Hail-O (Pty) Ltd | Registration No. 2026/298023/07 | Last updated and effective: 25 September 2026
Our promise in plain language. Hail-O is a women-only e-hailing service built around safety. Protecting your personal information is part of keeping you safe, so we treat it with the same care we expect from every driver on our platform. We collect only what we need to connect riders with drivers, verify who is on the platform, keep trips safe, pay drivers, and meet South African law. We never sell your personal information, and we do not share it with advertisers or advertising networks. You can ask to see, correct or delete your information at any time by emailing admin@hailoapp.co.za or calling +27 75 475 9707.
Hail-O (Pty) Ltd ("Hail-O", "we", "us" or "our") is a South African private company that operates a women-only electronic hailing (e-hailing) platform connecting women riders with women drivers. For the purposes of the Protection of Personal Information Act 4 of 2013 (POPIA), Hail-O is the responsible party for the personal information described in this policy.
This policy applies to everyone whose personal information we process, including:
• Riders who use the Hail-O Rider app on iOS or Android;
• Drivers and driver applicants who use the Hail-O Driver app or apply to drive with us;
• Visitors to our website at hailoapp.co.za; and
• anyone who contacts us by email, WhatsApp, telephone or social media, or who is named as a trusted or emergency contact.
Together, the website and apps are our "Services". This policy should be read with our Terms of Service. It is written to comply with POPIA and its Regulations, the Promotion of Access to Information Act 2 of 2000 (PAIA), the National Land Transport Act 5 of 2009 as amended by the National Land Transport Amendment Act 23 of 2023 (NLTA) and its e-hailing regulations, the Electronic Communications and Transactions Act 25 of 2002, and the Consumer Protection Act 68 of 2008.
We do not rely on a general statement that using our Services means you agree to everything we do with your information. Instead, each use of your information is based on one of the lawful grounds set out in section 11 of POPIA, which we explain in section 5 below. Where we rely on your consent, we ask for it separately and you may withdraw it at any time.
• Personal information: information relating to an identifiable, living natural person and, where applicable, an identifiable existing juristic person, as defined in section 1 of POPIA.
• Special personal information: the categories listed in section 26 of POPIA, including biometric information and information about criminal behaviour. These receive extra protection.
• Processing: any operation involving personal information, including collecting, storing, using, sharing, updating and destroying it.
• Operator: a service provider that processes personal information on our behalf under a written contract, as required by section 21 of POPIA.
• Trip: a ride requested by a Rider and accepted by a Driver through the Services, from request to completion or cancellation.
• Trusted contact: a person you choose to share trip details with, or who you nominate for emergencies.
• Account and contact: name, mobile number, email address, profile photograph, and password (stored in encrypted form). Source: you.
• Eligibility and verification: information that confirms you meet our women-only eligibility criteria in our Terms of Service, which may include an identity document or verification photograph. Source: you.
• Trip information: pickup and drop-off points, saved places, route, date, time, distance, fare, ride tier (Rise, Ascend, Elevate or Sovereign) and cancellations. Source: you and the app.
• Payment: payment method type and a tokenised reference, transaction records, tips and receipts. We do not store full card numbers. Source: you and our payment service providers.
• Safety: trusted and emergency contacts, trip-sharing activity, SOS or panic alerts, and incident reports. Source: you, Drivers and the app.
• Feedback: ratings and comments you give or receive, support requests and messages. Source: you and Drivers.
• Identity and contact: full name, identity number, residential address, mobile number, email address and profile photograph. Source: you.
• Regulatory and licensing: driver's licence and Professional Driving Permit (PrDP), e-hailing operating licence details, vehicle registration, roadworthy certificate, insurance details, and confirmation of the in-vehicle panic button required under the NLTA. Source: you and licensing authorities.
• Background screening: criminal record (police clearance) results required for a PrDP and for passenger safety (see section 4.2). Source: you and authorised screening providers.
