Privacy Policy

Last Updated: May 31, 2026

1. Introduction and Scope

This Privacy Policy ("Policy") explains how Hopon Pakistan ("Hopon," "we," "us," "our," or "Company") collects, uses, stores, processes, and protects personal data when you access or use the Hopon platform, including the mobile application and website (the "Service").

This Policy applies to all Users, including Riders, Drivers, and other individuals who interact with the Service. Please read this Policy carefully. If you do not agree with our data practices, you should not use the Service.

2. Data Protection Principles

Hopon is committed to responsible data handling based on these principles:

• Lawfulness: We process data only with a valid legal basis (consent, contract, legal obligation, etc.)
• Fairness: We are transparent about our data practices
• Minimization: We collect only data necessary for the specified purposes
• Security: We implement technical and organizational measures to protect data
• Accountability: We document our data practices and respond to user rights requests

3. Data We Collect

3.1 Information You Provide Directly

Account Registration:

• Full name, email address, phone number, date of birth, gender
• Profile photo and emergency contact information
• Payment method (credit/debit card details are processed by third parties; we retain only tokenized references)

Driver-Specific Information:

• Government-issued ID (National ID, Passport, or CNIC)
• Driver's license number and expiry date
• Vehicle registration documents, details (make, model, color, license plate)
• Insurance information and bank account information for fund transfers

Rider-Specific Information:

• Preferred routes and destinations, saved addresses (home, work, frequent locations)
• Rider preferences (gender preference for driver, accessibility needs)

3.2 Information Collected Automatically

• Location Data: Real-time GPS location during Trip booking and travel; location history for matched Trips; geofencing data for pickup/dropoff radius matching
• Device Information: Device type, OS, version, device identifier, IP address, app version, crash logs
• Usage Data: Features accessed, Trip details, search history, interaction patterns
• Payment Data: Transaction history, payment method type (not full card numbers), billing address
• Behavioral Data: Driver/rider ratings, cancellation history, safety incident reports
• Session Recordings: We record anonymized replays of your in-app activity (clicks, scrolls, taps, page transitions, and form interactions — with password and other sensitive input fields automatically masked) together with browser console logs and network metadata. These recordings are used to diagnose bugs, understand user flows, and improve usability.
• Product Analytics Events: Custom events are captured when you take key actions (e.g. sign up, complete your profile, post a ride, approve a match, complete a ride). Each event includes minimal contextual properties (such as role, distance, or fare estimate) but never includes the contents of chat messages, identity documents, or payment details.

3.3 Information from Other Sources

• Background check results and ID verification results from third-party verification services
• Transaction status and fraud indicators from payment processors
• Reviews, ratings, and complaints filed by other Users

4. Purpose of Data Collection and Use

4.1 Core Service Provision

• Matchmaking: Compare Trip preferences, routes, schedules, and user preferences to match compatible Riders and Drivers
• Trip Management: Facilitate Trip bookings, provide routing and navigation assistance
• Communication: Enable in-app communication between Drivers and Riders
• Payment Processing: Calculate fares, process payments, generate invoices, manage refunds
• Account Management: Create and manage your account, verify identity, authenticate access

4.2 Safety and Fraud Prevention

• Verify identity, driver's license, vehicle registration, and insurance
• Monitor for unsafe driving patterns, harassment, or dangerous behavior
• Identify and prevent fraudulent bookings, fake accounts, payment fraud
• Investigate safety complaints, accidents, disputes, and violations

4.3 Analytics and Service Improvement

• Analyze usage to identify bottlenecks, bugs, and improvements
• Improve matching algorithm accuracy and efficiency
• Analyze demand patterns to improve service availability

4.4 Marketing and Communication

• Send Trip reminders, promotional offers, and safety announcements
• Personalized route and driver recommendations based on preferences

4.5 Legal and Regulatory Compliance

• Comply with court orders, government requests, and applicable laws
• Maintain records for Driver income reporting and tax compliance
• Comply with AML and KYC requirements from financial regulators

5. Legal Basis for Data Processing

6. Data Retention

6.1 Active Account Data

• Account information (name, email, phone): For the duration of your account and as long as necessary for legal, tax, or contractual purposes
• Trip history: For 7 years (to comply with tax and accounting regulations in Pakistan)
• Payment records: For 7 years (to comply with financial regulations)
• Communication records: For 2 years after the last interaction
• Device and usage analytics: For 1 year
• Location data: Real-time location data is deleted after Trip completion; historical data retained for 6 months

6.2 Deleted Account Data

When you delete your account, account information, Trip history, communication records, and device analytics will be deleted or anonymized, except payment records which are retained for 7 years as required by financial regulations.

6.3 Photo and Identity Document Retention After Account Deletion

Important: Even after you delete your account, we will retain profile photos for 6 months and government ID photos and verification documents for 6 months post-deletion. This is to prevent duplicate account creation and fraud — banned Users often attempt to circumvent suspension by creating new accounts. After 6 months, all photos and identity documents will be permanently deleted.

