Privacy Policy

1 Who We Are

Boreze is a technology platform that provides passengers with a convenient way to search, book, and pay for inter-city bus travel. We partner with licensed bus operators ("Bus Companies") across Africa to make their schedules and seats available through our platform.

Boreze is headquartered in Bamenda, Cameroon and serves travellers across the African continent.

For the purposes of data protection, Boreze acts as the data controller for the personal data collected during the booking process, and as a data processor on behalf of Bus Companies for passenger information necessary to fulfil a journey.

2 Data We Collect

We collect personal data in the following categories:

We do not collect sensitive personal data such as racial origin, health information, religious beliefs, or biometric data.

We do not store full payment card numbers. Mobile money payments are processed by your mobile network operator; we only receive a transaction reference and status confirmation.

3 How We Use Your Data

We use your personal data for the following purposes:

• confirmation_numberBooking fulfilment — to create, confirm, and manage your bus tickets.
• local_phoneTicket retrieval — to allow you to look up existing bookings using your phone number at any time, without requiring an account.
• chatTransit notifications & messaging — to provide customer service, send ticket confirmations, provide transit booking notifications, and facilitate travel reservations via WhatsApp and SMS.
• paymentsPayment processing — to initiate, verify, and record mobile money transactions.
• directions_busBus company coordination — to share your passenger details with the Bus Company operating your chosen journey so they can confirm your seat and print your ticket.
• support_agentCustomer support — to resolve booking issues, cancellations, or payment disputes via our platform and WhatsApp channels.
• bar_chartService improvement — to analyse how users interact with the platform so we can improve search results, fix errors, and add features (this is done on aggregated, anonymised data wherever possible).
• verified_userLegal compliance — to meet obligations under applicable law, including the retention of financial records and cooperation with regulatory authorities.

4 WhatsApp & Messaging Communications

When you communicate with Boreze via WhatsApp, we process your phone number, message metadata, and conversation content to handle bookings, answer inquiries, and provide customer support. Messaging data is transmitted securely via Meta's WhatsApp Business API infrastructure in accordance with Meta's privacy standards and our data protection policies.

Specifically regarding WhatsApp and messaging interactions:

• chatData collected via WhatsApp: phone numbers, profile display names, inbound message content, order details, and transaction status.
• task_altPurpose of use: to provide customer service, send ticket confirmations, provide transit booking notifications, and facilitate travel reservations.

We do not use WhatsApp to send unsolicited marketing messages or share your messaging contact information with unauthorized third parties.

5 Who We Share Data With

We may share your personal data with the following parties:

• businessBus Companies — the operator of your booked trip receives your passenger name, ID card number, phone number, seat number, and ticket class. This is strictly necessary to issue your ticket.
• chatCommunication Infrastructure Providers (Meta / WhatsApp) — we use Meta's WhatsApp Business API infrastructure to securely deliver ticket confirmations, transit booking notifications, and customer support communications.
• smartphoneMobile Money Providers — when you initiate a payment, your phone number is shared with the mobile money operator (e.g. MTN Mobile Money, Orange Money) solely to process the transaction.
• cloudCloud Infrastructure Providers — our platform runs on Google Cloud Platform. Data is hosted in data centres located within or compliant with applicable data protection standards.
• codeThird-Party Developers (API partners) — if a Bus Company accesses the Boreze API using a developer API key, they may receive trip and booking data as part of their integration. All API partners must agree to our developer terms, which include data protection obligations.
• gavelLegal Authorities — where required by law or court order.

We do not sell, rent, or otherwise commercially exploit your personal data to any third party.

6 Data Retention

We retain your personal data only for as long as necessary to fulfill the service or satisfy legal obligations:

• scheduleBooking records (passenger name, ID, route, payment reference) are kept for 5 years after the travel date to comply with financial record-keeping requirements.
• chatWhatsApp communications & messaging records are retained for up to 2 years to ensure continuous customer service history and resolve booking disputes, after which they are deleted or irreversibly anonymised.
• analyticsTechnical and usage logs are retained for a maximum of 12 months, after which they are automatically deleted or anonymised.
• supportSupport correspondence is kept for 2 years from the date of last contact.

When data is no longer required, it is securely deleted or irreversibly anonymised.

7 Security

We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• httpsAll data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• lockAccess to production databases is restricted by role-based access control and multi-factor authentication.
• vpn_keyAPI keys are hashed and never stored in plain text.
• manage_searchWe conduct periodic security reviews of our infrastructure and codebase.

No method of electronic transmission or storage is 100% secure. If you suspect unauthorised access to your booking, please contact us immediately at privacy@boreze.com.

8 Your Rights & Data Deletion Instructions

You have the following rights with respect to your personal data. To exercise any of them, contact us at privacy@boreze.com.

We will respond to verified requests within 30 days. We may need to verify your identity before processing a request.

9 Cookies & Tracking

Boreze is designed with low-bandwidth users in mind. We use only essential session data (stored in your browser's local storage or session storage) to maintain your booking state during a visit. We do not use advertising or tracking cookies.

Technical session data is cleared when you close your browser tab or complete a booking. We do not set persistent tracking cookies.

10 Third-Party Services

Our platform integrates with the following third-party services:

• cloud_queueGoogle Cloud Platform — hosting and infrastructure.
• chatMeta Platforms, Inc. (WhatsApp Business API) — messaging and transit notification infrastructure.
• smartphoneMTN Mobile Money & Orange Money — payment processing.

Each third-party provider operates under its own privacy policy. We encourage you to review them if you have concerns about how those providers handle your data.

11 Children's Privacy

Our platform is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without verifiable parental consent.

When a booking includes child passengers, the child's personal data (name, ID if applicable) is provided by the adult making the booking and is used solely to issue the child's ticket. This data is subject to the same protections described in this policy.

If you believe we have inadvertently collected personal data from a child under 16 without appropriate consent, please contact us immediately and we will delete it.

12 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the effective date at the top of this page.

We encourage you to review this policy periodically. Continued use of the Boreze platform after changes take effect constitutes acceptance of the updated policy.

13 Contact Us

If you have any questions about this Privacy Policy, want to exercise your rights, or wish to raise a data protection concern, please reach us through any of the channels below:

schedule We aim to respond to all privacy enquiries within 5 business days.