Privacy Policy

This Privacy Policy applies when you use EZconvy's websites, public route-launch pages, Rider app, EZ Bus driver app, administrative portals, Pick n Drop services, Carpool, public-transport information, support channels, and other services that link to this policy (together, the "Services").

EZconvy is owned and operated by EZCONVY TECHNOLOGIES (PRIVATE) LIMITED, a company registered in Pakistan. In this policy, "EZconvy," "we," "us," and "our" refer to EZCONVY TECHNOLOGIES (PRIVATE) LIMITED. An organization, institution, transport operator, driver, or third-party service may also process information under its own terms and privacy practices when it acts independently of EZconvy.

Depending on how you use the Services, we may collect:

• Account and contact information: name, email address, phone number, profile image, account role, login provider, and account identifiers.
• Identity and eligibility information: institution or organization affiliation, verification status, and—where needed for driver onboarding or lawful operations—CNIC, licence, vehicle, or supporting-document information.
• Journey and service information: pickup and destination names and coordinates, requested times and days, routes, stops, service areas, memberships, proposals, trip assignments, attendance, cancellations, incidents, feedback, and support history.
• Payment information: invoices, amounts, service month, selected payment method, transfer reference, receipt image, submission and review status, credits, adjustments, refunds, and related audit records. Do not submit bank passwords, PINs, card secrets, or unrelated financial information in a receipt.
• Carpool information: ride offer or request, pickup and destination, travel date and time, seats, suggested contribution, contact number, notes, interests, messages, and post status.
• Device and technical information: app and device type, operating-system and app version, push-notification token, IP address and request metadata, authentication and security events, crash reports, diagnostics, and performance information.
• Public-form information: information submitted through route-launch, route-request, waitlist, institution, sales, support, and account-deletion forms.

The Rider app may access precise or approximate location after permission is granted—for example, when you use your current location, choose a point on a map, search nearby transport, submit a journey, or view live trip tracking. The Rider app is not designed to collect a rider's location continuously in the background.

The EZ Bus driver app may collect precise location, including in the background, while an authorized driver is operating an active assigned trip. That location may be shown to the relevant riders and to authorized EZconvy, organization, or transport-operations personnel for dispatch, trip visibility, safety, support, and incident review. Location sharing is intended to stop when the trip ends, is cancelled, or tracking is otherwise stopped.

Location permissions can be changed in device settings. Disabling them may limit maps, nearby results, location selection, or live tracking. A location already submitted as a pickup, destination, stop, route request, Carpool post, or trip record remains part of that record even if device permission is later disabled.

We may receive information from:

• Google or Apple when you choose social sign-in, such as a provider account identifier, name, email address, verification state, or an Apple private-relay address. We do not receive your Google or Apple password.
• Organizations, institutions, transport operators, drivers, riders, or account owners who arrange or manage a service involving you.
• Map and place providers, public-transport feeds, device platforms, notification providers, and other integrations used to deliver a feature you request.
• Other users, such as when someone expresses interest in a Carpool post, reports an incident, or provides feedback relating to a trip.

We use information to:

• Create, authenticate, secure, support, and administer accounts.
• assess route feasibility; prepare journeys, stops, schedules, and proposals; operate trips; and provide relevant information to riders, drivers, and operations teams.
• create and manage memberships, invoices, payment submissions, payment verification, boarding authorization, cancellations, credits, and refunds.
• publish and manage Carpool posts and interests, provide public-transport information, and support institution or organization access.
• send service, safety, account, payment, trip, support, and—where permitted—marketing communications.
• prevent duplicate or fraudulent receipts, misuse, unauthorized access, unsafe conduct, and other violations; investigate incidents and resolve disputes.
• diagnose failures, monitor performance, improve the Services, create aggregate or de-identified analytics, and comply with applicable law or lawful requests.

Depending on applicable law and the context, we process information to provide a requested service, with consent, for legitimate operational and safety purposes, or to comply with a legal obligation.

We may share information only as reasonably needed with:

• Riders and drivers: trip participants may receive names, assigned trip, stop, attendance, contact, vehicle, driver, and live-location information needed to coordinate an authorized journey.
• Operations, organizations, and institutions: authorized personnel may access information needed to assess requests, verify eligibility or payments, plan routes, assign vehicles and drivers, operate trips, support users, and address safety or compliance matters.
• Carpool users: active Carpool posts may display the poster's name, profile image, journey details, contact number, seats, contribution, notes, and interest count. Information you place in a Carpool post should be treated as visible to other authenticated Carpool users and, when shared through a link, potentially to link recipients.
• Service providers: providers supporting hosting, databases, authentication, maps and places, notifications, communications, app delivery, security, diagnostics, and customer support process information for us under their applicable terms and safeguards.
• Authorities and professional advisers: where reasonably necessary to comply with law, respond to lawful process, protect rights or safety, investigate fraud or abuse, or establish and defend legal claims.
• Business transactions: information may be disclosed as part of a financing, restructuring, merger, acquisition, or sale, subject to appropriate confidentiality and applicable law.

