Privacy Policy

How Shuttle collects, uses, and protects your personal information.

Last updated: 20 September 2026Shuttle (Pvt) Ltd • Sri Lanka

This Privacy Notice for Shuttle (Pvt) Ltd (“we”, “us”, or “our”) describes how and why we might access, collect, store, use, and/or share (“process”) your personal information when you use our services (“Services”), including when you:

Download and use our mobile application, Shuttle
Visit our website at shuttle.lk
Use Shuttle, a platform that connects riders with independent drivers
Engage with us in other related ways, including any marketing or events

Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services.

1. What information do we collect?

In Short: We collect the personal information you give us, information about your trips, and location and device information from the app while you use it.

Personal information you disclose to us

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us. This may include:

Name
Phone number
Email address (optional if you sign up with a phone number)
Password, which is held by our sign-in service (Firebase Authentication)
Gender (male, female or other), chosen when you sign up and not changeable afterwards; we use it to send Shuttle Pink requests to women drivers
Home province, city and district
Language
Profile photo
Emergency contact names and phone numbers
Saved places, such as a home or work address you choose to save for faster booking
Ratings and reviews you give and receive
Messages and photos you send in trip chat
Support requests, including any photos you attach

Trip information

When you book or take a trip we record it: the pickup, stops and drop-off points, the route, the fare and any fees, the times, the vehicle type, the payment method you chose (cash), the driver or rider you were matched with, and any cancellation, no-show, waiting or route-change charges. When you place a call through the app we record that it happened: the two phone numbers, the trip and the time.

Sensitive information

When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information:

Precise geolocation: a driver’s real-time location while online and on a trip, and the location a rider or driver is at when they press SOS. A rider’s location is otherwise used on the rider’s device (see “Application data” below).
Driver verification documents: if you register as a driver, we collect photographs of your driving licence, a selfie photograph used to verify your identity, your vehicle registration, insurance certificate, fitness certificate and revenue licence, together with your vehicle’s type, model, number plate and colour.

Payment information

Riders pay drivers directly, in cash. The app does not currently process card payments and we do not collect or store card numbers. If we introduce card payments, we will update this notice first.

Application data

If you use our application, we may also collect the following if you give us access or permission:

Geolocation information. If you are a driver, we ask for permission to use your device’s location while you are online and during trips (including when the app is minimised on Android), so that riders can see you and we can match you with nearby trips. If you are a rider, we ask for permission to use your device’s location while you use the app, to set your pickup point, show nearby drivers and calculate your fare. A rider’s exact GPS position stays on the rider’s device; what we receive is the pickup and drop-off points the rider chooses (which may be the rider’s current position) and, if you press SOS, your location at that moment. You can change or withdraw this permission at any time in your device’s settings, though parts of the Services will not work without it.
Mobile device data. We store which platform you use (iOS or Android), a random device identifier and the time you last signed in, so that we can manage the devices signed in to your account. Our hosting providers also see your IP address when the app connects to them.
Push notifications. We store a notification token for your device so we can send you notifications about your account or your trips. If you wish to opt out, you can turn them off in your device’s settings.
Diagnostic data. If the app crashes, our crash-reporting service (Firebase Crashlytics) receives a report with technical details about the crash and your device, such as its model and operating system version. We do not attach your name, phone number, email address, location or trip details to it.
Safety and fraud signals. We check whether location data looks falsified (for example, produced by a mock-location app) and keep the result as a flag on your account. We also keep records of blocks, reports, suspensions and the action we take on an account.

This information is primarily needed to maintain the security and operation of our application, for troubleshooting, and for our internal reporting purposes.

All personal information that you provide to us must be true, complete and accurate, and you must notify us of any changes to it.

