Data Retention & Deletion Policy

Effective date: 09-21-2026 · Version: 1.2 · Contact: support@drivio.pk · Companion to the Privacy Policy.

---

1. How to delete your account and your data

You can delete your Drivio account yourself, from inside the app. Deletion is immediate and permanent — there is no waiting period and no way to undo it.

1.1 In the app (customers and riders)

Profile → Edit profile → Delete account.

The app asks you to confirm, then deletes the account. Your profile, ride history, rider registration and uploaded documents, saved places, synced contacts, wallet and login are removed as described in §2.

Before you delete, note:

• Withdraw any money in your wallet first. A balance left behind cannot be reached after deletion.
• The app will refuse to delete the account while it is still holding something that belongs to someone else — a ride in progress, a booked pool seat, a live Pickup & Drop service, a wallet balance or debt, or a top-up or withdrawal awaiting approval. It tells you which one, and deletion succeeds once that is finished or cancelled.

1.2 By email

If you cannot sign in — a lost phone number, a device you no longer have, or a merchant account, which has no in-app delete button — email support@drivio.pk from any address, asking for your account to be deleted and giving the mobile number the account is registered to.

We verify that the request is yours by sending a one-time code to that number (or, where the account signs in by email, to the registered address). We cannot act on an unverified request — that protection is what stops someone else deleting your account.

We respond to an emailed request within 30 days (Privacy Policy §8) and complete a verified deletion within 90 days of the request. An in-app deletion (§1.1) is immediate and needs none of this.

1.3 What happens on a verified request

We disable the account immediately; cancel open bookings under the Refund & Cancellation Policy; pay out any withdrawable balance; and delete or anonymise your personal data as set out in §2 and §3 — except records under statutory retention (the ledger row in §3), which are deleted when their period expires.

2. What is deleted, what is kept

2.1 Deleted

Removed outright when the account is deleted:

• Your profile — name, photo, gender, phone, email, roles and settings.
• Your rider record and its whole tree: registration drafts, per-service registrations and their review history.
• Every document image you uploaded — CNIC, driving licence, vehicle registration, police certificate, vehicle and profile photos.
• Your wallet, ratings, referral record and referral code.
• Your saved pool and rental templates, and your published rental listing.
• Your notifications and push tokens.
• Your synced address book and the record that you synced it. Those rows name people who never signed up for Drivio; once you are gone, we have no reason to hold them.
• Your live location state.
• Your sign-in identity records, saved OTP channel preference, and every active session — after this, no Google, email or phone sign-in resolves to your account.
• Your Firebase Authentication user.

2.2 Kept, and why

• Ride, pool and rental records are kept for the period in §3. A completed trip is also the other party's record, and they are entitled to it. Your identifiers are removed from it as described in §2.3.

• The financial ledger and payment settlement records are kept for 6 years under statutory accounting and tax requirements.

• A deletion audit record. We keep a minimal record that the account existed and was deleted: the public account ID, name, phone, email, gender, roles, rider status and vehicle details, rating summary, wallet balance at the moment of deletion, and the dates the account was created and deleted. It exists to answer "whose account was this, and when did it go" — for dispute resolution, fraud prevention and our own accountability — and it is readable only by senior administrators, never by any app.

  It deliberately never contains your CNIC, date of birth, home address, emergency contact, or any of your identity document images. Those are destroyed with the account.

2.3 Anonymisation

Where a record must survive the account — the financial ledger, and ride records within their retention period — we remove or replace the direct identifiers in it (name, phone, photo, document images) and keep only the transactional facts required by law or by the other party's own history, keyed to a non-identifying reference.

3. Retention schedule

Data category	Where	Retention	Reason
Account profile (users/{uid}: phone, name, photo, roles)	Firestore	Life of account; deleted immediately on an in-app deletion, and within 90 days of an emailed deletion request	Service provision
Rider KYC record (riders/{uid})	Firestore	Active rider + 12 months after deactivation	Safety, dispute & regulatory defence
KYC document images (CNIC, licence, vehicle registration, police certificate)	Cloud Storage	Same as KYC record; 30 days after a rejected application	Verification evidence
Ride / pool / rental records	Firestore	12 months after completion, then deleted or irreversibly anonymised (kept only as aggregate statistics)	Disputes, support, analytics
Chat messages (rideChats/{rideId})	Realtime DB	90 days after ride completion	Dispute evidence
Live GPS (driverLocations/{riderId})	Realtime DB	Transient — overwritten continuously; cleared when the rider goes offline	Live tracking only
Wallet balances	Firestore	Life of account; paid out/zeroed at closure	Prepaid value
Transaction ledger & payment settlement records	Firestore	6 years	Statutory accounting/tax; fraud investigation
Push tokens	Firestore	Until logout/uninstall-detected or account deletion	Notifications
Deletion audit record (deletedUsers, §2.2)	Firestore	Retained as a permanent audit record, minimised as described in §2.2	Accountability, fraud prevention, dispute resolution
Technical logs	Firebase	90 days	Debugging, security
OTP verification data	Firebase Auth	Managed by Firebase Authentication per its policy	Authentication

Backups expire on the backup provider's cycle (target ≤ 35 days); deleted data may persist in backups until that cycle completes.

Coordinates sent to Google Maps Platform (Google LLC) to render map tiles and Static Maps images are processed by Google as a service provider and are not a data store retained by Drivio; they are not kept by us beyond the categories above.

4. Admin & operational access

• KYC images: readable only by the data subject and administrators (enforced by Storage rules).
• Payment settlement records: administrators only; never client-readable.
• The deletion audit record (§2.2): readable only by senior administrators; no client of any kind can read, write or erase one.
• Deletion operations are performed with the Admin SDK by authorised personnel and logged.

5. Review

This schedule is reviewed at least annually and whenever a new data category (e.g. payment gateway data) is introduced.

6. Contact

Manwaj Solutions (Private) Limited — operator of the Drivio platform House No. 42/A, Survey No. 331, Saleem Housing Society, Malir Halt, Karachi, Pakistan Data protection contact: support@drivio.pk