We do not currently sell personal information to data brokers or share it for third-party cross-context behavioural advertising.

Bank-transfer details and receipt images are used to review payment claims, prevent duplicate submissions, reconcile invoices, authorize service, handle refunds or disputes, and maintain financial and audit records. A receipt may contain information you choose to include, so crop or redact unrelated balances, transactions, account numbers, and personal details where possible before uploading it.

Payment proof is accessible only through authorized workflows, but it may be reviewed by approved EZconvy or organization personnel responsible for payment operations. Submitting proof does not itself confirm payment or authorize boarding.

Our websites and portals may use cookies or browser storage that are necessary for login, security, preferences, and core functionality. Mobile apps may use secure device storage, local caches, and identifiers needed for login, app updates, notifications, reliability, and performance. We do not currently operate an advertising network in the Services.

We may send transactional messages through in-app notifications, push notifications, email, phone, or WhatsApp where available. You can control push permissions in device settings. Essential account, safety, payment, and service communications may still be sent through another available channel. Marketing messages will include a reasonable opt-out where required.

Our providers may include Google and Apple for sign-in or device services, Google Maps and Places for maps and search, Expo for app updates and push delivery, Meta/WhatsApp for supported communications, Sentry for error diagnostics, and hosting or database providers. The exact providers may change as the Services evolve.

Some providers may process information outside Pakistan. Where cross-border requirements apply, we take reasonable steps appropriate to the provider relationship and applicable law. We do not promise that every item of information is stored in Pakistan unless a particular feature expressly says so. Third-party services are also governed by their own privacy policies.

We retain information for as long as reasonably needed for the purpose for which it was collected, including to provide the Services, keep operational and financial records, prevent fraud, resolve disputes, enforce agreements, support safety investigations, and meet legal, tax, accounting, or regulatory requirements.

• Account and profile information is generally retained while the account is active and during the account-deletion period.
• Detailed driver trip-location history is ordinarily retained for up to 30 days, unless a longer period is reasonably needed for an incident, dispute, fraud review, safety matter, or legal obligation.
• Membership, trip, attendance, payment, receipt, refund, safety, support, and audit records may be retained longer where reasonably required for operational integrity or law.
• Carpool posts expire or can be cancelled in the user interface, but limited records may remain for safety, abuse prevention, dispute handling, and audit purposes.
• De-identified or aggregated information that no longer reasonably identifies a person may be retained for analytics and service planning.

You may request account deletion in the app or at our account-deletion page. A request made from a signed-in app is currently marked with a deletion date 30 days after the request. A website request may require identity verification before it is attached to an account. Actual processing may require us to protect the account from unauthorized deletion and complete necessary operational or legal steps.

On completion, we delete or de-identify personal information associated with the account except information we reasonably need to retain for legal obligations, payment and tax records, fraud prevention, safety, dispute resolution, security, or enforcement. Deletion does not remove information another user lawfully holds outside the Services, and may not immediately remove encrypted backup copies that are isolated and later overwritten in the ordinary course.

Subject to the Services and applicable law, you may:

• review and update available profile and journey information;
• change location, photo, and notification permissions in device settings;
• cancel or edit supported memberships, route requests, or Carpool posts;
• opt out of non-essential marketing communications;
• request access to, correction of, or deletion of personal information; and
• withdraw consent where processing relies on consent.

We may need to verify your identity and may limit or decline a request where permitted or required by law, where fulfilling it would affect another person's rights, or where records must be preserved for legitimate legal, safety, payment, fraud, or dispute purposes.

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These may include role-based access, authentication controls, transport encryption, credential hashing, restricted payment-proof access, monitoring, and operational logging. No service, device, storage system, or internet transmission can be guaranteed completely secure. Keep your device and credentials protected and tell us promptly if you suspect unauthorized account use.

EZconvy accounts are not intended to be created independently by a person under 18. Where EZconvy expressly supports a parent, legal guardian, or authorized institution arranging transport for a minor, that adult or institution is responsible for providing required authority and accurate information. If we learn that a child created an account or provided personal information without appropriate authorization, we may suspend the account and delete or restrict the information as appropriate.

We may update this policy as the Services, providers, or legal requirements change. The latest version will be posted here with its effective date. If a change materially affects how we use personal information, we will provide additional notice or obtain consent where required by applicable law. Earlier versions may be requested from us where available.

For privacy questions, account or data requests, or concerns about this policy, contact contact@ezconvy.com. Please do not email passwords, PINs, complete bank details, or unnecessary identity documents.