2. How do we process your information?

In Short: We process your information to provide, improve and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes only with your prior explicit consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To facilitate account creation and authentication and otherwise manage user accounts, so you can create and log in to your account and keep it in working order.
To deliver and facilitate delivery of services to the user — to match you with nearby drivers, navigate your trip, calculate fares and process trip records.
To respond to user inquiries and offer support, so we can answer your questions and resolve problems with a trip.
To enable user-to-user communications, so riders and drivers can message or call one another about a trip in progress. Calls made through the app use your phone’s dialer to call the other person’s real number, so each of you can see the other’s phone number.
To decide which drivers receive a request and to send Shuttle Pink requests only to women drivers (see section 9).
To protect our Services, including fraud monitoring and prevention, detecting falsified or manipulated location data, and enforcing our Terms.
To identify usage trends, so we can understand how the Services are used and improve them.
To save or protect an individual’s vital interest — for example when you use the in-app SOS feature, or where we need to act to prevent harm.
To contact you about your account and trips.

3. What legal bases do we rely on?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on in order to process your personal information. We may rely on the following:

Consent. We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time.
Performance of a contract. We may process your personal information when we believe it is necessary to fulfil our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.
Legitimate interests. We may process your information when we believe it is reasonably necessary to achieve our legitimate business interests and those interests do not outweigh your interests and fundamental rights and freedoms. For example, to analyse how our Services are used so we can improve them, and to diagnose problems and prevent fraudulent activity.
Legal obligations. We may process your information where it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.
Vital interests. We may process your information where we believe it is necessary to protect your vital interests or those of a third party, such as situations involving potential threats to the safety of any person.

If you are located in Canada

We may process your information if you have given us specific permission (express consent) to use your personal information for a specific purpose, or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example: if collection is clearly in the interests of an individual and consent cannot be obtained in a timely way; for investigations and fraud detection and prevention; for business transactions provided certain conditions are met; if it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim; for identifying injured, ill or deceased persons and communicating with next of kin; if we have reasonable grounds to believe an individual has been, is, or may be a victim of financial abuse; if disclosure is required to comply with a subpoena, warrant, court order or rules of the court relating to the production of records; or if the information is publicly available and is specified by the regulations.

In Short: We share information with the rider or driver you are matched with, with the service providers that run the app, and in the specific situations described below.

We may need to share your personal information in the following situations:

With the rider or driver you are matched with. When you are matched for a trip, we share what the other party needs to find you and complete the trip safely. The driver sees the rider’s name and profile photo and the pickup, stop and drop-off points. The rider sees the driver’s name, profile photo, rating, vehicle and number plate, and can see the driver’s live location during the trip. A rider’s live location is not shared with the driver.
With drivers who receive your request. When a rider books, the request — with the rider’s name, profile photo, and pickup and drop-off points — goes to nearby drivers, and each driver who receives it can see it, even if another driver ends up taking the trip.
With other riders, anonymously. An online driver’s position appears as an anonymous pin, with no name or vehicle details, on the maps of riders nearby.
With your emergency contacts. If you use the in-app SOS feature, we send an SMS to the emergency contacts saved on your account. That message says who pressed SOS and contains a link to the location they were at when they pressed it, the pickup and drop-off addresses, and the driver’s name, vehicle and number plate.
With anyone you share your trip with. If you choose to share your trip, we generate a link that anyone who has it can open without signing in. While the trip is active it shows a map with the vehicle’s live location, the driver’s name, and the vehicle and its number plate. It also shows the pickup and drop-off addresses, which remain visible on the link after the trip ends. The message we prepare when you share includes your name and those addresses. Share the link only with people you trust. The link’s page loads its map code from unpkg and its map tiles from OpenStreetMap, so those services see the IP address of anyone who opens it.
With our service providers. We share information with third parties that perform services for us: Google Cloud and Firebase (application hosting, database, file storage, authentication, push notifications, crash reporting and logs), Apple (push notifications, and the map display, on iPhone), SMSLenz (SMS delivery for verification codes and SOS alerts), and Resend (email). These providers process your information to provide their service to us.
When we use Google Maps Platform APIs. We share location and address information with Google Maps Platform APIs (for example the Maps, Places, Routes and Geocoding APIs) in order to display maps, search for addresses and navigate trips. On iPhone the map itself is drawn by Apple Maps. Google Maps uses GPS, Wi-Fi and cell towers to estimate location; GPS is accurate to about 20 metres, while Wi-Fi and cell towers help improve accuracy when GPS signals are weak, such as indoors. This data helps Google Maps provide directions, but it is not always perfectly precise. By using our application, you are also bound by Google’s Terms of Service, available at https://policies.google.com/terms, and by the Google Maps/Google Earth Additional Terms of Service, available at https://www.google.com/help/terms_maps/
For legal compliance and safety. We may disclose your information where we are legally required to do so, or where we believe disclosure is necessary to investigate, prevent or take action regarding potential violations of our policies, suspected fraud, or threats to the safety of any person.
Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

