Privacy Policy

1. Data operator

Operator: Individual Entrepreneur ADA Technologies, 21 Kultegin Street, Astana, Republic of Kazakhstan; dastan_ermaganbet@mail.ru. The identification number must be confirmed before final consent is completed. This policy describes the QazDriver app, API, support and account operations.

2. Account, profile and driver documents

Data includes phone number, entered name, selected avatar, account identifier, login and session details. Driver applications include vehicle brand, model, colour, year, registration plate, photos of the driving licence, vehicle, registration certificate and interior, and application status and review outcome.

Images may contain full names, national identification numbers and other visible details. Documents are used by authorised people to review applications, not for publication in the general feed. Submit only your own relevant documents and avoid unnecessary information.

3. Trips, addresses and location

Data includes cities, departure date/time, passenger addresses, selected coordinates, request type, price, seats, comment, publication/cancellation/closure and related agreements. Address searches send the text and city or coordinates through the API to the address lookup service.

Current location is used after permission for a pickup address or another explicit selection. Continuous background tracking is not provided. Addresses can be selected manually. Driver publications use cities without pickup and destination addresses.

4. Contact, support and technical data

The service records contact requests, participants, time and explicit agreement responses, not the content of phone conversations. Selecting WhatsApp or a phone app passes the number to that app, whose own terms apply separately.

Data includes support submissions, IP addresses and related connection/security information, session identifiers and expiry, and publication/agreement events. Some technical signals are transformed into cryptographic derivatives for abuse prevention. This does not make all service data anonymous.

5. Purposes

Purposes are login and session restoration, profiles, driver application review, publication and search, address selection and route estimates, authorised contact disclosure, agreement history, support, abuse prevention, legal obligations and protection of rights.

Required consent must be separate and demonstrable. Processing without consent is permitted only on an applicable legal basis. Signing in does not authorise arbitrary new purposes. This edition does not request consent for advertising or marketing messages.

6. Visibility to other users

Signed-in users see cards available to them: name/avatar, direction, date, type, price, seats, comment and other displayed conditions. Passenger requests may show pickup and destination addresses to approved drivers. Passenger ride offers display the vehicle details provided by the card.

Phone numbers are not published in general cards. Access is granted by protected requests under service rules, including driver approval and an active same-direction listing. Mutually confirmed participants retain history contacts. Licence and registration-document photos are not intended for public viewing.

Do not put documents, phone numbers, third-party or sensitive information in comments if you do not want card recipients to receive it. Although the feed requires authentication, recipients may independently save information; the operator cannot guarantee removal of copies from another person’s device.

7. Providers, hosting and cross-border transfers

According to the operator, primary infrastructure, the database and files are hosted on a rented PS.kz VPS in Astana, Kazakhstan. Staff and provider access must be limited to what is necessary. Data is disclosed to public authorities only on a lawful basis.

The map loads OpenStreetMap tiles; its provider receives IP addresses, request information and the viewed map area. External routing receives start/end coordinates, not profile names, phone numbers or documents. The configuration may use the public OSRM service routing.openstreetmap.de.

External mapping, routing, phone and messaging services may process information outside Kazakhstan. SMSC.kz has been selected for actual SMS delivery: once delivery is enabled, it receives the phone number and login code. Transfer grounds, required consent and cross-border conditions must be established separately; general consent does not replace mandatory Kazakhstan storage requirements.

When the operator enables WhatsApp sign-in, the phone number is checked for WhatsApp availability for sign-in and registration; the number and one-time code are passed to that service. SMSC.kz is used if WhatsApp is absent or the connection is unavailable before sending. An SMS can be explicitly requested on the code screen after 30 seconds. Up to three sends per number are allowed; after the third, resending is blocked for 30 minutes while the latest code remains valid for 5 minutes. Number checks are not used for bulk contact discovery. The WhatsApp Web linked-device integration is not the official WhatsApp Business API; the operator must separately establish applicable processing terms and any required consent. This edition does not confirm where WhatsApp processes data.

8. Retention, deletion and backups

Deleting an account disables access, clears phone, name and avatar, removes the driver application and cancels active publications. Related comments and address snapshots are cleared and files marked for deletion. Physical file removal follows a subsequent cleanup rather than being guaranteed at the moment of the tap.

Trip, agreement, contact-attempt and outcome history currently remains without automatic history deletion. Identifiers, cities, dates, prices and outcomes may remain after direct details are cleared. These can permit indirect matching and are not represented as fully anonymous. Support submissions and backups need separate retention and deletion accounting.

The operator must still approve and implement final periods for history, support, technical logs, documents and backups according to purposes and lawful grounds. Until then this policy remains a draft; it does not authorise indefinite personal-data retention without a basis.

9. Rights and requests

You may request information about processing and recipients, access, correction, blocking or deletion where the law provides, withdraw consent within lawful limits and approach a competent authority or court. Use the operator’s email or Support.

Identify your account and request. Proportionate identity verification may be requested to prevent unauthorised disclosure; do not send login codes or payment secrets. Where law requires continued retention, the operator must explain its basis and scope. Withdrawal does not retrospectively make previously lawful processing unlawful.

10. Protection and changes

The service uses protected connections, authentication, access restrictions and abuse-prevention measures. No system guarantees absolute security. Do not share access codes and promptly report suspicious access.

Current text is downloaded from the server with a version number. Material expansion of purposes, data or recipients requires separate notice and consent where required by law. Updating the text alone does not record acceptance.

Firebase push notifications

If you enable push notifications, the Android app uses Firebase Cloud Messaging (Google) for new orders, agreements, driver approval and messages from the service operator. After sign-in and notification permission, Firebase receives a technical installation identifier and delivery token; the operator stores the token encrypted and linked to the session, language, role and city/date filters. Automatic messages do not contain user phone numbers, addresses, documents, names or comments. Manual notifications contain a title and text entered by the operator and may target all available registered devices or one selected user. Google may process delivery data outside Kazakhstan under its provider terms. Google Analytics is not enabled in this integration. You can revoke permission in phone settings; logout, account deletion or session expiry ends that session registration. Queue data is removed in background after its delivery window and an additional day; this does not change trip-history or backup retention.