Data safety

• Your name, phone number, and email address if you choose to add one.
• Precise and approximate location, while the app is open — to set your pickup point, search destinations, show nearby drivers, estimate the fare and follow the trip. The passenger app does not collect location in the background.
• Trip and parcel records: pickup, drop-off, date, time, vehicle type and fare.
• Messages you send the driver in the in-app chat.
• Payment records for completed trips, and any Sura wallet balance.
• Device model, operating system, app version and a push-notification token.
• App-usage and crash information — which you can switch off in Settings → Analytics sharing.

We collect no card or bank details: trips are paid in cash or from a Sura wallet balance. In-app voice calls are never recorded or stored.

Everything in section 1 except app-usage analytics, which the Sura Driver app does not collect at all. In addition:

• Precise location the whole time you are online, including while the app is in the background or the screen is off. This is what matches you with nearby riders and lets a rider watch you approach. It stops when you go offline.
• Your driving licence, national ID or passport, profile photo, and photos of your vehicle, number plate and logbook. Insurance, roadworthiness and police-clearance documents may also be submitted.
• Vehicle details, and your verification status and history.
• Earnings, any commission owed, and payout records.

Google Play draws a line between data that is *shared* with another company and data handled by a processor acting on our instructions. We answer it this way:

• Shared: your first name and your live location, with the driver matched to your trip — and the driver's name, photo, vehicle and live position with you. A driver is an independent contractor, not a company processing data for us, so this is genuine sharing and we declare it as such.
• Processed on our behalf: everything else. HERE (maps, search, routing), Google Firebase (push notifications, crash reporting, and usage analytics in the passenger app only), Agora (live in-app voice calls, never recorded), Twilio (verification codes, when our own South Sudanese SIM gateway cannot send them), Cloudinary (driver documents and photos), Brevo (service emails), and MongoDB Atlas and Railway (database and server hosting). None of them may use your data for their own purposes.

We do not sell your data. We use no advertising networks and no data brokers, and neither app collects an advertising ID.

• Everything the apps and this website send to our servers travels over encrypted connections (HTTPS/TLS). Neither app permits unencrypted traffic.
• Sign-in tokens are held in encrypted storage on your device.
• Verification codes expire five minutes after they are sent and cannot be reused.
• Neither app is backed up to cloud storage or copied by device-to-device transfer, so your history is not carried off your phone that way.
• Inside Sura, access to operational data is restricted by role and recorded in an audit log.

No system is perfectly secure, but if a breach ever affects your personal data we will tell you.

You can delete your account and personal data from inside either app, from this website, or by email — and you can ask for specific data to be removed without closing your account at all.

The account deletion page sets out each route, exactly what is erased, what has to be kept (financial records required by law, held without your name or number attached) and how long the process takes.

Sura is not for anyone under 18, and we do not knowingly collect data about children. If you believe someone under 18 has an account, tell us at [email protected] and we will remove it.