• Face verification: reference photograph and verification selfies, processed as set out in section 4.1. Source: you.
• Earnings and payouts: banking details for payouts, fares, tips, referral bonuses, statements, and tax information needed for our records. Source: you and the app.
• Performance and safety: trip history, acceptance and cancellation records, ratings, complaints, incident reports, and training and onboarding records. Source: you, Riders and the app.
Accurate location is essential to e-hailing and to your safety. We collect precise GPS location from the Rider app when you open the app, request a trip and during a trip, and from the Driver app while you are online and available for trips, and during every trip, including when the app is running in the background. We do not track Drivers when they are offline. You can switch off location permissions in your device settings, but the Services will not work without them.
When you use the Services we automatically collect technical information such as your IP address, device type and model, operating system, app version, unique device identifiers, crash and diagnostic data, and how you use the app and website. We also keep records of in-app messages between Riders and Drivers, messages to our support channels (including our WhatsApp line), and call records where calls are placed through the app.
If you give us details of a trusted or emergency contact, or book a trip for someone else, please make sure they know you have shared their details with us and why. We use this information only for the purpose you gave it to us.
To make sure the person driving is the registered, vetted Driver, the Driver app may ask Drivers to complete a face verification check. Face data is biometric information, and we process it only with the Driver's express, specific in-app consent, in line with section 27(1)(a) of POPIA.
• How it works. A liveness check runs first. Images of your face and, on supported devices, depth data are processed entirely on your device. Depth data is never stored or transmitted and is discarded when the check completes. A selfie is then transmitted securely to Ondemand Apps OÜ, the operator of our app software platform, which compares it with your reference photograph using Amazon Web Services Rekognition as a sub-processor.
• How long we keep it. The selfie is deleted automatically once verification completes, and in any event immediately upon completion or interruption of the verification session. Your reference photograph is kept while your Driver account is active, because repeated checks need an image to compare against, and is deleted within 30 days after your account closes. After each check we keep only the pass or fail result and its date, which contains no face data.
• Who sees it. Face data is shared only with the two providers named above, solely to perform the verification. Amazon Web Services processes the images transiently, does not retain them after the check, and does not use them to train or improve its services.
• What we never do. Face data is never used for advertising, marketing, profiling or analytics, and is never sold.
• If you do not consent. Please contact us and we will discuss an alternative verification process with you.
Passenger transport law requires Drivers to hold a valid PrDP, which depends on a criminal record check, and our women-only safety model depends on proper vetting. We process criminal record information about Drivers and applicants only with their consent and as permitted by sections 27 and 33 of POPIA. We use it only to decide eligibility to drive and to meet our legal obligations. Access is limited to authorised Hail-O personnel, and we keep only what we need to show that screening took place.
We do not ask for health information. If you choose to share it with us, for example in an incident report or to request assistance with accessibility, we will use it only for that purpose and only with your consent.
Hail-O is a women-only service. We ask Riders and Drivers to confirm that they meet the eligibility criteria in our Terms of Service, and we may verify this. We use this information only to operate the service as designed and to keep the platform safe. It is never used for advertising or shared for any unrelated purpose.
You must be 18 years or older to create a Hail-O account. We do not knowingly collect personal information about children through our Services. If we learn that we have collected a child's personal information without the consent of a competent person, as required by sections 34 and 35 of POPIA, we will delete it.
POPIA requires every use of personal information to have a lawful justification. Below is what we do, and the ground in section 11(1) of POPIA we rely on.
• Providing trips: matching Riders and Drivers, navigation, arrival times, fares, receipts and trip history. Lawful basis: necessary to perform our contract with you (b).
• Verification and eligibility: confirming identity and women-only eligibility, and preventing account sharing and impersonation. Lawful basis: contract (b); our legitimate interest and yours in a safe platform (d), (f).
• Driver onboarding and compliance: checking licences, PrDP, operating licence, vehicle, insurance and panic button compliance, and ensuring no unlicensed operator uses our platform as the NLTA requires. Lawful basis: legal obligation (c); contract (b).
