Privacy Policy

1. Who we are

Sawary ("we", "us", "our") is a carpool platform operated by Sawary, a company registered in Pakistan with its registered office at haseebleoo@gmail.com (registration number TBD).

Sawary connects verified commuters — both riders and drivers — for shared daily journeys. This privacy policy explains what personal data we collect, why we need it, how we use it, and the rights you have over it.

2. What personal data we collect

We collect the minimum data needed to operate the Sawary platform and verify that everyone using it is who they say they are. Specifically:

2.1 Account data

• Full name (as it appears on your CNIC)
• Mobile phone number (used for login and ride notifications)
• Email address (optional, for support and account recovery)
• Date of birth (to confirm you are 18 or older)

2.2 Identity verification (KYC) data

• CNIC number (the 13-digit Pakistani national identity card number)
• Photograph of the front and back of your CNIC
• A live selfie photograph for facial matching against your CNIC
• The KYC verification status and timestamp

2.3 Location data

• The pickup and drop-off points you set or search for
• Approximate location while the app is open, used to display nearby rides
• Live location during an active ride (only while you have a confirmed booking, and shared with your driver and any emergency contacts you have enabled)

2.4 Device and usage data

• Device model, operating system, and a unique device identifier
• App version, crash reports, and basic usage analytics (which screens you visit, which buttons you tap — never the contents of private messages)
• Push notification token (so we can deliver booking confirmations and safety alerts)

2.5 Ride and booking data

• Rides you post (as a driver) or book (as a rider), including route, time, fare, and seat selection
• The 4-digit boarding OTP we generate for each booking
• Your star ratings and written reviews after a ride
• Support messages and complaints you send us

3. How we use your personal data

We use your data for the following purposes only:

• To verify your identity — CNIC and selfie matching is performed by our KYC provider. The result (verified / not verified) is stored; the underlying biometric data is not stored on our servers.
• To match you with rides — your route preferences and verified status are used to surface relevant rides (or, for drivers, relevant riders).
• To operate the boarding OTP system — we generate and verify a unique code at ride time so that both rider and driver can confirm the right person is in the right vehicle.
• To send transactional notifications — booking confirmations, departure reminders, ride status updates. You cannot opt out of these, because they are essential to using the service.
• To handle support and safety incidents — when you contact us, or when another user reports a problem involving you.
• To improve the app — aggregated, de-identified usage data helps us fix bugs and understand which features are used.
• To comply with the law — we may be required to disclose data to law enforcement in response to a valid Pakistani court order.

4. CNIC and KYC data — special handling

Your CNIC number and CNIC photographs are sensitive personal data. We treat them with extra care:

• CNIC photographs are stored encrypted at rest and only accessible to a small number of authorised KYC reviewers.
• Other Sawary users — including drivers — never see your CNIC number or CNIC photograph. They only see your first name, initial of your last name, KYC verified badge, and star rating.
• We retain CNIC photographs for 7 years after your account is closed, after which they are permanently deleted. Your CNIC number is retained as long as your account is active, plus the period required by Pakistani tax and anti-money-laundering law.
• Biometric selfie data used for face matching is never stored on our servers. It is processed in real time by our KYC provider and discarded after a match result is produced.

5. Who we share your data with

We do not sell your data. We share it only with the following categories of recipient, and only the data they need:

• Other Sawary users on a need-to-know basis — drivers see your first name and verified badge; riders see the same about you. Phone numbers are revealed only after a booking is confirmed.
• Trusted emergency contacts — if you opt in to the safety contact feature, your live ride location and ride details are shared with the contacts you nominate.
• KYC and identity verification provider — to perform CNIC and selfie verification.
• Cloud infrastructure provider (currently Google Firebase / Google Cloud Platform, with data hosted in Pakistan) — for database, file storage, authentication, and push notifications.
• Maps provider (Google Maps) — for route display, pickup suggestions, and distance calculation. This provider receives your location only while the map screen is open.
• Payment provider (when payments are enabled in a future release) — for fare processing. We do not store your card number on our servers.
• Law enforcement — only in response to a valid order from a Pakistani court of competent jurisdiction.

6. Your rights over your data

You have the following rights. To exercise any of them, email haseebleoo@gmail.com from the address registered to your Sawary account. We will respond within 14 days.

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to fix any data that is wrong or out of date.
• Deletion — close your account and ask us to delete your data, subject to the retention rules above and any legal obligation to keep records.
• Withdrawal of consent — for optional data uses (such as marketing emails), you can withdraw your consent at any time without affecting your ability to use the core service.
• Complaint — if you believe we have mishandled your data, you have the right to complain to Pakistan's Personal Data Protection Authority (or its successor body).

7. Children's data

Sawary is not for use by anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please email haseebleoo@gmail.com and we will close the account and delete the data.

8. International data transfers

Some of our service providers (Google Firebase, Google Maps) process data outside Pakistan. When this happens, we rely on the data protection commitments those providers publish in their own terms of service, and we choose regional data hosting where it is available.

9. How we keep your data secure

We use industry-standard measures to protect your data:

• TLS encryption for all data in transit
• Encryption at rest for sensitive fields, including CNIC photographs
• Role-based access controls inside our team — only a small number of authorised staff can view KYC documents
• Regular access reviews and security audits
• SOS and account-takeover monitoring

No system is perfectly secure. If we ever suffer a data breach that affects your personal data, we will notify you by email and, where required, by SMS, within the timelines set by Pakistani law.

10. Changes to this policy

We may update this policy as the product changes or as Pakistani data protection law evolves. When we make a material change, we will notify you in the app and by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page always reflects the current version.

11. Contact us

If you have any questions about this policy, or to exercise any of your rights, contact us at:

• Email: haseebleoo@gmail.com
• Phone: +92-333-2759526
• Mail: Sawary, haseebleoo@gmail.com