Privacy Policy

1. Information we collect

Account details you give us: your name, phone number, email address, and password or sign-in credentials.

Booking and listing details: the vehicles, transfers, hotels, and stays you search for, book, or list; trip dates, pick-up and drop-off locations, and messages you exchange with partners or support.

Verification (KYC) data: for partners and, where required, renters — identity documents, driving licence, and vehicle documents used to verify you and comply with the law.

Payment information: M-Pesa phone number and transaction references needed to process payments and refunds. We do not store full card numbers; payments are handled by our regulated payment providers.

Technical data: device type, app version, IP address, and diagnostic or crash logs collected automatically to keep the service secure and working.

2. How we use your information

To create and manage your account and let you book, list, and manage trips.

To process payments via M-Pesa, hold funds in escrow, and issue refunds and receipts.

To verify identity, prevent fraud, and meet legal and regulatory obligations.

To provide customer support and send transactional messages about your bookings.

To maintain, secure, and improve the app and website. We do not sell your personal data.

3. How we share your information

With the other party to a booking — a renter and the partner they book with share the details needed to complete the trip (for example name and contact where appropriate).

With service providers who process data on our behalf, including Google Firebase (hosting, database, authentication) and our M-Pesa payment and email providers, under agreements that protect your data.

With authorities or regulators where we are legally required to do so, or to protect the rights and safety of our users.

4. Data retention

We keep your personal data for as long as your account is active and as long as needed to provide the service, then for any additional period required to meet legal, tax, accounting, or dispute-resolution obligations. When data is no longer needed we delete or anonymise it.

5. Your rights

Under Kenya's Data Protection Act, 2019 you have the right to access the personal data we hold about you, to correct inaccurate data, to request deletion, to object to or restrict certain processing, and to lodge a complaint with the Office of the Data Protection Commissioner.

You can delete your account and associated data at any time from within the app (Account → Delete account) or by emailing us at the address below.

6. Data security

We protect your data with encryption in transit, access controls, and reputable infrastructure providers. No system is completely secure, but we work continuously to safeguard your information and will notify you and the relevant authority of any breach as required by law.

7. Children

Isura is intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us and we will remove it.

8. Changes to this policy

We may update this policy from time to time. We will post the new version here with an updated date and, where changes are significant, notify you in the app.

9. Contact us

For any privacy question or to exercise your rights, contact Tunga AI Ltd, Nairobi, Kenya at privacy@isura.co.ke.