Privacy Policy

Who we are

This Privacy Policy (the “Policy”) sets out how Merani Taxi LLC (შპს „მერანი ტაქსი“, identification code 425062424; registered address: 5 Merab Kostava 1st Dead End, Baghdati, Georgia; the “Company”) collects, uses, stores and protects personal data when you use the Baghdati Taxi platform.

The Company is the controller of your data. This Policy is issued under the Law of Georgia on Personal Data Protection.

Who this applies to

This Policy applies to:

• Riders — people who order a taxi through the Baghdati Taxi app or website, or by phone through an operator;
• Drivers — people who register and work through the driver app.

If you use the same phone number as both a rider and a driver, both parts apply to you.

Rider data

Account

• Mobile phone number and password (you sign in with your number and password; an SMS code only verifies the number — at registration and when recovering your password);
• Municipality (optional, if you add it to your profile).

We do not ask riders for their name, surname, personal ID number or email address.

Orders

• Pickup and destination (and any extra stop) addresses and coordinates;
• Order time (including scheduled rides), vehicle type, fare and status updates;
• The comment you leave for the driver (it is shown to the driver);
• The reason and comment if you cancel an order.

Location

With your permission, your device’s location is used to show where you are on the map and to help set the pickup point. Our servers store only the addresses and coordinates entered in the order — we do not track your movement during the ride.

Messages and reviews

• Messages exchanged with the driver in the in-app chat;
• Ratings and comments you give drivers;
• Ratings drivers give you (punctuality, behaviour, cleanliness, route deviation) and their comments.

Ordering by phone

If you order a taxi by calling an operator, the operator records your phone number and the order details. For every order taken by an operator we send order status SMS messages (order received, driver on the way, driver arrived, ride completed, no free driver found) — whether or not you also use the app. If you later register with the same number, your earlier orders are linked to your account.

Payment

Cash is currently the only payment method — fares are paid directly to the driver. We do not collect bank card details.

Driver data

Identification data

• Name and surname;
• Personal ID number (11 digits);
• Mobile phone number;
• Municipality and village of residence;
• Driving licence number and categories;
• Photo of your ID card;
• Photos of your driving licence (front and back).

Vehicle data

• Make, model, colour and registration plate;
• Vehicle registration certificate details and photos (front and back);
• Vehicle type (economy / minivan).

Location data

We collect your device’s real-time location only while you are “online” in the app or taking part in a ride. The app does not collect location in the background. Location is used for dispatch (matching you with riders taking distance and rating into account) and for following the progress of rides.

Platform usage data

• Ride history, statuses, dates and times, routes;
• Ratings and comments given by riders;
• Ratings and comments you give riders;
• Messages exchanged with riders in the in-app chat;
• Statistics on offers accepted and declined.

Financial data

• History of commission charged and paid.

Technical data

• A log of sign-in events (phone number, time, outcome, IP address, browser or device information);
• A log of SMS messages sent (phone number and message text);
• Error logs (for diagnostics).

We do not use advertising or third-party analytics tools. Your browser and the app store only what the service needs to work (for example, your sign-in session or an unfinished order).

How we use your data

We use your data to:

• Create and manage your account;
• Receive taxi orders and match riders with drivers, taking distance and rating into account;
• Calculate routes, distances and fares;
• Verify drivers’ identity and eligibility to drive (KYC);
• Monitor rides and keep them safe;
• Run the rating system and calculate rider and driver ratings;
• Calculate and settle commission;
• Resolve disputes and complaints;
• Prevent fraud and attempts to get around a ban;
• Improve the quality of the service;
• Send SMS messages (number verification codes, order status and similar);
• Meet our legal obligations (tax, requests from law enforcement).

Ratings are reflected in a person’s rating no earlier than 48 hours after being given, so that the person rated cannot tell which ride or who gave a particular rating.

Legal basis for processing

• Performance of a contract — taking orders, matching riders with drivers, the ride itself and settlement;
• Legal obligation — tax and accounting records, and lawful requests from law enforcement;
• Legitimate interest — safety, fraud prevention, the rating system, resolving disputes and recovering unpaid commission;
• Consent — access to your device’s location, camera and photos. You can withdraw these permissions at any time in your device settings, but some features will not work without them.

Who we share data with

What the driver sees about the rider

• The pickup and destination locations — when receiving the offer and during the ride;
• The rider’s phone number — only after accepting the order, so they can call;
• The comment the rider left for the driver;
• The rider’s messages in that order’s chat.

