesa number and payment confirmations. We never see your M-Pesa PIN.
• Voice and camera: when you use the voice assistant or speech translation we use your microphone while you're talking; when you scan a code or take a photo (for example proof of delivery) we use your camera. We don't listen or record in the background.
• Driver and Merchant checks: ID, licences, vehicle and business documents, and the results of our checks.
• Businesses using Zyra Business: the records they keep there (staff, payroll, accounts, stock) — for which the business is the controller and Zyra processes on its behalf.
• Device and usage: device model and system, app version, push-notification token, language and region, and crash and error reports.

2. Why we use it

• To provide the service you ask for — matching you with a Driver, taking orders and bookings, showing routes and arrival times, and processing payments (performance of our contract with you).
• To keep people safe and prevent fraud — verifying accounts and Drivers, trip safety features, and investigating reports (our legitimate interests and legal obligations).
• To send you updates about your trips, orders, bookings and account, and — only if you've allowed it — offers and suggestions (your consent, which you can withdraw in Settings).
• To support you, resolve disputes, and meet tax, accounting and legal requirements.
• To improve Zyra — understanding how features are used, fixing problems and developing new ones.

3. Who we share it with

• Drivers and Merchants — only what they need for your trip, order or booking (for example your first name, pickup and drop-off, phone number for the duration of the trip, and the items ordered).
• Payment providers — Safaricom M-Pesa (Daraja), to process mobile-money payments.
• Service providers acting on our instructions: Google Maps (maps, routes, places, travel times), OpenAI (the AI assistant and voice features — what you say or type to it), Resend (email), Expo and Google (push notifications), and our hosting provider.
• Authorities — when the law requires it, to protect someone's safety, or to respond to valid legal requests.
• A buyer or successor — if Zyra's business is reorganised or sold, under the same protections.
• We don't sell your personal data. Other businesses on Zyra can't see your data unless you deal with them, and one business can never see another's records.

4. International transfers

Some of our providers process data outside Kenya. When they do, we make sure there are appropriate safeguards as the Data Protection Act requires, such as contractual protections.

5. How long we keep it

We keep your data while your account is open. After you close it we delete or anonymise it, except what we must keep for legal, tax, safety or dispute reasons (for example payment and trip records, usually up to 7 years). Location history not linked to a trip is kept only as long as needed to provide the feature.

6. Your rights

• Be told how your data is used (this policy).
• Access the personal data we hold about you and get a copy.
• Correct data that's wrong, and delete data that's no longer needed.
• Object to or restrict some uses, including direct marketing.
• Withdraw consent at any time — for example switch off location, notifications, microphone or camera in Profile → Permissions, or in your phone's settings.
• Complain to the Office of the Data Protection Commissioner (www.odpc.go.ke) if you think we've mishandled your data.
• To use these rights, email us. We'll reply within the time the law sets.

7. Security

We protect data with encrypted connections, access controls so staff only see what their job needs, separation between businesses, and monitoring. No system is perfectly secure; if a breach affects you, we'll tell you and the Data Protection Commissioner as the law requires.

8. Children

Zyra is for adults. We don't knowingly collect data from anyone under 18; if we learn we have, we delete it.

9. Changes

We'll update this policy as Zyra changes, show the new date at the top, and tell you in the app about important changes.