1. The service. Navo provides information and tools to help you find minibus taxi points and routes. It does not provide transport services, street safety guarantees, or professional legal or financial advice.
2. Your account. You are responsible for your login details and for activity under your account. You must provide accurate information and keep it up to date where the app asks you to.
3. Lawful use. You will not misuse Navo, including by harassing others, uploading illegal content, attempting to breach security, or scraping or overloading systems beyond normal personal use.
4. Location data and other systems. Maps routing and GPS lean on your phone plus outside providers. Answers can miss reality so keep your own eyes on the road and follow every law that applies here.
5. Disclaimer. The service is provided “as available.” To the fullest extent allowed by applicable law, Navo operators disclaim warranties and limit liability arising from use of the app (including reliance on pickup points, timings, fares, or community posts).
6. Pauses. We may block accounts when fraud, harm or dishonest fares show up. Follow the moderation checklist your team publishes.
7. New wording. When big edits land we tell you inside the app. Using Navo after that date means the new rules apply. We keep the notice version beside your signup record.
8. Contact. Reach us through Safety and community under Settings or the support inbox your rollout publishes.

• No hate, harassment, threats, stalking, or targeted abuse.
• No illegal goods or services, scams, impersonation with intent to deceive, or sharing others’ private data without permission.
• Keep taxi chat honest about routes, fares, safety and lawful rules.
• Report serious abuse via the mechanisms in Settings; operators may investigate and enforce these rules.

• Identity and profile: name, email, role, avatar, signup timestamps, moderation status where applicable.
• Operational data: taxi routes, favourites, chats, marshal cues, driver pings, plus extras you toggle in Navo.
• Technical data: types of devices and browsers, coarse location signals, diagnostics, Firebase session identifiers.

• To run authentication, personalization, routing, moderation, notifications, analytics, debugging, fraud prevention, and legal compliance.
• With processors such as Firebase (Google) hosting auth, database, storage, email verification, etc., under their agreements.

• Purpose limitation. Harvest only what fuels accounts, routes, moderation, notifications, receipts, troubleshooting, aggregates, lawful orders, contractual duties. Shed anything cosmetic.
• Processors & transfers. Firebase/Google and ancillary vendors operate on your documented instructions under their DPAs. If backups leave South Africa plug the gap with counsel-approved transfer mechanisms.
• Information officer. The operating entity must designate/register an officer (unless another statute takes priority) and tell commuters how they escalate disputes.
• Integrity & access. Provide practicable avenues for commuters to rectify obvious mistakes and to escalate refusals to the Information Regulator.

Account pauses tied to dishonest fares, abusive chat, or physical safety cues should follow your written moderator playbook—not ad‑hoc guesswork inside the Firebase console alone. The admin tools persist short notes (bannedReason today) alongside timestamps and moderator IDs internally; escalate to disabling Firebase Authentication or law-enforcement liaison when playbook severity demands it. Operators should keep the playbook beside docs/community-moderation.md in source control.

Retain identifiers and chat content only while the lawful purpose plus incident-handling timelines stay valid. Typical operating defaults (adjust with counsel/GDPR hybrids if you widen geography):

• Active commuter profile / Auth user: until the commuter deletes/disables plus any cooling-off spelled out internally.
• Operational backups: follow Firebase/Google retention plus your archival policy (encrypt and inventory off-site clones).
• Moderation trails: keep ban metadata consistent with tribunal or insurer expectations—purge once exposure ends unless law orders longer audits.
• Crash/diagnostic artifacts: strip personal data before indefinite storage.
• Marketing/analytics aggregates: prefer cohort-level metrics inside GA4 dashboards; shorten raw retention inside Google tooling when settings allow.

Settings still lists the quickest human inbox for objections, exports, portability, or objections; bind that mailbox to SLA owners on your side.