Privacy Policy

1. Who We Are

This Privacy Policy explains how Nyata Ltd ("Nyata", "we", "us", "our") collects, uses, shares and protects your personal data when you use the Nyata AI mobile apps, our website (including the website chat assistant), our WhatsApp channel and our booking services (together, the "Services").

Nyata Ltd is the controller of your personal data for the Services. This includes the chat assistant on our website.

2. Information We Collect

2.1 Information you give us

• Account details: your name, email address and password, and any optional profile details or photo.
• Conversations: messages you send to the AI in the app, the website chat assistant or on WhatsApp, and the AI's replies.
• Bookings: details needed to book taxis, barbers, beauty treatments or cleaning services, such as addresses, dates and times, and contact details.
• Ratings, reviews and feedback you submit.
• Messages to us: emails and support requests.
• Optional equality and diversity information, if you choose to answer those questions (see section 3).

2.2 Information collected automatically

• Device and technical data: device type, operating system, app version, IP address and crash reports.
• Usage data: which features you use and when.
• Location data: precise location while you use taxi booking or tracking (only with your device permission), and approximate location to show nearby Bristol services.
• Push notification tokens, so we can send booking updates.
• Cookies and similar technologies on our website (see section 13).

2.3 Information from others

• Sign-in providers: basic profile details if you sign in with Apple or Google.
• Stripe: payment status and references (never your full card details).
• Operator partners and service providers: booking status updates, and driver and vehicle details for your journey.

2.4 If you list a business or charity on Nyata

If you register a charity, barbershop, beauty salon, cleaning service or other provider, we collect your business and contact details, service listings, availability and booking records so we can publish your listing and pass bookings to you.

3. Sensitive Information

Some information is given extra protection by law ("special category data"). This is how we handle it.

3.1 Health information you share in chat

You may choose to tell the AI about your health or wellbeing, for example to find a GP, a mental health service or a food bank. We only process health information in conversations with your explicit consent, which we ask for in the app. You can withdraw consent at any time in your settings or by contacting us. After that we will stop using that information, although this does not affect processing already carried out. Please don't share health details you would rather keep private. You can still use Nyata without doing so.

3.2 Safeguarding

We monitor conversations and community content for signs that someone may be at serious risk of harm, for example a risk to life or of abuse. Where this happens, a trained member of our team may review the relevant messages and, where necessary, share limited information with emergency services or the appropriate safeguarding organisation. We do this to protect people from harm, relying on the safeguarding conditions in the Data Protection Act 2018 (Schedule 1) and, in an emergency, to protect someone's vital interests. We record these decisions and keep them only as long as needed for that purpose.

3.3 Equality and diversity information

We may invite you to answer optional equality and diversity questions. Answering is entirely voluntary. We use the answers only in aggregated, non-identifying form in our internal analytics dashboard (Nyata Insights) to check that Nyata is reaching and serving people fairly. We rely on the equality of opportunity condition in the Data Protection Act 2018 (Schedule 1).

3.4 Criminal offence data

We do not collect or process criminal records information about users or drivers. Driver vetting, including criminal record checks, is carried out by our licensed private hire operator partners and the local licensing authority, not by Nyata.

4. How We Use Your Information and Our Lawful Bases

We must have a lawful basis under the UK GDPR for each way we use your data. Where we rely on legitimate interests, we have carried out an assessment to check that our interests are not overridden by yours. You can ask us for details.

5. Our AI Features

Nyata's AI generates replies based on your messages and information about Bristol services. Replies can be wrong or out of date, so please check anything important.

5.1 Improving our AI

To improve Nyata, we may review samples of conversations and use them to improve our AI models. Before any conversation data is used to train or fine-tune a model, we remove names, contact details and other direct identifiers. We do not use health information shared under explicit consent, or safeguarding records, for model training. You can object to your conversations being used for improvement by emailing us. We will then exclude your future conversations.

Once de-identified data has been used to train a model, it becomes part of the model's statistical patterns and cannot be individually located or removed from it. This is why we de-identify data first. Deleting your account deletes your stored conversations.