6.4 Data Retention for Legal/Dispute Purposes

If you are involved in an accident, safety complaint, or legal dispute, all related data will be retained for the duration of the dispute and for 3 years thereafter.

6.5 Anonymized Data

After retention periods above, we may retain anonymized or de-identified data for analytics and service improvement. Anonymized data cannot identify you and is not subject to deletion requests.

7. Data Storage and Security

7.1 Data Storage Location and Transfers

Your personal data is processed and stored on Amazon Web Services (AWS) cloud infrastructure in the Tokyo, Japan region. By using the Service, you explicitly consent to the transfer of your personal data outside of Pakistan for processing, storage, and backup.

7.2 Security Measures

Technical Controls:

• Encryption in Transit: All data uses TLS/SSL encryption (minimum TLS 1.2)
• Encryption at Rest: Sensitive data is encrypted using AES-256 encryption
• Password Security: Passwords are hashed using bcrypt; we do not store plaintext passwords
• Access Controls: Role-based access control (RBAC) limits employee access
• API Security: APIs use OAuth 2.0 and API key authentication

No security system is impenetrable; we cannot guarantee 100% security. Users are responsible for maintaining the confidentiality of their passwords.

7.3 Breach Notification

In the event of a data breach, we will investigate and notify affected Users without unreasonable delay via email to the address associated with your account.

8. Your Rights

8.1 Right to Access

You may request a copy of the personal data we hold about you by emailing admin@hopon.pk or via Settings > Privacy > Request My Data. We will make reasonable efforts to respond within 30 days.

8.2 Right to Rectification

You may correct inaccurate or incomplete personal data directly in the app (Settings > Account) or by emailing admin@hopon.pk.

8.3 Right to Erasure ("Right to Be Forgotten")

You may request deletion of your personal data by emailing admin@hopon.pk with the subject "Data Deletion Request" or via Settings > Privacy > Delete My Account. We will make reasonable efforts to respond within 30 days, subject to the retention limitations described in Section 6.

8.4 Right to Data Portability

You may request your personal data in a structured, commonly used format by emailing admin@hopon.pk with "Data Portability Request". We will provide Trip history, profile information, ratings, and communications in CSV or JSON format within 30 days.

8.5 Right to Object

• Marketing Communications: Opt out via Settings > Notifications or unsubscribe via email
• Analytics: Disable non-essential analytics via Privacy Settings
• Location Services: Disable GPS on your device (note: this may limit Service functionality)

9. Third-Party Data Sharing

9.1 Service Providers

9.2 Law Enforcement and Government Requests

We may disclose personal data to law enforcement, courts, and government agencies if legally required via court order, search warrant, or subpoena. Where legally permitted, we may notify affected users.

9.3 Business Transfers

If Hopon is acquired or merged, personal data may be transferred to the acquiring company. Users will be notified and given an opportunity to object or delete their data.

10. Data Protection Compliance

Hopon complies with applicable data protection laws in Pakistan, including the Personal Data Protection Ordinance 2020, Prevention of Electronic Crimes Act (PECA) 2016, Pakistan Telecommunications Authority (PTA) rules, and State Bank of Pakistan (SBP) guidelines on consumer data and KYC compliance.

11. Cookies and Tracking Technologies

We use the following types of cookies and similar local storage technologies:

• Essential Cookies: Session IDs, security tokens, and preference settings required for Service functionality
• Analytics & Product Cookies: Google Analytics, Firebase Analytics, and PostHog to understand user behavior, build conversion funnels, and diagnose drop-off
• Session Replay: PostHog stores a pseudonymous session ID in browser localStorage so that recorded interactions during a single visit can be played back together. Recordings mask password fields, OTP inputs, and other inputs marked as sensitive.
• Marketing Cookies: Retargeting pixels and ad conversion tracking

You can manage cookies via your browser settings or via Settings > Privacy > Tracking Preferences in the app. If you wish to opt out of session recording specifically, contact admin@hopon.pk and we will exclude your account from replay capture.

12. Children's Privacy

The Service is intended for users age 18 and older. We do not knowingly collect personal data from children under 18. If you believe your child has created an account, please contact us immediately at admin@hopon.pk. If we discover we have collected data from a child under 18, we will delete it immediately.

13. Updates to This Privacy Policy

Hopon reserves the right to modify this Privacy Policy at any time. We will make reasonable efforts to notify you of material changes via email and in-app notification at least 30 days before they take effect. Your continued use of the Service constitutes acceptance of the updated Privacy Policy.

14. Contact

For privacy inquiries, data subject requests, or complaints:

Hopon Pakistan
Email: admin@hopon.pk
Response time: We make reasonable efforts to respond to all privacy inquiries within 3–5 business days.

15. Acknowledgment

By using the Service, you acknowledge that you have read and understood this Privacy Policy, consent to the collection and processing of your personal data as described, consent to the transfer of your personal data to AWS (Tokyo region) for processing, and accept the photo retention policy for 6 months after account deletion.