Privacy

Pooly App — Privacy Statement

Effective date: 7 July 2026

Pooly Technologies Limited (NZBN 9429052654923) · Aotearoa New Zealand

This privacy statement explains how Pooly Technologies Limited (we, us, our) collects, uses, stores, shares and protects your personal information when you use the Pooly app (the app). We handle personal information in accordance with the New Zealand Privacy Act 2020 and the Information Privacy Principles.

This statement applies whenever you create an account or use the app.

1. Who we are and how to contact us

Pooly is operated by Pooly Technologies Limited, a company registered in New Zealand. If you have any questions about this statement or your personal information, contact our privacy officer at privacy@pooly.nz or by post at Pooly Technologies Limited, 8 Citrus Grove, Māpua, 7005, New Zealand.

2. Information we collect

We collect the following categories of personal information:

• Account and identity details: your first and last name, email address, phone number and date of birth.
• Identity verification: a government-issued photo ID (a New Zealand driver licence or passport), checked through a trusted third-party verification provider (Didit). We do not store your ID in the app, only your verified name and date of birth. We do not collect biometric information — see section 8.
• Profile information: your profile photo, short bio, travel preferences and, for drivers, vehicle details such as make, model, colour, fuel type and registration number.
• Trip and booking information: the trips you post or book, including routes, pick-up and drop-off points, dates, times, seats and distances travelled.
• Payment information: payments are processed by our payment provider, Stripe. We receive limited details such as a payment reference and status, but we do not collect or store your full card number. Drivers provide bank account details directly to Stripe to receive payouts.
• Communications: messages you send to other members through in-app chat, and any support or bug reports you send us. Your support requests automatically include information about the device, browser and software versions you use to help with diagnosing issues. Pooly staff may review messages for safety, support and dispute resolution.
• Reviews and ratings: the reviews and star ratings you give and receive.
• Location information: the locations you enter or, with your permission, your device location used to set a trip starting point. Exact street addresses you enter are not shown to other users (street numbers are removed).
• Technical and usage information: device and log data, and error reports used to keep the app stable and secure. We do not use advertising trackers.

You do not have to give us any personal information, but if you choose not to provide certain details, we may not be able to offer you an account or some features of the app. Identity verification in particular is required to post rides as a driver and optional to travel as a passenger, so declining it limits what you can do rather than closing your account. Most collection is voluntary; some records must be kept by law — for example, transport legislation requires us to keep certain trip and payment records (see section 11).

Some personal information comes to us from sources other than you — for example, reviews and ratings other members write about you, identity information we receive from Didit, and payment and fraud information we receive from Stripe. Where we collect personal information about you indirectly, we take reasonable steps to make sure you know we have it, unless an exception under the Privacy Act applies.

3. How we use your information

We use your personal information only to provide and operate the app, including to:

• Create and manage your account and verify your identity.
• Match drivers and passengers, and show relevant trips.
• Process payments to the platform and payouts to drivers.
• Support trust and safety, including reviews, ratings and handling reports.
• Send you essential ride updates and, where you have not opted out, other notifications.
• Respond to your support requests and fix problems.
• Provide neutral mediation between users to support resolution.
• Improve the app and keep it secure.
• Meet our legal obligations and respond to lawful requests from authorities.

4. How we handle your personal information

We treat your personal information with care. We collect only what we need to run the app, limit who can access it to staff and providers who need it, and protect it with access controls and encryption in transit and at rest through our service providers. We do not sell your personal information.

5. What other members can see: your public profile

Protecting your identity matters to us, so your public profile is deliberately limited. Other members can see only your first name, your profile photo, your age (calculated from your date of birth), the month and year you joined, the number of trips you have completed, your bio, and your reviews and overall star rating.

Other members cannot see your last name, your email address, your phone number, your date of birth, your exact address or your payment details. Your full name and contact details are kept private and used only where needed to run the service.

6. Payment details

We use Stripe as our payment provider. When you pay for a trip, your card details are collected and processed directly by Stripe under its own security standards (PCI DSS). Pooly never sees or stores your full card number. We keep only limited information such as a payment reference, amount and status so we can show your trips and support you.

Drivers receive payouts through Stripe Connect. Bank account and payout details are provided to and held by Stripe, not stored by Pooly. Refunds are also managed through Stripe.

7. Location privacy

We use precise locations behind the scenes to match trips and show an accurate route, but we do not display anyone's exact address publicly. Trips show a street-level area only, and you arrange a precise meeting point with the other member in the in-app chat once a booking is in place.

8. Identity documents

We use Didit for identity document verification. Didit collects images of your ID document and reads the details printed on it — your name, date of birth and document number — along with information about the device used to submit it. Didit shares the verified details with us so we can confirm your identity and your age, and uses the information to operate and secure its own service, including fraud detection. You can read Didit's privacy policy at https://didit.me/privacy-policy.

We do not collect or process biometric information. Our verification checks the document only. There is no selfie, no liveness or "prove you are a real person" step, and no facial comparison between you and the photo on your ID. No faceprint or other biometric identifier is created, stored or matched, by us or by Didit on our behalf. This is a deliberate choice: it means Pooly's identity checks do not involve biometric processing under the Privacy Act 2020 or the Biometric Processing Privacy Code 2025.

