Privacy Policy

Who we are

Developer / Data Controller: Solutions Through Technology (South Africa).

Contact & Information Officer (POPIA): support@solutionsthrough.tech

Data we collect

• Location (approximate and/or precise) — to show local emergency contacts and features. During an Emergency Tracking or Travel Check-in session that you start, location is also accessed in the background (including when the app is closed or the screen is off) to generate GPS updates sent to your Next of Kin via SMS. Background location is never used outside a tracking session you started.
• Next of Kin and saved contacts — names, phone numbers, and optional notes that you add. Stored locally in encrypted storage on your device; used to send emergency SMS updates and to help you call or message contacts quickly.
• App-linked Next of Kin: our backend stores account IDs, an opaque relationship ID, invitation/consent state and timestamps. Current invitations do not use the contact's phone number as the server relationship key. Older phone-based links may retain the nominated phone number and account relationship until removed or deleted. Local contact names and notes are not uploaded as an address book.
• Emergency and Travel Check-in records: when you use app-linked alerts or sharing, the backend processes the selected account relationships, sender display name, event/journey identifiers, status and acknowledgement/seen timestamps. It stores the latest available location snapshot (coordinates, source, accuracy and capture time) for the authorized selected recipients' map. This is separate from SMS and is not continuous live tracking. Internet and an authenticated account are required for this supplementary channel.
• Profile and account data (if provided) — name, surname, phone number, email, and Firebase Auth UID. Used for profile management, entitlements, and support.
• Device and app identifiers — a per-installation ID (non-permanent), device model/OS, and app version. Used for security, entitlements, and diagnostics.
• Purchase information — Google Play product IDs and purchase tokens to verify subscriptions and entitlements. We do not receive full payment card details.
• Push notification data — Firebase Cloud Messaging (FCM) token and topic subscriptions (plan tier, home country, optional anchor label).
• Diagnostics and usage analytics — privacy-filtered crash categories, performance metrics, and app usage events (via Firebase Analytics / Crashlytics). Neither service receives precise or manually entered coordinates; addresses, place names or service names; contacts, phone numbers or phone hashes; profile details; Firebase Auth UID or RapidE installation ID; stored JSON; or arbitrary error text from RapidE telemetry.
• Support communications — information you send us by email or in support requests.

How we use data

• Provide core emergency features and improve reliability.
• Send automatic GPS location updates via SMS to your chosen Next of Kin during a tracking session. This happens on your device and is not routed through our servers.
• Separately, provide app-linked emergency alerts and emergency/Travel maps using the latest location snapshot on our backend. Access is restricted to the sender and eligible selected account-linked recipients; an acknowledgement records that someone saw an alert, not that help was dispatched or anyone is safe.
• Verify and manage subscriptions and free trials.
• Enforce one active device per subscription with quick transfer.
• Detect and prevent abuse, fraud, or misuse.
• Comply with law and regulatory obligations.

Legal bases (GDPR / POPIA)

• Consent — for optional features like background location, SMS tracking, and push notifications.
• Contract — to provide paid subscriptions and core app functionality.
• Legitimate interests — to improve reliability, prevent abuse, and secure the service.
• Legal obligations — to meet accounting, fraud prevention, or other regulatory requirements.

Data sharing

• Service providers: Google Play Billing, Firebase (Auth, Firestore, Functions, Remote Config, Analytics, Crashlytics, Cloud Messaging).
• No advertising use of Analytics: Firebase Analytics uses its automatically generated, resettable pseudonymous identifier. RapidE does not set an Analytics User-ID and does not use Analytics data or identifiers for advertising, remarketing, or ad personalization.
• No Advertising ID / AdServices: RapidE does not request the Advertising ID or Android AdServices advertising/attribution permissions. Advertising ID collection, SSAID collection, advertising storage, advertising user-data consent, and ad-personalization signals are disabled in the App's Firebase Analytics configuration.
• SMS delivery: messages sent during tracking are delivered by your mobile carrier directly to your Next of Kin contacts. We do not see, store, or intercept these messages.
• We do not sell personal data.

Data retention

• On-device data (contacts, preferences, tracking state) is stored locally and retained until you delete it in the app, reset the app, or uninstall it.
• Server-side profile and entitlement data is kept while your account is active and removed when you request deletion.
• Supplementary emergency and Travel maps retain the latest location rather than a route history. Server cleanup is scheduled to remove precise snapshots after sharing ends/expiry, using a maximum twelve-hour latest-point retention window and an hourly cleanup job. Removal can be delayed by service failure. Event and acknowledgement metadata has a separate lifecycle; account deletion removes owned records and removes or anonymizes the account's participation in other relationships/events. Older phone-based links are included in account deletion.
• Purchase records are retained as required for accounting and fraud prevention.
• Analytics and crash data are retained according to Firebase retention settings.

Security

• We use encrypted transport and restricted access for backend services.
• Next of Kin contacts and tracking state are stored in encrypted storage on your device and are not accessible to other apps.

Permissions used and why

Your choices and controls

• You may disable location, though some emergency features will be limited.
• You may disable background location; tracking updates may be degraded when the screen is off.
• You may revoke SMS permission; emergency tracking will not function without it.
• You may opt in or out of push notifications in app settings or device settings.
• You may turn Share usage analytics on or off in Settings. Firebase automatic Analytics starts disabled until RapidE successfully reads and applies your saved choice. Turning the switch off immediately requests native Firebase collection disablement and stores the choice. Turning it on does not enable collection unless the preference is stored successfully. If RapidE cannot confirm the requested state, it shows an error and does not present the request as completed.
• Privacy-filtered Crashlytics diagnostics remain separately enabled for reliability when usage Analytics is off. Crashlytics receives code-owned categories and technical stack information — not RapidE contact, profile, location, stored-JSON, or arbitrary-error content.
• You can export your data from within the app (Settings → Data Export).
• You can review or revoke any permission at any time in Android Settings → Apps → RapidE → Permissions.
• RapidE has no advertising use case and does not collect or use advertising identifiers, advertising storage, advertising user data, remarketing data, or ad-personalization signals in the App.

Your rights (GDPR / POPIA)

• Access — request a copy of your personal data.
• Correction — request updates to incorrect or incomplete data.
• Deletion — request erasure of your personal data, subject to legal/contractual requirements.
• Objection or restriction — object to or restrict certain processing in appropriate circumstances.
• Portability — request export of your data in a portable format.
• Withdraw consent — you may withdraw consent at any time for features that rely on consent.

International transfers

Data may be processed in regions where our providers operate. We use reputable service providers and apply reasonable safeguards for cross-border transfers.

Children

RapidE is not directed to children under 13. If you believe a child has provided personal data, please contact us and we will take appropriate action.

Complaints

You may lodge a complaint with your local data protection authority.

Updates to this policy

We may update this policy; material changes will be reflected here with a new effective date.