Privacy Policy

1. Introduction

This Privacy Policy explains how TOPSII ("TOPSII", "we", "us", or "our"), a company registered in Afghanistan with its principal place of business at Kabul, Afghanistan, collects, uses, shares, and protects personal information of users of both TOPSII mobile applications and our website:

• the TOPSII Rider mobile application (iOS and Android) — for people requesting rides,
• the TOPSII Driver mobile application (iOS and Android) — for people offering rides, and
• the TOPSII web admin console (used by our staff).

The Driver app collects more data than the Rider app because Drivers must be verified, stay locatable while online, and receive payouts. Those extra Driver practices are described in Sections 3.2, 7, and 9.

By using any TOPSII app or service, you acknowledge that you have read and understood this Privacy Policy and our Terms of Service. If you do not agree, please do not use our services.

2. Quick Summary

3. Information We Collect

3.1 From Riders

• Account: full name, phone number, email address, profile photo (optional), password (hashed).
• Payment: payment method details (processed and stored by our payment provider — we store only a token and last 4 digits).
• Trips: pickup and drop-off locations, route taken, time, fare, ride history.
• Communications: in-app messages and calls between you and your Driver (calls may be masked via our SMS provider), support tickets and ratings.
• Promotions: referral codes used, promotional credits.

3.2 From Drivers (TOPSII Driver app)

The Driver app is a separate application from the Rider app. If you register as a Driver we collect the following in addition to the account data in 3.3:

• Identity verification: full name, phone, email, driving licence image and licence number, licence expiry date, and a profile photo taken or uploaded in the app.
• Vehicle documents: vehicle registration, insurance certificate, vehicle type (car, bike, etc.), make, model, year, colour, and licence plate.
• Application status: whether your account is pending review, approved, rejected, or asked to resubmit documents, plus any rejection reason our team sends you.
• Banking & payouts: bank account or wallet details and tax identification number where required so we can pay your earnings.
• Online / offline status: when you toggle available in the Driver app.
• Real-time location: continuous GPS (precise location) while you are online — including when the Driver app is in the background or the screen is off — so we can dispatch nearby trips and show ETAs. Collection stops when you go offline. See Section 9.
• Trip activity: accepted, arrived, in-progress, completed, and cancelled trips; pickup and drop-off; route; fare; and duration.
• Performance & earnings: ratings from Riders, rating count, total trips, acceptance and cancellation rates, total earnings, and payout history.
• Push token: a Firebase Cloud Messaging device token so we can send trip requests and account alerts to your phone.

3.2a Device permissions used by each app

Both apps ask for device permissions. The Driver app asks for more because it must verify you and locate you while you are available for work.

You can revoke any permission in your phone settings. Revoking location, camera (before verification), or notifications will stop the affected app from working as intended. Background location in the Driver app is not used for advertising.

3.3 From everyone (Riders, Drivers, Admins)

• Device & technical data: device model, operating system version, app version, language, time zone, mobile network, IP address, device identifiers (advertising ID, installation ID).
• Usage data: screens viewed, features used, session duration, taps and gestures (aggregated), crash reports.
• Support: the content of any messages you send to support, including attachments.

4. How We Use Your Data

4.1 In both apps

• Create and manage your account.
• Match Riders with nearby Drivers and calculate fares.
• Process Rider payments and Driver payouts.
• Provide in-app navigation, ETAs, and trip tracking.
• Enable safety features: emergency contact sharing, trip sharing, incident response.
• Detect and prevent fraud, abuse, unsafe driving, and policy violations.
• Provide customer support and respond to your requests.
• Send service-related notifications (trip status, receipts, account alerts).
• Send marketing communications (only with your consent — you can opt out at any time).
• Comply with legal obligations (tax, accounting, law enforcement requests).
• Improve our service, debug issues, and develop new features (using aggregated or anonymised data where possible).

4.2 Extra uses in the TOPSII Driver app

• Review your licence, vehicle registration, insurance, and profile photo so our team can approve or reject your Driver account.
• Ask you to resubmit a document if a photo is unclear or expired, and store the reason we send you.
• Show you as available to nearby Riders only while you are Online, using your live GPS (including background location).
• Push a trip request to your phone even if the Driver app is in the background.
• Show the Rider your first name, photo, rating, vehicle, plate, and live location during an active trip.
• Calculate your earnings, service fee, and payouts, and keep records required for tax.
• Measure acceptance, cancellation, and rating so we can keep the platform safe and reliable.

5. Legal Basis for Processing (GDPR)

For users in the European Economic Area, UK, and other GDPR-aligned jurisdictions, we process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)) — to provide the ride-hailing service you signed up for.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, transport licensing, and law enforcement requirements.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, network and service security, product improvement.
• Consent (Art. 6(1)(a)) — for marketing communications, optional features, and cookies that are not strictly necessary.
• Vital interests (Art. 6(1)(d)) — to protect the safety of Riders and Drivers in emergency situations.

6. Sharing & Third Parties

We share personal data only as described below. We do not sell your personal data.

6.1 With other TOPSII users

• When you request a ride, your first name, photo, rating, pickup location, and drop-off location are shared with the assigned Driver.
• When you accept a ride, your first name, photo, rating, vehicle details, and real-time location are shared with the Rider.

6.2 Service providers (subprocessors)

Each subprocessor is bound by a data processing agreement and may only use your data for the purposes we specify.

6.3 Legal & safety

• To comply with a valid court order, subpoena, or legally binding government request.
• To enforce our Terms of Service or investigate potential violations.
• To protect the rights, property, or safety of TOPSII, our users, or the public, including emergency disclosures to first responders.

