Privacy Policy

Account data: name, phone number, email, password (stored hashed), profile photo, and the role(s) on your account (passenger, driver, SACCO admin).

Location data: your device's live location while booking a ride or, for drivers, while a trip is active. This is used to show nearby matatus, calculate ETAs, and match pickup stages. Drivers' location is only shared with passengers while a trip is in progress.

Trip and booking data: routes searched, trips booked, seats reserved, pickup/dropoff stages, fares, and trip history.

Payment data: M-Pesa transaction references, amounts, and status. Matu never receives, stores, or has access to your M-Pesa PIN. That is entered directly on your phone through Safaricom's own prompt, entirely outside the app.

Vehicle and SACCO data (drivers/admins): vehicle registration, capacity, route assignments, and SACCO membership/commission records.

Support data: messages you send through Support & complaints, and conversations with the in-app AI assistant.

Device and usage data: device type, app version, and basic diagnostic logs used to fix bugs.

We use your data to: operate core booking and payment features; show live vehicle locations and ETAs; verify identity and prevent fraud; process M-Pesa payments; respond to support requests and complaints; improve the app; and meet legal obligations (e.g. transport sector recordkeeping).

We share data only where necessary to run the service:

• Safaricom M-Pesa: to process payments (transaction reference and amount only; never your PIN).
• Supabase: our database and backend infrastructure provider, which stores account, trip, and booking data securely.
• Mapbox and OpenStreetMap: for maps, routing, and place lookups. Only the location needed for that specific request is sent.
• Google (Gemini API): powers the in-app AI assistant. Messages you send it are processed to generate a reply; the assistant only acts through verified app data, never external data about you.
• SACCOs: a SACCO admin can see trip, vehicle, and revenue data for vehicles registered under their SACCO, but not a passenger's personal account details beyond what's needed for a specific booking dispute.

We do not sell personal data to third parties, and do not share it with advertisers.

We retain account and trip data for as long as your account is active, and for a reasonable period after account deletion where required for legal, tax, or dispute-resolution purposes. When you delete your account, your profile, bookings, and related records are permanently deleted as described in Section 7. Some anonymized transaction records may be retained for financial recordkeeping as required by Kenyan law.

Under the Data Protection Act, 2019, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request deletion of your data (see Section 7); object to or restrict certain processing; and lodge a complaint with the Office of the Data Protection Commissioner (ODPC) Kenya if you believe your data has been mishandled.

To exercise any of these rights, use Support & complaints in the app, or email us at the address in Section 9.

We use industry-standard safeguards: encrypted connections (HTTPS), access-controlled databases, and row-level security on account data, to protect your information. No system is 100% secure, and we encourage you to use a strong, unique password and never share your M-Pesa PIN with anyone, including anyone claiming to represent Matu.

You can permanently delete your account from Account settings at any time. Deleting your account removes your profile, roles, bookings, payment references, and favorite routes. If you own a SACCO, deleting your account also deletes that SACCO and its vehicles. If you drive your own independently-registered vehicle, that vehicle record is deleted too. This action cannot be undone.

Matu is not directed at children under 18. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.

Thamana Solutions, Nairobi, Kenya

Email: emmanuelmakobiero@gmail.com

We may update this policy as Matu's features change. We'll update the "Last updated" date above, and where changes are material, notify you in-app.