What the rider sees about the driver

• While the order is searching — the anonymous positions of nearby drivers on the map (without names);
• The driver’s first name (without surname);
• The driver’s rating;
• Vehicle details (make, model, colour, registration plate);
• The driver’s live location while travelling to the rider and during the ride.

Riders cannot see the driver’s phone number, KYC documents or personal ID number.

Company staff

Dispatchers and administrators can access data only to the extent their work requires — managing orders, checking driver documents and handling complaints.

Technology providers

To run the platform, some of your data is processed by our technology providers, who process it only on our instructions:

• Cloud hosting and database services (including document storage);
• Map, routing and distance-calculation services (they receive the coordinates of route points);
• SMS delivery services (they receive the phone number and the message text);
• Authentication and security services.

These providers’ servers may be located outside Georgia. Our providers are required to protect data in line with applicable law.

Law enforcement

The Company must disclose data to law enforcement or tax authorities where Georgian law or a court decision requires it.

Advertising and sale

The Company does not sell your personal data to third parties and does not use it for advertising.

How long we keep data

We keep your data while your account is active. When you delete your account, your data is deleted or no longer linked to your identity, as described below; some records are kept for as long as Georgian law requires (for example, tax or financial records).

After you delete your account

You can delete your account directly in the app, on the Profile page. Deleting the rider account also deletes the driver profile on the same account (deleting the driver account does not delete the rider account).

As soon as you ask for deletion, the account is switched off (a driver stops receiving orders and disappears from dispatch; a rider can no longer order taxis), and the data is deleted for good 30 days later. During those 30 days, signing in to the app offers to restore the account; after 30 days it can no longer be restored. The final deletion removes:

• Your name, surname and personal ID number;
• Your phone number and sign-in data;
• Photos of your driving licence, ID card and vehicle registration certificate;
• Your location history (live GPS location);
• The chat messages you sent (the other party’s messages are not deleted);
• Individual reviews written about you;
• The typed address names of your trips (pickup, destination and extra stop) and your comments on trips;
• The log of SMS messages sent to you;
• Your car’s registration plate, make, model, colour and registration certificate number.

After deletion we keep the following records, which are no longer linked to your identity:

• Trip and payment records (amounts and times) — to meet Georgian law and our tax obligations, for as long as the law requires;
• Trip coordinates (pickup, destination and extra stop points and the route) — for operational statistics.

For drivers, deleting the account does not cancel unpaid commission. If a driver owes unpaid commission when the account is finally deleted, we keep, on the basis of legitimate interest (establishing and defending legal claims), only their name, surname, personal ID number, phone number and the amount owed — everything else is deleted as usual — in order to recover the debt. These details are deleted as soon as the debt is paid (or carried over to a new account), and at the latest after 3 years (the limitation period).

To prevent fraud — so that deleting an account cannot wipe out a ban, a low rating or a debt — we keep, on the basis of legitimate interest:

• A one-way encrypted fingerprint of your phone number and (for drivers) personal ID number. The number cannot be recovered from it; it is used only to tell whether the same person is registering again;
• Your rating summary (average scores and number of reviews);
• The amount of unpaid commission and whether the account was banned.

If you register again, your previous rating and any unpaid commission carry over to the new account, and a person whose account was banned will be refused registration. Your previous profile, documents, trip history and messages are not restored. More details: Deleting your account.

Your rights

Under the Law of Georgia on Personal Data Protection, you have the right to:

• Request information about your data;
• Have inaccurate data corrected;
• Have your data deleted (subject to legal retention obligations) — you can also delete your account directly in the app;
• Object to the processing of your data;
• Request an export of your data;
• Withdraw your consent (except for obligations to pay commission and to settle when closing the account).

To exercise your rights, contact us at gio.matchavariani@gmail.com. We will handle the request after verifying your identity, within 30 days at most.

If you believe your rights have been violated, you can complain to the Personal Data Protection Service of Georgia.

Data security

We protect your data with the following measures:

• Encrypted connections (HTTPS/TLS) between the app, the website and our servers;
• Secure cloud storage for KYC documents (only authorised staff have access);
• Sign-in with phone number and password; the number is verified by SMS code;
• Access logs and monitoring;
• A duty on staff not to disclose your data.

Despite our efforts, no system can be guaranteed to be completely secure. Please protect access to your account (your password) from other people as well.

Changes to this Policy

We may update this Policy. You will be notified of significant changes in the app or by SMS. The date of the latest update is shown at the top of this page.

Contact

For questions about privacy:

• Email: gio.matchavariani@gmail.com
• Phone: +995 706 706 206
• Address: 5 Merab Kostava 1st Dead End, Baghdati, Georgia