6.4 Business transfers

In the event of a merger, acquisition, reorganisation, or sale of assets, your data may be transferred to the successor entity, subject to the same protections described in this policy.

7. Driver App — Extra Disclosures

This section applies only to people who install and use the TOPSII Driver app. Rider-app users who never register as a Driver are not subject to these extra practices.

• You cannot accept trips until you are verified. After you upload your driving licence, vehicle registration, insurance, and profile photo, our staff review them in the admin console. We may approve, reject, or ask you to send clearer or updated files. You will get a push notification when the status changes.
• Documents are private. Licence and vehicle files are stored securely and shown only to TOPSII verification staff (and to you). They are not shown to Riders. We may check them against government registries where the law allows.
• Background location while Online: the Driver app collects precise GPS in the foreground and in the background (app minimised or screen off) for as long as you are toggled Online. We use it to find you for nearby trip requests, to give the Rider an ETA, to show your movement during the trip, and for safety. We do not collect background location when you are Offline, and we do not use it for ads. See Section 9.
• Going Offline stops tracking. When you toggle Offline, we stop sending regular location updates. A last-known point may remain briefly for support or an in-progress trip.
• What a Rider sees: after you accept a trip, the Rider sees your first name, profile photo, rating, vehicle type, and live location. Your full licence image, insurance file, and payout details are never shown to the Rider. Your phone number is shared only through a masked call or in-app channel during an active trip, if that feature is enabled.
• Earnings & tax: we keep trip and payout records for the period required by tax and accounting law in Afghanistan and may issue reports to tax authorities where required.
• Account actions: we may suspend or ban a Driver account for safety, fraud, fake documents, or Terms violations. Those records may be kept longer so the same person cannot immediately re-register.

8. Rider App — Extra Disclosures

This section applies to people who use the TOPSII Rider app.

• What a Driver sees: your first name, photo, rating, pickup, and drop-off for the assigned trip. Your payment card details are never shown to the Driver.
• Location: collected only while the Rider app is in use (see Section 9.1). We do not request background location from Riders.
• Ratings: Drivers can rate you after each trip; aggregate ratings may affect your ability to use the service. Individual ratings are not shown to Drivers in real time.
• Saved places: "Home", "Work", and other saved locations stay on your account and are visible only to you unless you use them as a pickup or drop-off.

9. Location Data

Location is required for a ride-hailing service. The two apps use it differently:

9.1 TOPSII Rider app

• We collect your location only while you are using the app (foreground): to set pickup, find nearby Drivers, follow the trip, and briefly after drop-off for support or disputes.
• The Rider app does not request “always” / background location.

9.2 TOPSII Driver app (background location)

The TOPSII Driver app collects location data to enable trip dispatch even when the app is closed or not in use (background location), but only while you are toggled Online.

• Why we need it: to send you nearby trip requests, calculate Rider ETAs, show your live position to the Rider during a trip, and support safety features if something goes wrong.
• When it runs: from the moment you go Online until you go Offline — including when the Driver app is minimised, another app is open, or the screen is locked.
• When it stops: as soon as you toggle Offline, or if you revoke location permission. An active trip may keep sharing location until that trip ends.
• What we do not do: we do not sell your location, use background location for advertising, or track you when you are Offline and not on a trip.

You can turn location off in your device settings at any time. Without location, the Rider app cannot request a trip and the Driver app cannot receive dispatches.

10. Data Retention

• Active accounts: we retain your data for as long as your account is active.
• After account deletion: most personal data is deleted or anonymised within 30 days.
• Legal retention: trip records, invoices, and payout history are retained for the period required by tax and accounting law in Afghanistan (typically 5–7 years).
• Safety and fraud: records relating to safety incidents, fraud, or banned accounts may be retained longer to prevent re-registration and protect the platform.
• Backups: data may persist in encrypted backups for up to 90 days after deletion from production systems.

11. Data Security

We protect your data with industry-standard measures:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 via our hosting provider).
• Row-level security policies on our database so users can only access their own data.
• Hashed and salted passwords (we never see your plain-text password).
• Role-based access controls for our staff; admin actions are logged.
• Regular security reviews and dependency scans.

No system is 100% secure. If we become aware of a breach affecting your data, we will notify you and the relevant supervisory authority within the timeframes required by law.

12. Your Rights

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request deletion of your data.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Non-discrimination (CCPA) — we will not deny service or charge different prices because you exercise your privacy rights.
• Lodge a complaint — with your local data protection authority.

To exercise any of these rights, email us at info@topsii.com. We will respond within 30 days (extendable by 60 days for complex requests, as permitted by GDPR).

13. Children

TOPSII is not directed to people under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at info@topsii.com and we will delete it.

14. International Data Transfers

TOPSII operates globally. Your data may be transferred to and processed in countries other than your own, including the United States and the European Union, where our service providers are located. Where required, we rely on Standard Contractual Clauses or equivalent safeguards to protect your data during international transfers.

15. Cookies & Tracking

The TOPSII Rider and TOPSII Driver mobile apps do not use browser cookies. They do use on-device identifiers and third-party SDKs (maps, push notifications, crash reporting) described in Section 6.2. The TOPSII web admin console uses:

• Strictly necessary cookies — to keep you signed in and remember your theme preference.
• Analytics cookies — only with your consent, to understand how the admin console is used.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If the changes are material, we will notify you through the app or by email at least 30 days before they take effect.

17. Contact Us