• Safety: live trip tracking, trip sharing, SOS alerts, incident investigation, and suspending or removing users who put others at risk. Lawful basis: protecting your legitimate interests (d); our legitimate interest (f); legal obligation (c).
• Payments and payouts: collecting fares and tips, paying Drivers, referral bonuses, refunds, and financial and tax records. Lawful basis: contract (b); legal obligation (c).
• Support: responding to questions, complaints, lost property and disputes. Lawful basis: contract (b); legitimate interest (f).
• Security and fraud prevention: detecting fraud, fake accounts, payment abuse and misuse of the Services. Lawful basis: legitimate interest (f); legal obligation (c).
• Improving the Services: understanding demand, pricing, service quality and app performance, using de-identified or aggregated data wherever possible. Lawful basis: legitimate interest (f).
• Marketing: telling you about Hail-O news, offers and the driver referral programme. Lawful basis: your consent (a), or as an existing customer under section 69(3) of POPIA, with an opt-out in every message.
• Legal matters: complying with lawful requests, and establishing, exercising or defending legal claims. Lawful basis: legal obligation (c); legitimate interest (f).
We will not use your information for a purpose that is incompatible with the purpose for which we collected it, as section 15 of POPIA requires. If we need to, we will tell you and, where required, ask for your consent.
We do not suspend or remove a Rider or Driver based solely on an automated process such as a ratings threshold. A person at Hail-O always reviews these decisions, and you may make representations before a final decision is taken, consistent with section 71 of POPIA.
We share personal information only where necessary, and only with the following recipients:
• Riders and Drivers: to complete a trip, a Rider sees the Driver's first name, photograph, vehicle details, registration number, rating and live location. A Driver sees the Rider's first name, pickup and drop-off points and rating. We share only what is needed for the trip.
• Trusted contacts: trip details and live location, only when you choose to share them or trigger an SOS alert.
• Our operators: service providers that process information on our behalf under written contracts requiring confidentiality and security (section 21 of POPIA), including our app platform provider Ondemand Apps OÜ and its sub-processor Amazon Web Services, Google (email, workspace and mapping services), payment service providers, communications providers, and our website hosting provider.
• Emergency and security responders: SAPS, emergency medical services, and tracking or armed response providers when an SOS or panic alert is triggered or a life may be at risk.
• Regulators and authorities: the National Public Transport Regulator, the Provincial Regulatory Entity, the South African Revenue Service, the Information Regulator, and other authorities when the law requires it.
• Law enforcement and courts: only in response to a valid legal process, such as a subpoena or court order, or where disclosure is necessary to prevent serious harm. We disclose only what is required.
• Insurers and legal advisers: where needed to handle an incident, claim or dispute.
• Support organisations: if you ask us to connect you with a gender-based violence or trauma support organisation, we share only what you agree to, and only with your express consent.
• A buyer or successor: if Hail-O is involved in a merger, acquisition or sale of assets. We will notify you before your information becomes subject to a different privacy policy.
What we never do: we do not sell or rent personal information, and we do not share it with advertisers, ad networks, data brokers or contest sponsors.
Some of our operators store or process information outside South Africa. Our app platform provider, Ondemand Apps OÜ, is based in Estonia and is subject to the European Union's General Data Protection Regulation. Amazon Web Services and Google may process information in other countries. We transfer personal information across borders only where section 72 of POPIA allows it, which means that the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or where the transfer is necessary to perform our contract with you or you have consented.
We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires, as section 14 of POPIA provides. When it is no longer needed, we delete or destroy it, or de-identify it so that it can no longer be linked to you.
• Rider and Driver account information: while your account is active, and deleted or de-identified within 12 months after the account closes, unless a longer period below applies.
• Trip, payment, payout and financial records: up to 7 years, as required by the Companies Act 71 of 2008 and the Tax Administration Act 28 of 2011.
