1. Who we are
On The Way is a carpooling platform operated by Innovibyte (Pvt) Ltd ("Innovibyte", "we", "us"), a company registered in Sri Lanka. We connect drivers who have empty seats with passengers travelling the same way. This policy covers the personal data we handle when you use the On The Way app or visit this website.
For any privacy question, or to exercise your rights, contact us at contact@innovibyte.com.
2. Data we collect
We collect only what we need to run the service and keep trips safe.
Account & profile
- Your phone number (used to sign in and verify your identity).
- Your name, and your email address if you sign in with Google or verify by email.
- Your gender, which is used only for our women's-safety ride matching.
- Your National Identity Card (NIC) number and address, and a profile photo if you add one.
If you drive
- Your driving licence number and photos of your licence (front and back).
- Your vehicle details — type, model, colour and number plate — and photos of the vehicle.
- Vehicle documents you upload for verification (such as the registration book, insurance and revenue licence).
Trips & safety
- Ride and booking details: routes, pickup and drop-off points, times, seats booked and the fare.
- Location data, including live location during a trip — see section 6.
- Trusted (emergency) contacts you add — their name, phone number and relationship to you.
- SOS events and trip-share links you create, including the location captured at that moment.
- Ratings, reviews and complaints you give or receive.
Technical
- A notification token for your device, so we can send you ride updates.
- Basic device and app information (such as model, operating system, app version and network status) used for reliability and security.
3. How we use your data
- To create your account and sign you in.
- To match rides, show fares, and let drivers and passengers find and book each other.
- To verify drivers and vehicles, and to keep one number plate tied to one owner.
- To power live tracking, trip sharing, SOS alerts and women's-safety matching.
- To send ride notifications (requests, acceptances, arrivals, cancellations and trip summaries).
- To calculate ratings, handle complaints, and keep the community trustworthy and safe.
- To prevent fraud and abuse, and to meet our legal obligations.
4. Our legal basis
We process your data in line with Sri Lanka's Personal Data Protection Act, No. 9 of 2022. Depending on the activity, we rely on: performing our contract with you (providing the rides service), your consent (for example, location access and alerting your trusted contacts), our legitimate interest in keeping the platform safe and reliable, and compliance with legal obligations.
5. Who we share data with
We do not sell your personal data. We share it only as needed to provide the service:
- Other users see what's necessary for a trip — for example, a driver and passenger see each other's name, photo, rating, and relevant pickup/drop-off and live-location details during a ride.
- Your trusted contacts receive a tracking link when you share a trip or trigger SOS.
We also use trusted service providers ("processors") who handle data on our behalf under contract:
| Provider | Purpose | Data involved |
|---|---|---|
| Google / Firebase | App backend — sign-in, database, file storage, cloud functions and push notifications | Account, trip, document and location data; notification tokens |
| Google Sign-In | Optional sign-in method | Email and Google account name |
| Twilio | Sending WhatsApp/SMS safety alerts to your trusted contacts | Contact phone numbers, your name and live-location link |
| Email OTP provider | Sending one-time codes for email verification | Email address |
| OpenStreetMap (Nominatim) & OSRM | Maps, addresses and route calculation | Coordinates and place names |
Some of these providers operate servers outside Sri Lanka, so your data may be processed abroad with appropriate safeguards. We may also disclose data where required by law or to protect the safety of our users.
6. Location data
Location is central to a rides app, so we're specific about it:
- We use your location to find nearby rides and to set accurate pickup and drop-off points.
- During an active trip, your live location is shared with the others in that ride so everyone can see progress and ETA.
- Drivers may grant background location so the trip keeps updating while the app isn't open. You can change this in your device settings at any time.
- When you share a trip or press SOS, a private tracking link lets your trusted contacts follow your live location. That link stays active for up to two days after the trip ends, then stops working.
You're always in control: location permissions can be turned off in your phone's settings, though some safety and matching features won't work without them.
7. How long we keep your data
We keep your account and trip data for as long as your account is active and as needed to provide the service, resolve disputes, and meet legal and safety obligations. Trip-share links expire automatically two days after a trip. When you ask us to delete your account, we remove or anonymise your personal data unless we're required to retain certain records by law.
8. How we protect your data
Access to data is restricted by authentication and server-side security rules, so users can only reach the information they're entitled to. Documents and photos are stored in protected cloud storage. No system is perfectly secure, but we work to safeguard your information and to limit who can access it.
9. Your rights
Under the Personal Data Protection Act, you may ask us to:
- Access the personal data we hold about you.
- Correct data that is inaccurate or incomplete.
- Delete your data, or withdraw consent you previously gave.
- Object to or restrict certain processing.
To make a request, email contact@innovibyte.com. We may need to verify your identity first, and we'll respond within the time the law allows.
10. Children
On The Way is intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a minor has used the service, contact us and we'll take appropriate action.
11. Changes to this policy
We may update this policy as the service evolves or the law changes. We'll revise the "last updated" date above and, for significant changes, give notice in the app. Continuing to use On The Way after an update means you accept the revised policy.
12. Contact us
Questions, requests or concerns about your privacy? Reach Innovibyte (Pvt) Ltd at contact@innovibyte.com.