Privacy Policy

Sura is operated by Sura Ride Technologies, a company based in Juba, South Sudan. In this policy “Sura”, “we” and “us” mean Sura Ride Technologies. We provide the technology that connects passengers with independent drivers; we do not employ drivers.

For anything in this policy — including a request to see or delete your data — contact [email protected].

• Your name, used to identify you to the driver who accepts your trip.
• Your mobile number. This is your account identity and is verified by a one-time code (OTP) when you sign in.
• Your email address, only if you choose to add one.
• Precise and approximate location, to set your pickup point, search destinations, show nearby drivers, estimate the fare and follow the trip.
• Trip and parcel records: pickup and drop-off, date, time, vehicle type and fare.
• Messages you send the driver in the in-app chat, kept with that trip.
• Payment records for completed trips and any Sura wallet balance.
• Your device model, operating system and app version, and a push-notification token.
• App-usage and crash information, which you can switch off — see section 8.

We do not collect card or bank details. Sura trips are paid in cash or from a Sura wallet balance. We do not record or store any voice call made through the app.

Everything in section 2 applies, except app-usage analytics, which the Sura Driver app does not collect at all. In addition we collect:

• Your precise location continuously while you are on duty, so you can be matched with nearby passengers and so a passenger can watch you approach. This stops when you go offline.
• Your driving licence, national ID or passport, profile photo, and photos of your vehicle, number plate and logbook. Insurance, roadworthiness and police-clearance documents may also be submitted.
• Your vehicle details and your verification status and history.
• Your earnings, any commission owed and payout records.

When you sign in here we store one cookie, named sura_session. It holds your sign-in token, is readable only by our server, and expires after 30 days or when you sign out. It exists solely to keep you signed in.

We set no other cookies, and this website runs no advertising pixels and no cross-site trackers.

Cloudflare, which serves and protects this website, provides a cookieless page-view measurement (Cloudflare Web Analytics). It records page views and performance timings without setting a cookie and without building a profile of you. Cloudflare also sees the IP address of every request, because it has to in order to deliver the site.

• To connect passengers with drivers and to complete trips and parcel deliveries.
• To estimate fares, plan routes and show live positions during a trip.
• To verify your phone number when you sign in.
• To send you notifications about a trip.
• To take payment, record commission and keep the financial records the law requires.
• To review driver documents and decide whether to approve a driver.
• To answer support requests and investigate complaints and safety reports.
• To detect and prevent fraud and misuse of the platform.
• To keep the apps reliable and diagnose faults.

When a driver accepts your trip, that driver sees your first name, your pickup point and your destination, and can message or call you inside the app. Drivers do not see your phone number, your email address or your payment details. In-app calls connect through our voice provider so neither side sees the other's number.

During a trip the passenger sees the driver's name, photo, vehicle and live position.

A driver is an independent contractor, not a company processing data on our behalf, so this exchange is a genuine sharing of data and we declare it as such.

Sura staff can see operational records — trips, documents and financial entries — under internal access controls, in order to run and support the service.

These companies handle data strictly on our instructions, to run the service. They are not permitted to use it for their own purposes:

• HERE — maps, search and routing. Receives location coordinates.
• Google Firebase — push notifications and crash reporting, and app-usage analytics in the passenger app only.
• Agora — carries live in-app voice calls. Calls are not recorded or stored.
• Twilio — sends verification codes when our own SIM gateway cannot. Most codes are sent from a local South Sudanese SIM that we operate ourselves.
• Cloudflare — serves and protects this website and our API, and provides the cookieless page-view measurement described in section 4. It sees the IP address of every request.
• Cloudinary — stores the verification documents drivers upload (licence, national ID and vehicle papers). Files are uploaded privately and are not reachable from a public link.
• Brevo — sends service emails.
• MongoDB Atlas and Railway — host our database and servers.

We do not use advertising networks or data brokers, and neither app collects an advertising ID.

In the passenger app, Settings → Analytics sharing turns off app-usage analytics and crash reporting. The Sura Driver app does not collect usage analytics at all.

You can refuse or later withdraw location permission in your phone's settings, but the service cannot function without it: a passenger cannot be collected and a driver cannot be dispatched without a location.

You can turn off notifications in your phone's settings; you may then miss trip updates.

Everything the apps and this website send to our servers travels over encrypted connections (HTTPS/TLS); neither app permits unencrypted traffic. Sign-in tokens are held in encrypted storage on your device. Verification codes expire five minutes after they are sent and cannot be reused. Neither app is backed up to cloud storage, so your trip history is not copied off the device that way.

Access to operational data inside Sura is restricted by role and recorded in an audit log. No system is perfectly secure, but if a breach ever affects your personal data we will tell you.

You can delete your account at any time — in the passenger app under Account, in the Sura Driver app under Account settings, or at surarider.com/legal/delete-account.

Deleting erases immediately, with no recovery period: your name, phone number and email; your profile photo and saved places; your trip and parcel history; scheduled rides; your push token; and for drivers your licence and ID documents, vehicle details and verification history.

Records of completed payments and driver commission are kept, with your name and phone number removed. Financial records are required by law and are held in an append-only ledger that cannot be altered. Support tickets are kept with your name and number removed.

Deleting your account does not refund a wallet balance and does not cancel money you owe. The app tells you before you confirm if either applies.

Signing out is not deletion — it only ends the session on that device.

If you cannot reach the app at all, email [email protected] from your registered address or quoting your registered number. We confirm the request is genuinely yours and complete it within 30 days.

You may ask us to give you a copy of the personal data we hold about you, correct anything inaccurate, or delete your account and personal data. You may withdraw consent by deleting your account and no longer using Sura.

Write to [email protected]. We verify that a request comes from the account holder before acting on it, and respond within 30 days.

Sura is not for anyone under 18. We do not knowingly collect data about children. If you believe someone under 18 has an account, tell us at [email protected] and we will remove it.

If we change this policy in a way that materially affects you, we will tell you in the app before the change takes effect. The date at the top of this page always shows when it was last revised.

Sura Ride Technologies — Juba, South Sudan.

• Privacy and data requests: [email protected]
• General support: [email protected]