Privacy Policy

Shaffl ("Shaffl", "we", "our", "the App") is a smart bus and shared mobility application operating in Egypt. We help riders book seats, view schedules, track buses live, and arrive safely and on time.

We also sell flight tickets through our flight booking supplier, and our team arranges private rides on request.

This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use Shaffl, our website, our mobile app, or our customer support channels.

Shaffl complies with the Egyptian Personal Data Protection Law No. 151 of 2020, which governs consent, data usage, and individual rights such as access, correction, and withdrawal.

This Privacy Policy applies to:

• Riders who use the Shaffl app to book and take rides.
• Corporate, school, or university accounts using Shaffl for group transport.
• Drivers and operators who provide transportation through Shaffl.
• Visitors to our website or social media.

This policy does not apply to any third-party websites, apps, or payment gateways outside Shaffl's control.

We collect information necessary to operate and improve our transport service.

Identity Data: Full name, mobile number, gender, national ID or passport number (if required), profile photo.

Contact Data: Phone number, email, emergency contact details.

Trip & Mobility Data: Booked routes, pickup & drop-off points, seat reservations, attendance.

Location Data: GPS during app use, pickup and drop-off coordinates, bus GPS for live tracking.

Payment Data: Payment method, transaction reference, billing details.

Device & Technical Data: Device model, OS, app version, IP address, crash logs.

Communication Data: Messages with customer support, complaints, refund requests.

Flight Booking Data: for each traveller — title, first and last name as on the passport or ID, date of birth, gender, nationality, National ID or passport number, and passport expiry date; for the booking — a contact name, email and mobile number.

Saved Passengers (optional): details you save for the people you book for, with their permission, including document numbers.

Passenger ID Data (optional): your passport details (names, number, nationality, issuing country, date of birth, sex and expiry date) and a photo of its photo page; if your passport is Egyptian, also your National ID number, your name as written on it, its expiry date and photos of its front and back; a selfie and the result of the in-app face check; and what was read automatically from your document photos.

We use personal data to:

1. 1Operate the service — manage accounts, bookings, and rides.
2. 2Ensure safety — confirm riders, track vehicles, and assist in emergencies.
3. 3Handle payments — issue receipts and prevent fraud.
4. 4Improve performance — analyse routes, fix crashes, and forecast demand.
5. 5Communicate — send alerts, updates, and offers (you may opt out).
6. 6Comply with Egyptian law — respond to authorities and maintain required records.
7. 7Book and issue flight tickets with the airline, and send you your e-ticket.
8. 8Verify your identity when you apply for a Passenger ID (optional), read your details from the photos you upload so you don't have to type them, and, once you're approved, fill in your passport details when you book a flight.

We process your data under one or more of the following legal bases:

• Consent — you agree by creating an account and using Shaffl.
• Contractual necessity — needed to operate your rides.
• Legal obligation — to meet Egyptian regulatory requirements.
• Legitimate interest — to ensure platform security and prevent misuse.

You can withdraw consent anytime. However, without essential data, Shaffl cannot function properly.

We do not sell your data. We only share information in specific, lawful cases:

• Drivers/Operators: receive the name and mobile number of the person booking, and the trip and seats booked; depending on the bus company, also the booker's email, a pickup note you add, or each passenger's name, mobile number and email.
• Airlines and our flight booking supplier: the traveller details the airline needs to book and ticket your flight — names, title, date of birth, nationality and, when the fare requires them, passport number and expiry — and the booking's contact email and mobile number.
• Payment Providers: process payments securely.
• Corporate Accounts: receive attendance summaries and invoices.
• Service Providers: cloud hosting and analytics (under NDAs).
• Authorities: when legally required or for safety investigations.
• Business Transfers: in case of merger or acquisition, with privacy safeguards.

Location is essential to Shaffl's service. We use it to show buses nearby, estimate arrival time, and improve route planning.

• You control GPS permissions via your phone settings.
• 'While using the app' means location is only active in foreground.
• Background use is requested explicitly (e.g. 'alert me when to leave now').

Children's data is treated as sensitive under Egyptian law.

For school or youth routes, we collect limited information (child's name, guardian contact, pickup/drop-off) — always with parental or institutional consent.

We never use children's data for marketing.

When you book a flight for a child or an infant, you give the same details as for every traveller: their name, date of birth, gender, nationality and document details. Book for a child only as their parent or guardian, or with their permission.

We keep your data only as long as necessary or required by law.

• Trip data: kept for operational, tax, and safety purposes.
• Payments: kept for financial auditing.
• Complaints: retained longer if related to investigations.
• Technical logs: stored temporarily for debugging.
• Flight bookings: traveller details are kept with the booking record for as long as Egyptian law requires us to keep booking and payment records, including after you delete your account. When you delete your account, we delete the passport and ID numbers on your bookings.
• Passenger ID: once our team decides on your application, we delete the photos, what was read from them and your National ID number; if we ask you to redo a part, the parts we accepted are kept for the second look. If you're approved, we keep your passport number, encrypted, to book your flights until you delete your account; if not, we delete it too. Until you delete your account, we also keep the decision, the other details you confirmed, the last four digits of each document number and a digital fingerprint of each number (not the number itself; it stops the same document being used on two accounts). An unfinished application is cleared after 30 days.
• Saved passengers: until you delete them or your account.

After that, data is deleted or anonymised permanently.

We use administrative, technical, and physical safeguards to protect your data:

• Encrypted communication between device and servers
• Limited staff access to personal records
• 24/7 monitoring for suspicious activity
• Passenger ID numbers and saved passengers' document numbers are stored encrypted, and only authorised staff can see Passenger ID photos

If a breach occurs, we'll follow Egyptian PDPL reporting rules and notify affected users.

Under Egypt's Personal Data Protection Law (PDPL), you have the right to:

• Access your data
• Correct or update inaccurate information
• Request deletion of personal data
• Withdraw consent for optional processing
• File a complaint with the Egyptian Personal Data Protection Centre

To exercise these rights, email our Data Protection Officer (DPO) at: support@shaffl.com

Data Protection Officer (DPO)

SHAFFL for Smart, Tourism & Air Transport Technology Services

📧 support@shaffl.com

📍 Al-Munir Tower, Shaker St., Al-Estad, 2nd Tanta District, Gharbia, Egypt