Privacy Policy

This Privacy Policy is a draft. It describes, in plain English, how Vhiri handles personal information today, and it is waiting for review by our legal advisers. The reviewed policy may differ from this draft.

When the reviewed policy is ready, it will be published here, in the app and on the website, as a new version with the date it takes effect.

Vhiri is a marketplace for renting cars and booking vehicle services. It is operated by Bolu Digital Intelligence (Private) Limited ("Vhiri", "we" or "us"), which is responsible for the personal information described in this policy.

In this policy, "you" means anyone who uses the Vhiri app or website: renters, hosts, service providers, the people who work for them, and visitors.

We collect the information you give us and the information created when you use Vhiri:

• Account details: your name, email address, phone and WhatsApp numbers, and the profiles you hold (renter, host or service provider, for yourself or for a company). We never store your password itself, only a scrambled form of it.
• Identity and verification documents: for example your ID or passport, driving licence, a photo of you holding your ID and proof of address, and for a company its registration papers, tax clearance and the details of its directors.
• Vehicles and listings: registration and insurance documents, photos, features, prices, availability, locations, and maintenance and cost records.
• Bookings and jobs: dates, places, quotes, handover checklists, progress notes, reviews and ratings.
• Payments and wallet: payments, refunds, wallet balances and transactions, payout accounts and mobile money numbers. We do not store card numbers.
• Messages: what you write in Vhiri chat, with who sent it and when.
• Photos taken in the app, such as handover, return and job photos, with the time and, where your phone provides it, the place they were taken.
• Location: the addresses and areas you enter, such as pick-up, delivery and service areas, and the location attached to photos and trip records.
• Device and usage: device type, app version, push notification tokens, IP address and technical logs.

If you sign in with Google or Facebook, we receive your name, email address and an account identifier from them.

When signing the Terms and Conditions with a selfie is introduced, we will also keep the selfies and liveness results taken when you sign. We will ask for your consent before any are taken.

We use your information to:

• create and run your account and profiles
• check who you are and that your documents are valid, and review profiles, listings and services before they go live
• show listings and services, and connect renters and customers with hosts and service providers
• take payments, hold them until a booking or job is complete, pay out, refund, and keep financial records
• send you messages about your bookings, jobs, payments and account by push notification, email, SMS and WhatsApp
• keep Vhiri safe: prevent fraud and misuse, settle disputes and enforce our terms
• fix problems and improve Vhiri
• meet our legal duties, such as keeping tax and financial records and answering lawful requests from the authorities

We do not sell your personal information.

We share only what each party needs:

• The other party to a booking or job: the host and the renter, or the customer and the service provider, see each other's names and profile details, the booking or job details, and the messages between them.
• Payment processors: Paynow and Pesepay process card and mobile money payments, and EcoCash processes payments you send by EcoCash transfer to our business wallet.
• Messaging providers: Postmark sends our emails, Infobip sends our SMS and WhatsApp messages, Vonage sends SMS when Infobip cannot, and Firebase Cloud Messaging (from Google) delivers push notifications.
• Google and Facebook, if you choose to sign in with them.
• The companies that host and run our servers, under contract.
• The authorities, such as the police or a court, when the law requires it, or to deal with an accident, theft or fine involving a booking.
• Our professional advisers, such as lawyers and auditors, who must keep it confidential.

If you act for a company on Vhiri, the company's administrators can see what you do for that company.

We keep your information while you have an account, and afterwards only for as long as we need it for the reasons in this policy.

When you ask us to delete your account or your data, we act on the request within 30 days. We keep some records for longer where the law requires it or to settle disputes, for example financial records for tax and fraud prevention, and the records of bookings, payments and signed terms. These are deleted when they are no longer needed.

We protect your information with encrypted connections, access limited to the staff who need it, and a record of who opened identity documents. Identity documents are kept in a private store, and document photos are saved without their hidden location data.

No system is completely secure. Keep your password and phone safe, and tell us at once if you think someone else has used your account.

You can:

• see and correct your details in the app, under Profile, and on the website
• ask for a copy of the personal information we hold about you
• ask us to correct or delete information
• delete your account in the app: open Settings and choose Delete my account, or Request data deletion to remove your data and keep your login
• choose which notifications you receive, in Settings under Notification preferences
• object to how we use your information, or withdraw a consent you gave, where the law allows

We may need to confirm who you are before we act on a request. Some records must be kept even after a request, as set out under How long we keep it. You can also complain to the data protection authority.

Vhiri is for adults. You must be 18 or older to open an account, and older still to rent a car where a host or the law requires it.

We do not knowingly collect information about children. If we learn that a child has an account, we will close it.

Some of the providers we use, such as our email, SMS, WhatsApp and push notification providers, and Google and Facebook sign-in, process information on servers outside Zimbabwe.

When information goes abroad, we send only what the service needs, and we use providers that protect it.

When we change this policy, we publish a new version here, in the app and on the website, with its version number and the date it takes effect. If a change is important, we also tell you by notification or email.

Earlier versions are kept, so we can always show what you were shown.

Questions about this policy or your information can be sent to Bolu Digital Intelligence (Private) Limited, which operates Vhiri.

The contact details for privacy questions and requests will be published here before this policy is final.