Privacy Policy

Check-In is a service that transport companies use to manage their fleet and drivers and to count passengers from trip recordings. Accounts are created by invitation only: companies and their Transport Admins are set up by Check-In, and drivers are added by their company’s Transport Admin.

This policy applies to everyone whose information Check-In handles:

• Users of the web dashboards and the mobile app (Transport Admins, drivers and Check-In administrators).
• Transport companies that subscribe to Check-In, and their contact people.
• Passengers and drivers who appear in trip recordings. The transport company decides to record its trips and uploads the recordings; Check-In processes them on that company’s behalf. Questions about a recording, or about being recorded, should go to the transport company that operates the vehicle.

• Account details: name, email address, role, the company you belong to, and when you were last active. Your password is stored only as a one-way hash; we never store or see it in plain text.
• Company details: company name, registration and tax numbers, contact person, email, phone number, address, subscription plan and billing status.
• Driver details (entered by the Transport Admin): phone number, driver’s licence number, licence and professional driving permit (PrDP) expiry dates, and the vehicle assigned to the driver.
• Vehicle details: fleet number, registration, type, make, model, capacity and status.
• Trip recordings: the video file and its name and size, the shift date and times, optional notes, and the results: boarding and alighting counts and an hourly breakdown. Videos can show passengers and the driver.
• Payment details: card payments are made on Paystack’s secure checkout page, and your full card number never reaches Check-In. We keep the card type and last four digits, Paystack’s customer and subscription references, and a history of payments (amount, date, plan and status).
• Sign-in and device details: sign-in sessions (with your browser or app’s user-agent text), and, if you use the mobile app, the push-notification token and platform (iOS or Android) of your phone.
• Security information: your IP address is used to limit repeated sign-in, password-reset and other requests, and error logs may contain account or recording identifiers (never passwords or cookies).
• Notifications we show you in the app, such as “Results ready” or “Payment received”.

• To provide the service: create and secure accounts, manage fleets and drivers, and show each company its own data.
• To count passengers: recordings are analysed to count people boarding and alighting, and the results are shown to the transport company and the driver who uploaded them.
• To send service emails: invitations, password-reset codes and security notices such as “your password was changed”.
• To send in-app and push notifications about recordings, drivers, vehicles and your subscription.
• To take subscription payments and manage plans, renewals and cancellations.
• To keep the service secure: prevent unauthorised access, stop abuse and investigate errors.

Inside Check-In. Transport Admins see their own company’s vehicles, drivers and recordings. Drivers see their own profile and their own recordings. Check-In administrators can see company and user accounts to run and support the service. No company can see another company’s data.

Service providers. We use trusted providers to run Check-In, and they process information only to provide their service to us:

• a passenger-counting service that receives and analyses trip videos;
• hosting, database and file-storage providers;
• an email delivery provider for invitations, codes and notices;
• Paystack, for card payments and subscriptions;
• Firebase Cloud Messaging (Google), to deliver push notifications to the mobile app.

We do not sell personal information and we do not use it for advertising. We may disclose information where the law requires it.

Check-In uses only cookies that are essential for signing in. It uses no analytics, advertising or third-party tracking cookies.

Because these cookies are needed for the service to work, they can’t be switched off while you use it.

• Account, company, driver, vehicle and recording information: for as long as the account or company exists.
• Web sign-ins last up to 7 days and mobile app sign-ins up to 30 days. Changing your password signs out every other device.
• Password-reset codes expire after 10 minutes, reset links after 15 minutes and invitations after 7 days.
• Notifications are deleted automatically after 90 days.
• Push-notification tokens are removed when you sign out of the app, or after 30 days without use.
• Records used to limit repeated requests (which include IP addresses) are deleted automatically within about an hour.
• Payment records are kept after a company is deleted, because we need them for accounting.

When an account, driver, recording or company is deleted, its information is removed from Check-In. Deleting a company removes its users, vehicles, drivers and recordings. Copies of trip videos held by the passenger-counting service may remain there for a period after deletion; contact us if you need them removed.

• Connections to Check-In are encrypted (HTTPS).
• Passwords are stored as strong one-way hashes, and sign-in, reset and invitation codes are stored only in hashed form.
• Every request is checked against your role and company, so you only ever reach your own company’s data.
• Repeated failed sign-ins temporarily lock sign-in, and requests are rate limited.
• In Check-In, videos are only shown through signed links that expire.

Some of our service providers, such as payment, email and push-notification providers, may process information outside South Africa. Where that happens, POPIA requires the information to stay adequately protected, and we choose providers with that in mind.

Under the Protection of Personal Information Act (POPIA) you can:

• ask whether we hold information about you, and for a copy of it;
• ask us to correct or delete information that is inaccurate, out of date or no longer needed;
• object to how your information is used, in the circumstances the law allows;
• complain to the Information Regulator of South Africa (inforegulator.org.za).

You can update your own name on your Profile page at any time. Transport Admins can delete their own account from the Profile page. Drivers’ details are managed by their Transport Admin, so drivers should ask them for changes or deletion. Passengers should contact the transport company that operates the vehicle.

Check-In is a business service and is not intended for children. Accounts are only created for people invited by a transport company.

We may update this policy as the service changes. The date at the top shows when it was last updated, and we’ll let you know in the app or by email about important changes.

For questions about this policy or your information, reply to any email you have received from Check-In, or ask your company’s Transport Admin to contact us. See also our Terms of Service.