Privacy Policy

The data controller responsible for your personal data is:

Kooli | Email: privacy@kooli.app

If you have any questions about how we process your data, or wish to exercise any of your rights, please contact us at the address above.

We collect and process the following categories of personal data:

We process your personal data for the following purposes and on the following legal bases:

Kooli uses Firebase Cloud Messaging (FCM), a service provided by Google LLC, to deliver push notifications to your device. To do so, we store FCM tokens associated with your account.

We request permission to send push notifications contextually — for example, after you publish a Trip or submit a Booking — not automatically on app launch.

You may withdraw notification permission at any time through your device settings. Withdrawing permission does not affect your ability to use the Platform.

FCM tokens are stored securely in our database and are updated automatically when your device generates a new token. Old tokens are replaced to prevent stale delivery attempts.

We do not sell your personal data. We share data only in the following limited circumstances:

Kooli operates along African diaspora corridors and our users and infrastructure may be located in multiple countries, including within the European Economic Area (EEA), Africa, and North America.

Where we transfer your personal data outside the EEA to countries without an adequacy decision, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.

Transfers to Google LLC (Firebase / FCM) are covered by Google's Standard Contractual Clauses and adequacy decisions where applicable.

For users in countries with national data protection frameworks (including Nigeria's NDPR, Kenya's Data Protection Act, and similar legislation in other African jurisdictions), we process your data in compliance with applicable local requirements.

We retain your personal data for as long as your account is active, or as long as necessary to provide our services and comply with legal obligations.

• Account data: Retained for the duration of your account and deleted within 30 days of account deletion, subject to legal retention requirements.
• Trip and Booking records: Retained for a minimum of 5 years for legal compliance purposes, even after account deletion.
• Chat messages: Retained for 12 months from the date of the associated chat closure.
• Log data: Retained for up to 90 days.
• FCM tokens: Retained while associated with an active account; deleted on account closure.

When data is no longer needed, we securely delete or anonymise it.

Depending on your location, you may have the following rights in relation to your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Ask us to correct inaccurate or incomplete data.
• Right to Erasure: Ask us to delete your personal data, subject to legal exceptions.
• Right to Restriction: Ask us to restrict processing of your data in certain circumstances.
• Right to Data Portability: Request your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, please contact us at privacy@kooli.app. We will respond within 30 days. We may need to verify your identity before processing your request.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with your national data protection authority. In France, this is the CNIL (www.cnil.fr).

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These measures include:

• Encrypted data transmission (TLS/HTTPS) between the app and our servers.
• Hashed password storage — we never store passwords in plain text.
• JWT-based authentication for all API and WebSocket connections.
• Access controls limiting data access to authorised personnel only.
• Regular security reviews and updates to our infrastructure.

No system is completely secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and relevant authorities as required by law.

Kooli is a mobile application and does not use browser cookies. We may use mobile analytics tools to collect anonymised usage data for Platform improvement purposes.

Any analytics processing is carried out on the basis of our legitimate interest in understanding and improving the Platform, using aggregated and anonymised data wherever possible.

Kooli is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a child under 18 without parental consent, we will delete it promptly.

If you believe a child has registered on our Platform, please contact us at privacy@kooli.app.

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via in-app notification or email at least 30 days before the changes take effect.

We encourage you to review this Policy periodically. Your continued use of the Platform after any update constitutes your acceptance of the revised Policy.

For any privacy-related questions, data subject requests, or concerns, please contact us:

• Email: privacy@kooli.app
• Subject line: Privacy Request — [Your Name]

We are committed to resolving privacy concerns promptly and transparently. If you are not satisfied with our response, you retain the right to escalate to your national data protection authority.