Where your information is stored. Our main database is in Mumbai, India. Our realtime database is in Singapore. Our file storage (profile photos, driver documents and chat photos) and most of our server functions are in the United States.

5. Do we use cookies and tracking technologies?

In Short: Our mobile app does not use cookies, and we do not use advertising or cross-app tracking networks. Our website uses no advertising or tracking cookies.

Shuttle is a native mobile application. It does not use cookies, web beacons or advertising pixels, and we do not use third-party advertising or analytics networks to track your behaviour across other apps or websites. We do not serve advertising in the app, and we do not sell your personal information.

To make the app work, we store a limited amount of information locally on your device — such as your session, so that you stay signed in; your language and theme preferences; and a randomly generated identifier used to manage the devices signed in to your account. That identifier is created by the app itself; it is not the advertising identifier assigned by your phone.

Any web page we operate uses only the technical storage necessary to display it. This includes our website (see section 14) and the trip-tracking page opened from a shared trip link, which also loads map code from unpkg and map tiles from OpenStreetMap (see section 4).

6. How long do we keep your information?

In Short: We keep your information for as long as necessary to fulfil the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). In general, we keep your account information for as long as you have an account with us.

Some categories have their own retention periods:

Chat messages between riders and drivers, including any photographs sent in chat, are automatically deleted about 72 hours after a completed trip. Chat on cancelled trips is not currently deleted automatically.
Verification codes sent to you by SMS are valid for five minutes.
Trip records — including pickup and drop-off locations, fares, timestamps, the names and vehicle plate shown on the trip, ratings, call records, and fee, payment and safety records — are kept after a trip ends so that we can provide receipts, resolve disputes, prevent fraud, and meet our legal and accounting obligations.
Your profile photo and driver verification documents are deleted when your account is deleted.
If you start a driver application and do not finish it, we delete it after seven days and send you a text message to tell you.
Logs kept by our cloud providers can include phone numbers and approximate locations and are kept for a limited period.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. How do we keep your information safe?

In Short: We protect your information with organisational and technical security measures, and we will tell you if a breach puts you at risk.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process. Information sent to and from the app is encrypted in transit, and access to our administrative systems is restricted to authorised personnel.

Please note that in-app chat messages between riders and drivers are not end-to-end encrypted. They are encrypted in transit and at rest on our infrastructure, and they are deleted about 72 hours after a completed trip, but they can in principle be accessed by authorised personnel — for example when investigating a safety report or a dispute.

However, despite our safeguards and efforts to secure your information, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals or other unauthorised third parties will not be able to defeat our security and improperly collect, access, steal or modify your information. Although we will do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

If a data breach occurs

If a security incident occurs in which your personal information is accessed, disclosed, altered or destroyed without authorisation, we will investigate promptly and take steps to contain it. Where the incident is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. Where the incident is likely to result in a high risk to you, we will also notify you directly and without undue delay, describing what happened, what information was involved, what we are doing about it, and what you can do to protect yourself.

8. Do we collect information from minors?

In Short: We do not knowingly collect data from or market to children under 18 years of age, or the equivalent age as specified by law in your jurisdiction.

We do not knowingly collect, solicit data from, or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18, or the equivalent age as specified by law in your jurisdiction, or that you are the parent or guardian of such a minor and consent to that minor’s use of the Services.