• Detailed location data linked to a trip: kept with the trip record for up to 3 years, which is the general period for bringing claims under the Prescription Act 68 of 1969, and then de-identified.
• Driver location while online but not on a trip: up to 90 days.
• Safety incident reports and investigations: until the matter is resolved and for at least 3 years after that, or longer if legal proceedings are pending.
• Driver licensing and screening records: while the Driver is active on the platform, and for 3 years afterwards to show regulatory compliance.
• Face verification data: as set out in section 4.1.
• In-app messages and support records: up to 2 years, unless linked to an incident or dispute.
• Marketing preferences: until you withdraw consent. We keep a record of your opt-out so that we do not contact you again.
As section 19 of POPIA requires, we take appropriate, reasonable technical and organisational measures to protect personal information against loss, damage and unauthorised access. These include encryption of information in transit, access controls based on the principle of least privilege, multi-factor authentication on administrative accounts, confidentiality obligations on everyone who handles personal information, and written security commitments from our operators. We review these measures regularly.
No system is completely secure. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as soon as reasonably possible, as section 22 of POPIA requires, and tell you what steps you can take to protect yourself.
Under POPIA you have the right to:
• Access your personal information: ask us to confirm whether we hold information about you and to give you a copy (section 23);
• Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to keep (section 24);
• Object to processing based on legitimate interests, on reasonable grounds (section 11(3)(a)), using Form 1 of the POPIA Regulations or by email;
• Object to direct marketing at any time, free of charge (sections 11(3)(b) and 69);
• Withdraw your consent at any time, where we rely on consent. This does not affect processing that took place before withdrawal;
• Not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (section 71); and
• Complain to the Information Regulator (section 74) and, where applicable, institute civil proceedings (section 99).
Email admin@hailoapp.co.za, call +27 75 475 9707, or use the account settings in the app. We will need to verify your identity before acting on a request, to protect you from someone else trying to access your information. We will respond within 30 days. We do not charge to confirm whether we hold your information. Requests for copies of records are handled under PAIA, and the fees prescribed under PAIA may apply; we will tell you in advance.
You may close your account at any time in the app or by email. When you do, we will delete or de-identify your information in line with section 8, except information we must keep to meet a legal obligation, resolve an open safety matter or dispute, or prevent fraud. We will tell you what we are keeping and why.
We send electronic marketing (email, SMS, WhatsApp or push notifications) only if you have opted in, or if you are an existing customer and the message is about similar Hail-O services, as section 69 of POPIA allows. Every marketing message tells you how to opt out, and opting out is free. Service messages, such as trip updates, receipts, safety alerts and changes to this policy, are not marketing and will still be sent while you have an account.
Our website uses essential cookies that it needs to function, and may use analytics cookies to understand how visitors use the site so that we can improve it. Where consent is required, we ask for it before setting non-essential cookies. We do not use advertising cookies or cross-site tracking. You can block or delete cookies in your browser settings, although some parts of the website may then not work properly. Our website and apps may contain links to other websites. We are not responsible for their privacy practices, and we encourage you to read their privacy policies.
We may update this policy from time to time, for example when the law changes or we add new features. We will tell you about material changes by email or a prominent notice in the app or on our website before they take effect, and we will update the date at the top of this policy. Where a change requires your consent, we will ask for it.
Questions, requests and complaints about privacy can be sent to Hail-O's Information Officer:
Hail-O (Pty) Ltd, Registration No. 2026/298023/07
Address: 41 on Sloane, Bryanston, 2194
Telephone: +27 75 475 9707
Email: admin@hailoapp.co.za
Website: hailoapp.co.za
Our PAIA Manual is available from the Information Officer on request.
If you are not satisfied with how we have handled your personal information or your request, you have the right to lodge a complaint with the Information Regulator:
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
Telephone: 010 023 5200 | Toll free: 0800 017 160
Email: enquiries@inforegulator.org.za | Website: inforegulator.org.za