Privacy policy
How Toubbali OÜ handles information for Yallah.
Updated 11 October 2026 · Website and pre-launch service
1. Who is responsible
Toubbali OÜ, Estonian registration number 17054922, is the controller of personal information processed for Yallah. Our registered address is Soo tn 13-7, Põhja-Tallinna linnaosa, Tallinn, Harju maakond, 10414, Estonia. Contact hello@getyallah.com for privacy questions or requests.
2. Website visitors and enquiries
This website has no advertising trackers, analytics scripts or contact forms. Hosting infrastructure may process your IP address, requested URL, browser information and request time to deliver and protect the website. When you email us, we receive your email address, message and information you choose to include. We use these to respond to you, based on our legitimate interests in operating a secure website and answering enquiries, or to take steps you request before entering a contract.
3. Rider and driver service
Yallah is preparing for launch. If you participate in testing or use the apps when available, the features you use can involve:
- Phone number, name, preferred language, login verification and session information.
- Pickup and destination, trip history, quoted fares, trip status, ratings and support or safety reports.
- Location: a rider’s location when permitted for pickup; a driver’s precise location while online or handling a trip, including background location when enabled. Driver location supports matching, pickup, trip tracking and safety.
- Trip messages, voice notes or shared locations you send.
- For drivers: identity, licence, vehicle and supporting documents submitted for verification, document expiry information and account or billing records.
- Device and app version, notification tokens and technical information needed for reliability, security and support.
We use necessary account and trip information to provide the service and carry out our contract with you. We process verification and accounting information where required by law, and use proportionate security, abuse prevention and support records for our legitimate interests. Where consent is required, we request it separately. Device permissions can be changed in your phone settings; disabling location may prevent location-dependent features from working.
4. Who receives information
Relevant trip and contact information is shared with the rider or driver involved in your journey. Authorised staff access information needed for operations, verification, support and safety. Service providers support hosting (Hetzner), document and media storage (Backblaze), maps and notifications (Google/Firebase), and phone verification (Twilio). Provider use depends on the features enabled. We do not sell personal information. We may disclose information when legally required or necessary to establish, exercise or defend legal claims.
5. Storage and international processing
Our application hosting is in the EU. Configured document and media storage is in Backblaze’s US East region. Other providers may also process information outside your country or the European Economic Area. Applicable transfer requirements and appropriate safeguards must be addressed before public launch; this notice does not claim that every provider agreement or transfer review has already been completed.
6. Retention and deletion
We keep information for the purpose for which it was collected, taking account of support, security, legal and accounting needs. The current application is configured to prune detailed trip location trails older than 90 days. Driver document cleanup is scheduled 90 days after account deletion. Cleanup runs asynchronously, and backup copies can persist until their normal rotation. Trip records are retained with account identity removed on deletion; financial and legal records may need to be retained. Other category-specific retention periods are being finalised before public launch. Email us for the retention information relevant to your data.
7. Your choices and rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it. Send requests to hello@getyallah.com; we may need proportionate verification of your identity. You may complain to the Estonian Data Protection Inspectorate (AKI) or your relevant local supervisory authority. Account deletion is available in the apps and can also be requested through our account deletion page.
8. Updates
We will update this policy when the service or its data handling changes. Material changes will be communicated as appropriate. The current version and update date appear on this page.