What this policy covers
This policy explains what personal information MASHI collects, why, who it is shared with and what you can ask us to do about it. It covers this website, the MASHI rider app once it is released, and the investor portal.
What we collect
- Account information — your name, email address, phone number, and where the law requires identification, the identity details you provide.
- Trip information — when a trip started and ended, which vehicle, the route the vehicle travelled, and what the trip cost.
- Location — the app needs your location to show nearby scooters and to check that a trip is not being started or ended somewhere it may not be. The vehicle reports its own position while a trip is running.
- Payment information — handled by the payment provider. MASHI receives a confirmation and a reference, not your full card number.
- Device and usage information — the pages and screens you open, the app version, the device type and technical logs.
- What you send us — support messages, incident reports and the replies to them.
Why we use it
To run the service and charge for it correctly, to keep riders and the public safe, to investigate incidents and misuse, to meet legal and tax obligations, and to decide where the fleet should be. If you fund a campaign, we also use it to maintain your allocation record, produce your statements and make distributions. We do not sell personal information.
Location, specifically
Location is the most sensitive thing we handle, so it is used narrowly: to run trips, to enforce zones, to find vehicles, and to plan the fleet. Movement data used for planning is aggregated and stripped of anything that identifies an individual rider.
Who we share it with
The payment provider that processes your payment; the fleet technology provider that operates the vehicles' connectivity; and the service providers who host and support our systems. We share information with public authorities where the law requires it, and with insurers or legal advisers where an incident makes it necessary. Everyone we share with is bound to use it only for the purpose we share it for.
How long we keep it
Account information for as long as your account exists, and afterwards for the period the law requires. Trip and payment records for the period accounting and tax rules require. Investor records, including statements and distributions, for the period required of financial records. Support messages for as long as they are useful to resolve the matter, and then no longer.
Your choices
You can ask for a copy of the information we hold about you, ask us to correct it, ask us to delete what we are not required to keep, object to a particular use, or withdraw consent where we relied on it. Turning off location permission is your choice, but the app cannot start a trip without it.
Security
Access to personal data is restricted to the staff who need it for their work. Actions on financial records are logged with the person, the reason and the time. Payment credentials never reach MASHI's own systems. No system is perfectly secure, and if a breach affects you we will tell you.
Children
The service is not for anyone under 18, and we do not knowingly collect information from children.
Changes and contact
This policy will develop as the service launches and as Syrian data-protection requirements settle. Questions, or a request about your own data, should go to the address published on the contact page.