Data protection
Last updated 28 October 2026
Zidi Mobility Ltd decides how your personal data is used in the Zidi Rentals and Zidi Host apps and on this website. This page sums up your rights and how we look after your data. The full details are in our Privacy Policy, which applies if anything here differs.
What we hold, in short
- Your account: phone number and full name.
- Your ID check: your ID details and photos, a photo of your driving licence and a selfie.
- Hosts' cars: details, photos, documents and rules.
- Bookings, payments, refunds, withdrawals and ratings.
We do not track your location, read your contacts, or show you ads. We don't sell your data, and we don't use it for advertising. ID photos and selfies are seen by Zidi's team alone: hosts never see them.
Your rights
Under Kenya's Data Protection Act, 2019 you have the right to:
- be told how your data is used (our Privacy Policy);
- get a copy of your data, and have it in a form you can take elsewhere;
- have wrong or misleading data corrected or deleted;
- object to us using your data, or to parts of that use;
- withdraw consent you gave, such as turning off app notifications in your phone's settings;
- have a person review decisions about you. Automatic flags, such as a renter rejecting cars twice in 60 days, are always reviewed by Zidi's team before any action.
How to use them
- Delete your account yourself in either app: Account, then Delete my account. It closes at once, and we delete your data on the schedule below. You can also ask us to delete it: see Delete your account.
- For your other rights, e-mail privacy@zidimobility.co.ke or contact Zidi. We confirm it's you with a code sent to your phone, and reply within 48 hours.
We may need to keep some data even when you ask us to delete it: records the tax law requires, and anything tied to an open booking, payment or dispute. We will tell you what we kept and why.
How long we keep it
| Data | Kept for |
|---|---|
| ID photos, licence photo, selfie and car documents | While your account is open; deleted 90 days after you close it, unless needed for an open dispute or fraud case |
| Account details (name, phone) | While your account is open, then 12 months |
| Booking, payment, refund and withdrawal records | At least 5 years after the booking, as Kenyan tax law requires business records to be kept |
| Searches (place and dates, no name or phone) | 24 months |
| Photos taken when a car is rejected at pick-up | 6 months after the booking, longer if there is a dispute |
| Texts we sent you | 6 months |
The Privacy Policy lists everything else we keep, and for how long.
Where it's kept, and how we protect it
Your data is stored with Supabase in the United States, so it is kept outside Kenya. Some partners also process it abroad: Paystack in Nigeria, Google and Apple in the United States and elsewhere. We rely on our partners' data protection terms and safeguards, and give you the same protection wherever your data is held.
- Your data travels over encrypted connections, and the apps can read only the signed-in person's own account, bookings and payments, enforced by the database itself.
- ID photos sit in private storage that only Zidi's team can open, and only named Zidi staff can review IDs and fix payments.
- Zidi never stores card numbers: Paystack collects them on its own secure page.
No system is perfectly secure. If a breach puts your data at risk, we will inform you and the Data Protection Commissioner as the Act requires.
Complaints
If you're unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner. You can also write to us at privacy@zidimobility.co.ke.