01 Introduction and scope
Twsila ("Twsila", "we", "us") operates a transport marketplace in the Kingdom of Saudi Arabia. This Privacy Policy explains what personal data we process, why we process it, who we share it with, how long we keep it, and the rights available to you when you use the Twsila Captain mobile application as a captain, driver, or business owner providing transport services.
Twsila Captain is the application for captains and business owners who register vehicles and documents, search available trips, send offers, navigate, and complete trips. This policy applies to the Captain application and to related back-end services, notifications, invoices, and support channels connected to it.
Twsila is the party responsible for the personal data described here.
02 Data we collect
Captains and business owners provide additional data because Twsila must verify who is transporting a customer or their goods, and because earnings must be recorded.
| Category | What this includes | Why we process it |
|---|---|---|
| Account and identity | Name, mobile number, one-time verification code, account type (individual captain or business owner), profile photo, preferred language | Create and secure the account, present the captain to customers, sign you in |
| Eligibility documents | Identity document, driving licence, vehicle registration, operating or commercial documents, document images and expiry dates | Verify eligibility to provide transport services, satisfy safety and regulatory requirements, deactivate expired documents |
| Vehicle and fleet | Vehicle type and model, plate information, capacity, vehicle photos, selected services and coverage, linked drivers and their link requests, driver-to-vehicle assignments | Match the right vehicle to each request, operate fleets for business owners, show customers what is being sent |
| Location | Precise device location while the app is in use and, during an active trip, in the background; route, distance, and progress toward pickup and destination | Show nearby requests, provide navigation, allow the customer to follow the trip, confirm arrival and completion |
| Trip activity | Requests viewed, offers and counter-offers submitted, accepted trips, status changes, arrival and completion times, cancellations, ratings you give passengers | Operate the marketplace, calculate earnings, investigate disputes, maintain quality and safety |
| Financial | Earnings and revenue records, wallet balance, trip invoices and generated invoice files, business-owner subscription payments and their status | Pay and reconcile earnings, issue and store invoices, manage subscriptions, meet accounting obligations |
| Device and technical | Device model, operating system version, application version, language, network status, push notification token, IP address, diagnostic logs, and Firebase Analytics events on Android | Deliver trip notifications reliably, keep the app stable, understand feature usage in aggregate, detect abuse |
| Support and communications | Messages to support, disputes raised, contact requests, shared content when you use the share function | Respond to you and record the issue and its resolution |
Background location in the Captain app
The Captain application may access location in the background only while a trip is active, so that the assigned trip can be tracked and the customer can see progress. Background access stops when the trip ends, and can be revoked at any time in device settings.
03 Device permissions
Permissions are requested only when a feature needs them, and each one can be changed in your device settings at any time.
| Permission | Purpose | If you decline |
|---|---|---|
| Location (precise / approximate) | Maps, nearby requests, navigation, pickup and destination, distance estimation | You must enter addresses manually; nearby and navigation features are limited |
| Background location | Live trip tracking while a trip is active | Trip progress may not update while the app is not in the foreground |
| Camera | Take a photo of a required document, vehicle, or load | You can still choose an existing photo instead |
| Selected photos | Attach specific images through the operating system photo picker | Documents and requests can be submitted without images where optional |
| Notifications | Trip requests, trip status, payment results, security and service messages | You will need to open the app to see updates |
| Ignore battery optimisation | Prevent the system from suspending time-critical trip updates | Notifications and status updates may be delayed |
| Network state | Detect connectivity and adapt to poor networks | Not applicable. Required for the app to function |
Photos and videos
The Captain application uses the operating system photo picker. You choose the specific images that are shared with the app, and the application does not request broad or continuous access to your media library. On Android, the broad media and storage permissions are explicitly removed from the application.
On iOS, the media capture component also declares microphone access because it supports video capture. Twsila does not record or transmit audio.
04 How we use data and our legal bases
| Purpose | Legal basis |
|---|---|
| Register accounts, verify mobile numbers, and authenticate sign-in | Performance of a contract |
| Publish transport requests, match customers with captains, and exchange offers | Performance of a contract |
| Calculate routes, distance, availability, and price | Performance of a contract |
| Verify captain identity, licences, and vehicle documents | Legal obligation; legitimate interest in user safety |
| Process payments, record earnings, and issue invoices | Performance of a contract; legal obligation |
| Send trip, payment, and security notifications | Performance of a contract |
| Provide customer support and handle disputes | Performance of a contract; legitimate interest |
| Prevent fraud, misuse, and unsafe conduct; enforce our terms | Legitimate interest; legal obligation |
| Maintain security, diagnose faults, and improve reliability | Legitimate interest |
| Understand aggregate feature usage (Captain app, Android) | Legitimate interest; consent where required |
| Access precise location, background location, camera, selected photos, and notifications | Your consent, given through the device permission prompt |
| Retain tax, accounting, and regulatory records | Legal obligation |
We do not use personal data for automated decisions that produce legal effects without human involvement, and we do not use it for profiling for advertising purposes.
05 Sharing with customers
The service only works if a limited amount of information is exchanged between you and the customer on a trip. We share the minimum necessary at each stage.
| Stage | Shown to you | Shown to the customer |
|---|---|---|
| Open request | Service type, general pickup and destination area, dates, item details, attached photos, requested budget | Offers received, offered price, your rating, vehicle type |
| After the offer is accepted | Customer first name, contact number, exact pickup and destination, trip notes | Your name and photo, contact number, vehicle and plate details, live trip progress |
| After completion | Rating and review left by the customer | Invoice, trip summary, rating left for you |
Contact numbers are shared only for the duration required to complete the trip and must be used solely for that trip. Where a business owner assigns a driver to a trip, the business owner can see the trip and driver records for their own fleet.
We may also disclose personal data:
- to competent authorities, courts, or regulators where disclosure is required by law or legal process;
- where reasonably necessary to protect the rights, property, or safety of users, the public, or Twsila, including fraud and abuse prevention;
- to professional advisers under confidentiality obligations; and
- in connection with a merger, acquisition, financing, or transfer of business assets, subject to equivalent protection of your data.
06 Service providers and processors
We use a small number of established providers to run the platform. They act on our instructions, receive only the data needed for their function, and are bound by contractual confidentiality and security obligations.
| Provider | Function | Data involved |
|---|---|---|
| Google Firebase | Phone-number authentication, one-time codes, push notifications, app infrastructure | Mobile number, notification token, device and app identifiers |
| Firebase Analytics | Aggregate feature-usage statistics | Pseudonymous app and device events |
| Google Maps Platform | Maps, place search, geocoding, and route calculation | Location coordinates, entered addresses, search terms, IP address |
| Moyasar | Payment processing for trip earnings and business-owner subscriptions | Payment credentials entered by you, amount, transaction result |
| Cloud hosting provider (AWS) | Hosting of application servers, databases, and file storage | All service data described in this policy |
| SMS and telecom providers | Delivery of verification codes and service messages | Mobile number, message content |
Firebase Analytics is used on the Captain application for Android only. Each provider processes data under its own privacy terms in addition to our instructions. Providers are reviewed before onboarding and are not permitted to use the data for their own purposes.
07 Payments and earnings
Trip earnings and business-owner subscription payments are processed by our payment gateway, Moyasar. Card and payment credentials are entered within the gateway's secure interface and are transmitted directly to it.
Twsila receives and stores only:
- the amount, currency, and the trip or subscription the payment relates to;
- the payment method type and, where provided, a masked reference such as the last digits of a card;
- the transaction identifier and the authorisation, capture, or refund result; and
- invoice records generated for you.
Twsila does not store full card numbers, expiry data, or security codes. Payment and earnings records are retained as required by applicable tax and commercial regulations.
08 Data retention
We keep personal data only for as long as it is needed for the purposes described in this policy, and then delete or anonymise it. The following periods are indicative; the actual period depends on the category of data and any legal requirement that applies to it.
| Data | Retention |
|---|---|
| Account and profile data | While the account is active, and for a limited period after closure to handle disputes and prevent re-registration abuse |
| Trip and request records | For the period required for dispute resolution, safety, and financial reporting |
| Payment, invoice, and earnings records | For the period required by applicable tax and commercial regulations |
| Captain identity and vehicle documents | While the captain or vehicle is active, and for the period required to demonstrate that verification was performed |
| Photos attached to a request | For the trip lifecycle and any related dispute period |
| Precise location traces | For the trip and a limited period afterwards for safety and dispute purposes |
| Support correspondence | For a limited period after the issue is resolved |
| Technical and diagnostic logs | Short retention, typically weeks to months |
09 Account and data deletion
How to delete your account and personal data
Option 1: In the app. Open Profile, then choose the delete-account option and confirm.
Option 2: By email. Send a request to info@twsila.tech with the subject "Account Deletion Request", stating that the request relates to the Twsila Captain application and the mobile number registered to the account.
We verify that the request comes from the account holder before acting on it, and confirm the outcome to you. Requests are normally completed within 30 days.
What is deleted
Your profile, contact details, uploaded photos and documents, device tokens, and preferences are deleted or irreversibly anonymised.
What may be retained
A limited set of records is retained where the law requires it or where we have an overriding legitimate interest, specifically: financial and invoice records needed for tax and accounting purposes; records of a dispute, safety incident, or fraud investigation until it is concluded; and minimal data needed to enforce a suspension. Retained records are separated from your profile and are not used to contact you.
10 Your rights
Subject to the Personal Data Protection Law of the Kingdom of Saudi Arabia and any other law that applies to you, you have the right to:
- be informed of the legal basis and purpose for collecting your personal data;
- access your personal data and request a copy in a readable format;
- request correction of data that is inaccurate, incomplete, or out of date;
- request deletion of data that is no longer necessary for the purpose it was collected for;
- withdraw consent where processing is based on consent, including by revoking a device permission;
- object to or restrict processing that relies on our legitimate interests; and
- complain to the competent supervisory authority.
To exercise a right, email info@twsila.tech. We may ask for information needed to verify your identity so that we do not disclose data to the wrong person. We respond within the period required by applicable law, normally within 30 days, and we do not charge a fee for a reasonable request.
11 Security
We apply administrative, technical, and physical safeguards proportionate to the sensitivity of the data, including encryption in transit, access control on the principle of least privilege, network and application isolation, credential management, logging and monitoring, and review of providers before they are engaged. Payment credentials are handled by our payment gateway rather than by Twsila.
No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to cause you harm, we will notify you and the competent authority as required by applicable law. Please keep your device and verification codes protected, and contact us immediately if you believe your account has been accessed without authorisation.
12 International transfers
Our infrastructure and service providers may process personal data outside the Kingdom of Saudi Arabia, including in regions operated by our cloud hosting provider and by Google. Where personal data is transferred outside the Kingdom, we transfer it only for the purposes described in this policy and rely on the conditions and safeguards permitted under the Personal Data Protection Law and its implementing regulations, including contractual protections with the receiving party.
13 Contact us
For any question about this policy, or to exercise a privacy right, use the details below.
- Entity
- Twsila
- Privacy email
- info@twsila.tech
- Phone
- +966 53 735 0413
- Location
- Kingdom of Saudi Arabia
For account deletion, please follow the process in section 9 so that we can verify and action the request without delay.