5.2 Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We use automated tools to match bookings and estimate fares. If you have concerns about one of these outcomes, you can ask a person to review it.

6. Taxi Bookings

Taxi journeys booked through Nyata are provided by licensed private hire vehicle (PHV) operator partners. When you book:

• We share with the operator and driver: your first name, pickup and destination, your payment preference and your verification code. This is only what is needed to complete the journey.
• We show you: the driver's name and photo, vehicle details and registration, the licence details supplied by the operator, the driver's rating, and live location and arrival time during the booking.
• The operator is a separate controller of the booking data it receives and is responsible for its own compliance, including driver vetting and licensing records.
• If you use Share My Ride, we share your journey details with the contacts you choose.

7. Payments

Booking fees are processed by Stripe. We store the Stripe payment reference, the payment status (authorised, captured, refunded or cancelled), the amount and timestamps. We never see or store your full card number, expiry date or security code. Stripe processes payment data under its own privacy policy.

8. Who We Share Data With

We do not sell your personal data. We share it only as follows.

8.1 Service providers acting for us (processors)

These providers only act on our instructions and under written contracts:

• Web hosting and email hosting providers
• Stripe (payments)
• Pusher (real-time updates)
• Appilix (push notifications)
• Google Maps Platform (maps, routing and geocoding)
• Google Analytics (website analytics, only with your consent)
• AI model infrastructure providers that process conversations to generate replies

8.2 Providers you book with

These are taxi operators, barbers, beauty professionals and cleaning services. They receive the details needed to deliver your booking and handle them as independent businesses.

8.3 WhatsApp

If you contact Nyata on WhatsApp, your messages are also processed by WhatsApp (Meta) under WhatsApp's own terms and privacy policy.

8.4 Safety and legal reasons

We may share information with emergency services or safeguarding bodies (see section 3.2), or where the law requires it, such as a court order, a request from the police or a regulator, or to protect people's rights and safety.

8.5 Business changes

If Nyata is involved in a merger, acquisition or sale of assets, your data may be transferred to the new owner. We will tell you before your data becomes subject to a different privacy policy.

9. International Transfers

We primarily store your data in the UK. Some of our providers process data outside the UK, for example in the EEA or the United States. When that happens, we make sure there is a lawful transfer mechanism in place. This means a UK adequacy decision, or the ICO's International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses, with any extra safeguards that are needed. No member of our team or contractor based outside the UK is given access to personal data unless an IDTA is in place first.

10. How We Protect Your Data

• Encryption in transit (TLS) and at rest
• Access limited to people who need it, using individual company accounts
• Data protection training for everyone before they are given access to systems, including the ICO's training course and our internal induction
• PCI DSS Level 1 certified payment processing through Stripe
• A documented process for responding to incidents

If a personal data breach is likely to result in a risk to people's rights, we will report it to the ICO within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay.

11. How Long We Keep Data

We keep personal data only as long as we need it, in line with our internal retention schedule. The main periods are:

12. Your Rights

Under UK data protection law you have the right to:

• Access a copy of your personal data
• Rectification: correct data that is inaccurate or incomplete
• Erasure: ask us to delete your data. We may need to keep some records for legal reasons, such as payment records (see sections 5.1 and 11).
• Restriction: ask us to limit how we use your data
• Portability: receive data you gave us in a machine-readable format
• Object to processing based on legitimate interests, including AI improvement, and to direct marketing at any time
• Withdraw consent at any time where we rely on it, for example for health information in chat, analytics cookies and marketing

13. Age Requirement

Nyata is only for people aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete the associated data. If you think a child is using Nyata, please contact us.

14. Cookies

Our website uses necessary cookies to work. We only use analytics cookies (Google Analytics) and any advertising cookies if you accept them in our cookie banner. We set Google Analytics to keep data for 2 months. You can change your choice at any time using Cookie Settings in the footer. Our Cookie Policy has full details.

15. Changes to This Policy

We will update this policy when our practices or the law change, and change the "Last updated" date above. If we make a material change, we will tell you by email or in the app before it takes effect.

16. Contact Us and Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office:

• Website: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF