Zidi Privacy Policy
Last updated 12 October 2026
Who we are
Zidi Mobility Ltd ("Zidi", "we") runs a car rental marketplace in Eldoret, Kenya, and decides how the personal data described here is used. This policy covers the Zidi Rentals app, the Zidi Host app and zidimobility.co.ke.
Zidi connects people who rent cars ("renters") with people who rent out their cars ("hosts"). To do that safely we need to know who you are, check your ID, take payments and send money back out.
What we collect
We collect what you give us in the apps, what happens on your bookings, and what our payment and messaging partners tell us. We do not track your location, read your contacts, or show you ads.
| What | Examples | From whom |
|---|---|---|
| Account | Phone number, full name, the one-time codes we text you to sign in | Renters and hosts |
| ID check | ID type (national ID or passport), ID number, name as on the ID, photos of both sides of the ID, a photo of your driving licence, a selfie | Renters and hosts |
| Cars | Make, model, year, number plate, daily rate, car type, pick-up place (a town and area from Zidi's list), car photos, car documents, your rules for the car ("host terms") | Hosts |
| Bookings | Dates, the car, where you plan to drive (the host sees this before approving), messages about the booking, cancellation reasons, reasons and photos when a car is rejected at pick-up, the pick-up code, no-show reports and the renter's answer to them | Renters and hosts |
| Ratings | Stars (1 to 5) and an optional comment after a trip: renters rate the car, hosts rate the renter. Reports of comments that break the rules | Renters and hosts |
| Searches | The place and dates you searched in Zidi Rentals, kept without your name or phone number. If you ask to be texted when cars are listed in a town: that town | Renters |
| M-Pesa payments | The phone number you paid from, amounts, M-Pesa receipt numbers | Renters |
| Card payments | Amount, card fee, Paystack's reference and receipt. Paystack handles your card details; Zidi never sees your full card number | Renters |
| Withdrawals | Your M-Pesa number and the name M-Pesa holds for it, amounts and receipts | Hosts |
| Texts and notifications | Texts we sent you and whether they arrived; a notification token for each phone where you allowed notifications | Renters and hosts |
| Technical | Sign-in records kept by our hosting provider, such as the time and IP address | Renters and hosts |
For card receipts, Paystack needs an email address. If you haven't given us one, we send Paystack an address made from your phone number at our own domain, such as [email protected].
Location. The Near me button in Zidi Rentals uses your phone's approximate location to find the closest town or area on Zidi, and searches there. Your location stays on your phone: Zidi never receives or stores it. Your phone asks your permission the first time.
How we use it, and why we may
We use your data to run bookings and payments, keep renters, hosts and cars safe, and meet the law. Kenya's Data Protection Act, 2019 lets us do this on the grounds below.
| Use | Data used | Ground under the Act |
|---|---|---|
| Sign you in and keep your account | Phone number, name, sign-in codes | Needed to provide the service you asked for (contract) |
| Check who you are before you rent, host or withdraw | ID details and photos, licence, selfie | Contract; preventing fraud and car theft (legitimate interest) |
| Show hosts' cars to renters, so they can choose a car and check it before they book | Car details and photos, number plate, pick-up area, the host's first name and last initial | Needed to provide the service hosts asked for (contract); helping renters check a car before they hire it (legitimate interest) |
| Run bookings: requests, approvals, the rental agreement, pick-up, cancellations | Booking details, host terms, pick-up photos | Contract |
| Show ratings, so renters can choose cars and hosts can choose renters | Stars, comments, first name and last initial | Helping renters and hosts trust each other (legitimate interest) |
| Find cars near a place and free on your dates; count searches by town, to know where to find more hosts | The place and dates searched (no name or phone) | Providing the service you asked for; planning where Zidi grows (legitimate interest) |
| Text you when cars are listed in a town you asked about | Phone number, the town | Consent: you ask for it, and can ask us to stop |
| Take payments, send refunds, pay hosts | Payment and withdrawal details | Contract; keeping accurate financial records (legal obligation) |
| Check that an M-Pesa name matches the host's ID before paying out | Name on ID, name M-Pesa holds | Preventing fraud (legitimate interest) |
| Tell you what's happening by text and app notification | Phone number, notification token, booking details | Contract; app notifications only if you allow them (consent) |
| Spot misuse, such as repeated rejections or no-shows, and pause accounts or cars | Booking history | Safety and fraud prevention (legitimate interest) |
| Keep tax and accounting records, and answer lawful requests from authorities | Payment records, booking records | Legal obligation |
We don't sell your data, and we don't use it for advertising. If we ever want to send marketing messages, we will ask first.
Who we share it with
We share only what each side of a booking needs, and only with partners who help us run Zidi. ID photos and selfies are seen by Zidi's team alone.
The other side of your booking
- Hosts see the renter's first name and last initial, and whether their ID is verified. Once the booking is paid, they also see the renter's phone number.
- Once a booking is paid, the host also sees the renter's name as on their ID, the ID type and the last 4 characters of the ID number: in the rental agreement, and to check them at pick-up. Hosts never see ID photos, licence photos or selfies.
- If a renter rejects a car at pick-up, the host sees the reason and the photos taken.