Your government ID is used only to verify that you are who you say you are. ID document images are held securely by Didit, in the European Economic Area, and are deleted 12 months after your verification. Pooly does not keep a copy — we retain only your verified name, date of birth and a record that the check took place.

9. Who we share information with

We share personal information only as needed to run the app:

• Other members: the limited public profile and trip information described above.
• Service providers who process information on our behalf, including Clerk (sign-in and accounts), Supabase (database and file storage), Didit (identity document verification), Stripe (payments and payouts), Mapbox (maps and addresses), Resend (email notifications), Customer.io (onboarding and marketing email), Sentry (error monitoring), PostHog (product analytics) and Vercel (hosting). These providers may store information overseas.
• Authorities or third parties where we are required or permitted by law, or to protect the safety of members or the public (e.g. requests from Police or the New Zealand Transport Agency).

9a. Analytics

We use PostHog to understand how the app is used — which pages people visit, where they get stuck, and whether features work as intended. This covers page visits, actions such as searching or publishing a trip, and general device and browser information. It is linked to your account so we can tell, for example, whether new members are able to book a ride successfully.

We do not send message content, exact pickup addresses, phone numbers, dates of birth or identity documents to our analytics provider, and we do not use it for advertising. PostHog stores this information in the United States. You can read its privacy policy at https://posthog.com/privacy.

We also record how the app looks and behaves on screen during your visit — the pages you move through, where you tap and scroll, and where things go wrong — so we can find the points where people get stuck. These recordings are masked before they leave your device. Everything you type into a form is replaced, so card numbers, passwords and other typed details are never recorded. The card payment screens are left out of the recording altogether, and card details in any case are handled inside Stripe's own secure frames, which our recording cannot see into at all. We also hide message content, phone numbers, saved-card details, and street addresses shown on screen. Recordings are stored by PostHog in the United States and are deleted after a short retention period.

9b. Onboarding and marketing messages

We use Customer.io to send onboarding guidance, reminders and occasional updates about Pooly — for example, a nudge to finish setting up your account or to publish your first ride. To do that we share your email address, your display name and a small set of account facts that decide whether a message is relevant to you, such as whether you have verified your ID, whether you have added a vehicle, and when you last searched, published or booked. Customer.io stores this information in the United States. You can read its privacy policy at https://customer.io/legal/privacy-policy/.

We do not send message content, exact pickup addresses, phone numbers, dates of birth or identity documents to Customer.io.

Messages about your account and your bookings — booking confirmations, ride requests, cancellations and payment receipts — are always sent, because you need them to use the service. Marketing messages are optional: every one carries an unsubscribe link, and unsubscribing there also switches off "Product news" in your notification settings, so the two can never disagree. You can change your preferences at any time in Account → Notifications.

10. Storage, security and overseas transfer

Your information is stored using reputable cloud providers and may be held on servers outside New Zealand. Our main database is located in Australia. Identity document images are held in the European Economic Area by Didit, and our analytics and messaging providers store their information in the United States. Our service providers hold your information on our behalf and may only use it to provide services to us. If we disclose your personal information to an overseas organisation for its own purposes, we will only do so as permitted by the Privacy Act 2020 (IPP 12) — for example, where the organisation is subject to privacy safeguards comparable to those in the Act, or you expressly authorise the disclosure after we tell you that your information may not be adequately protected. No system is completely secure, but we take reasonable steps to protect your information from loss, misuse and unauthorised access.

11. How long we keep information

We keep personal information only as long as we need it for the purposes described here or to meet legal obligations. Identity documents are deleted after the retention period above. Some information may be kept in anonymised or aggregated form for analysis.

If you close your account, we delete or anonymise your personal information within 3 months, unless we need to keep it to meet a legal obligation, resolve a dispute or deal with a safety issue.

The New Zealand Transport Agency requires us to maintain certain records for 12 months, including on payments to drivers, payments made by passengers to Pooly, and distance travelled in each trip.

12. Privacy breaches

If a privacy breach occurs that has caused, or is likely to cause, serious harm, we will notify the Office of the Privacy Commissioner and affected members as soon as practicable, as required by the Privacy Act 2020.

13. Your rights

Under the Privacy Act 2020 you have the right to ask for access to the personal information we hold about you and to request correction of anything that is wrong. We will respond as soon as practicable, and no later than 20 working days after receiving your request. We will not usually charge you for making a request. If we do not make a correction you ask for, you can ask us to attach a statement of the correction you requested to the information. To make a request, contact our privacy officer at privacy@pooly.nz. If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner (www.privacy.org.nz, 0800 803 909).

14. Children

The app is intended for adults and is not directed at children. We do not knowingly collect personal information from anyone under 18, the minimum age to hold an account under our Terms of Use. If we learn that we hold personal information about someone under 18, we will delete it.

15. Changes to this statement

We may update this statement from time to time. We will post the updated version in the app with a new effective date, and where changes are significant we will let you know.

16. Contact us

Questions or concerns about privacy can be sent to our privacy officer at privacy@pooly.nz.