If we learn that personal information from users less than 18 years of age has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under 18, please contact us at support@shuttle.lk

9. What are your privacy rights?

In Short: You can review and change much of your account in the app, you can ask us to delete it, and depending on where you are you may have additional rights over your personal information.

In some regions — such as the European Economic Area (EEA), the United Kingdom, Switzerland and Canada — you have certain rights under applicable data protection laws. These may include the right (i) to request access to and obtain a copy of your personal information; (ii) to request rectification or erasure; (iii) to restrict the processing of your personal information; (iv) where applicable, to data portability; and (v) not to be subject to automated decision-making. In certain circumstances you may also have the right to object to the processing of your personal information.

Automated steps. Some steps in the Services are automated: choosing which nearby drivers receive a request (based on distance, rating, acceptance rate and recent activity), sending Shuttle Pink requests only to women drivers, applying cancellation and no-show fees, and flagging suspicious location data. If an automated step affects you and you would like a person to look at it, email support@shuttle.lk.

If you are located elsewhere, including Sri Lanka, Morocco or Tunisia, you may have similar rights under your local data protection law, and you may contact your national data protection authority. We will consider and act upon any request in accordance with applicable data protection laws.

If you are in the UK

If you are unhappy with how we have handled your personal information, you can make a complaint directly to us by emailing support@shuttle.lk. This is in addition to the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018.

After you complain:

We will acknowledge your complaint within 30 days of receiving it.
We will investigate without unjustifiable or excessive delay.
We will keep you informed of progress and explain the outcome.

If you are not happy with our final response, you can refer your complaint to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint, on 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

If you are located in the EEA or UK and you believe we are unlawfully processing your personal information, you also have the right to complain to your Member State data protection authority or the UK data protection authority. If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If we are relying on your consent to process your personal information — which may be express or implied consent depending on the applicable law — you have the right to withdraw that consent at any time by contacting us using the details in section 12. This will not affect the lawfulness of the processing before its withdrawal, nor will it affect processing carried out in reliance on lawful grounds other than consent.

Account information

You can review and change much of your account information in the app (Profile, then Edit Profile). The app does not yet have a delete-account button. To delete your account, email support@shuttle.lk from the email address on your account, or use shuttle.lk/delete-account, and give us the mobile number on your account. We may ask you to confirm that it is you. When we delete an account we end any trip in progress and remove your profile, photos, documents, emergency contacts, saved places and sign-in details. We keep trip records and safety, fraud and payment records as described in section 6, and we may retain some information to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

10. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

11. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated “Last updated” date at the top of this Privacy Notice. If we make material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification.

We encourage you to review this Privacy Notice frequently to be informed of how we are protecting your information.

12. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at support@shuttle.lk.

13. How can you review, update or delete your data?

Based on the applicable laws of your country, you may have the right to request access to the personal information we collect from you, details about how we have processed it, to correct inaccuracies, or to delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

To make a request, email support@shuttle.lk from the email address on your account. To delete your account you can also use shuttle.lk/delete-account. We may ask you to confirm that it is you before we act.

14. What do we collect when you visit our website?

In Short: Very little. We do not use advertising or tracking cookies, and we do not sell your information.

When you visit shuttle.lk, our hosting provider, Vercel, processes your IP address, browser type, the pages you request and the time, so that the site can be delivered and kept secure, and keeps its own logs for a limited period.

If you use our contact form or our account-deletion form, we collect what you type in, such as your name, phone number or email address, and your message. We use it only to reply to you or to act on your deletion request. The forms send us an email through Resend. We keep the details until we have replied, and for no longer than 12 months, unless you ask us to delete them sooner or we need them to act on a request.

Our forms use Cloudflare Turnstile to block spam, and Turnstile receives your IP address when you use a form.

We measure visits with Vercel Web Analytics, which uses no cookies and does not identify you.

The site remembers your light or dark theme in your browser. This storage is needed for the site to work the way you asked and is not used to track you.

When you follow a link to another site, such as Google Play, the App Store or a shared trip tracker, that site’s own privacy notice applies.