- Renters see the host's first name and last initial, the car with its number plate, its pick-up area and the host's terms. Car listings, plates included, are public: anyone using Zidi Rentals sees them, signed in or not. Once the booking is paid, they also see the host's phone number. If a host cancels, the renter sees the reason the host gave.
- Once a booking is paid, both sides can open its rental agreement, a PDF Zidi makes from the booking. It names the renter and the host, and gives the car, the dates, where the renter said they would drive, the price and payments, and the rules both agreed to. It shows both phone numbers while the booking is on. Zidi doesn't keep the PDF: it is made again each time it's opened.
- When a renter asks for a car, the host sees the renter's average rating from hosts and how many trips it comes from, not who gave which rating. A host's note about a renter is read only by Zidi.
- A renter's rating of a car shows on the car's page with their comment, first name and last initial, to anyone who opens Zidi. Once you delete your account, your ratings show without your name.
Partners who process data for us
| Partner | What they do for Zidi | What they receive |
|---|---|---|
| Supabase | Hosts our database, files, sign-in and server code | Everything described in this policy |
| Safaricom (M-Pesa) | Takes M-Pesa payments, sends refunds and host withdrawals | Phone numbers, amounts, booking references |
| Paystack | Takes card payments and sends card refunds | Amounts, booking references, the email described above; your card details go straight to Paystack |
| HostPinnacle | Sends our texts | Phone numbers and message text |
| Google (Firebase Cloud Messaging) and Apple | Deliver app notifications | Notification tokens and message text |
Each partner handles data under its own privacy terms and only to provide its service to Zidi.
Others, when needed
We may share data with the police, courts, the Kenya Revenue Authority or the Data Protection Commissioner when the law requires it. We may also share it to protect someone's safety or property, for example after an accident or a car theft. Our lawyers and auditors may see it under a duty of confidence.
Where your data is kept
Your data is stored with Supabase in the United States, so it is kept outside Kenya. Some partners also process it abroad: Paystack in Nigeria, Google and Apple in the United States and elsewhere.
The Act allows transfers outside Kenya only with proper safeguards. We rely on our partners' data protection terms and safeguards and give you the same protection wherever your data is held.
How long we keep it
We keep data only as long as we need it for the reason we collected it, or as long as the law requires.
| Data | Kept for |
|---|---|
| ID photos, licence photo, selfie and car documents | While your account is open; deleted 90 days after you close it, unless needed for an open dispute or fraud case |
| Account details (name, phone) | While your account is open, then 12 months |
| Booking, payment, refund and withdrawal records | At least 5 years after the booking, as Kenyan tax law requires business records to be kept |
| Ratings and comments | As long as the booking records. Once you delete your account, they show without your name. Zidi takes down comments that are rude, untrue or share someone's personal details |
| Searches (place and dates, no name or phone) | 24 months |
| Requests to be texted when cars are listed in a town | Until we send the text, then 12 months. Closing your account cancels the text |
| Photos taken when a car is rejected at pick-up | 6 months after the booking, longer if there is a dispute |
| Texts we sent you | 6 months |
| App notification tokens | Until you sign out, or the phone stops accepting notifications |
| Sign-in records | As long as our hosting provider keeps them (6 months) |
Zidi's accounts ledger can't be edited once written, so money records stay complete. They hold account references and amounts, not your ID details.
How we protect it
Your data travels over encrypted connections, and each person can open only their own records. ID photos sit in private storage that only Zidi's team can open.
- The apps can read only the signed-in person's own account, bookings and payments, enforced by the database itself.
- Hosts get ID details only for their own paid bookings, and only the few details listed above.
- Payment and messaging keys are kept on Zidi's server, never in the apps.
- Zidi never stores card numbers: Paystack collects them on its own secure page.
- Only named Zidi staff can review IDs and fix payments.
No system is perfectly secure. If a breach puts your data at risk, we will inform you and the Data Protection Commissioner as the Act requires.
Your rights
You can ask us at any time what data we hold about you, and have it corrected or deleted. Under the Act you also have the right to:
- be told how your data is used (this policy);
- get a copy of your data, and have it in a form you can take elsewhere;
- have wrong or misleading data corrected or deleted;
- object to us using your data, or to parts of that use;
- withdraw consent you gave, such as turning off app notifications in your phone's settings;
- have a person review decisions about you. Automatic flags, such as a renter rejecting cars twice in 60 days, are always reviewed by Zidi's team before any action.
You can delete your account yourself in either app: Account, then Delete my account. It closes at once, and we delete your data on the schedule above. You can also ask us to delete it at zidimobility.co.ke/delete-account. To use your other rights, email [email protected] or call 0715296479. We will confirm it's you with a code sent to your phone, and reply within 48 hours.
We may need to keep some data even when you ask us to delete it: records the tax law requires, and anything tied to an open booking, payment or dispute. We will tell you what we kept and why.
If you're unhappy with how we handled your data, you can complain to the Office of the Data Protection Commissioner.
Age, changes and contact
Zidi is for adults: you must be at least 21 to use it, and renters must hold a valid driving licence. We don't knowingly collect data about children; if we learn we have, we delete it.
When we change this policy, we'll update the date at the top. If a change affects how we use your data, we'll tell you by text or in the apps before it takes effect.
Contact: Zidi Mobility Ltd, 30100, Eldoret, Kenya. Email [email protected], phone 0715296479.