What we collect
- Account details: name, email, phone (optional), language and preferences.
- Journeys and tickets: searches, bookings, tickets, validations and refunds.
- Location: only while you use journey features, or in the background if you allow destination alerts.
- Accessibility needs you choose to share — shared with an operator only for a booked trip and only with your consent.
- Payments: handled by regulated payment providers; we keep tokens, never your full card number.
- Assistant and voice: your questions and the assistant's answers; voice recordings only if you turn them on.
- Developer platform: apps, API keys (stored as hashes) and usage.
How long we keep it
Location history: 90 days. Payment records: up to seven years for tax law. Support conversations: two years. Everything else: for as long as your account is open, then deleted or anonymised.
Legal bases (GDPR)
- Contract: tickets, bookings, journeys and support.
- Legal obligation: tax and accounting records, safety reports required by law.
- Legitimate interests: fraud prevention, service reliability and security — balanced against your rights.
- Consent: location while the app is in the background, marketing, AI personalisation and sharing accessibility needs with operators. You can withdraw consent at any time.
International transfers
Your data is processed in the EU region. Where a processor outside the EEA is used, we rely on an adequacy decision or the European Commission's standard contractual clauses with a transfer impact assessment.
Data protection officer and authority
Contact our DPO at dpo@teletransit.example. You may complain to your local supervisory authority.
Your rights
You can see, download, correct and delete your data, and object to or restrict some uses. Use Profile › Privacy in the app or write to privacy@teletransit.example. We answer within 30 days, or sooner where your local law requires (for example seven days in Kenya). Your export is ready to download for 30 days.
Sharing
We share data with the operator that carries you, payment providers, and service providers bound by contract. We never sell identifiable movement data; operators and cities only receive aggregated, privacy-preserving statistics.
Security
Data is encrypted in transit and at rest; access is limited by role, recorded in an audit trail and reviewed.