Privacy Policy
How gozy collects, uses and protects your personal data
How gozy collects, uses and protects your personal data · VERSION 3.1 · EFFECTIVE September 2026
1. Scope
1.1 This policy explains what personal data gozy collects, why, who we share it with, how long we keep it and what rights you have. gozy is the controller for that data.
1.2 It applies to subscribers and prospective subscribers; named users and passengers travelling on a booking someone else made; employees of corporate clients who travel on a company account; and visitors to gozy.ai and the account portal.
1.3 If you are travelling on a journey booked by someone else, we hold only what is needed to complete that journey. Your rights under clause 9 apply in full even though you do not hold an account with us, and we will tell you we hold your details in the first message we send you about the trip.
1.4 Our Terms at gozy.ai/terms govern the agreement between you and gozy. This policy is information we are required to give you about your data. It is not a contract and there is nothing here for you to accept.
1.5 Our employees and the drivers who serve gozy journeys receive separate notices.
2. What we collect
| Identity and contact | Name, email address, the mobile number you use on WhatsApp, Emirates ID or passport number, pickup and drop-off addresses |
|---|---|
| Plan and account | Your gozy ID, the plan you bought, its start and end dates, trips and kilometres used and remaining, rollover, freezes, invite codes, referrals |
| Payment | The name you type as it appears on your card, card type, last four digits, expiry, transaction and receipt records. We do not hold your full card number, we do not keep your card on file and we do not require a billing address. |
| Journey and location | Origin, destination, declared stops, times, distance, driver and vehicle assigned, waiting time, flight number, and vehicle GPS during a journey |
| Saved places | Places you choose to save (for example home, office, school) with their address and map coordinates, looked up through Google Maps when you pick them |
| Communications | WhatsApp messages between you and gozy, including those handled by our AI assistant; support tickets; call recordings where you have agreed to them |
| Named passengers | Names and profile details of children or other named users you add |
| Consent records | What you agreed to, when, in what wording, in which language and through which channel — including your acceptance of the Terms at checkout and any marketing consent you give |
| Technical | IP address, device and browser information, cookie data on gozy.ai and the account portal |
2.1 We do not deliberately collect sensitive personal data. Where you volunteer health or accessibility information so that we can serve you properly, we ask for your explicit consent at the point you give it, use it only for that purpose, and delete it when the arrangement ends.
3. Why we use it
3.1 The PDPL treats consent as the default basis and allows processing without it in limited cases, including where necessary to perform a contract with you or to meet a legal obligation.
| Performance of our contract | Creating and administering your account and plan; arranging, dispatching and completing journeys; operating the WhatsApp concierge |
|---|---|
| Contract and legal obligation | Taking the one-off payment for each plan you buy, issuing receipts and invoices, collecting sums due |
| Legitimate purpose and legal obligation | Verifying identity, preventing fraud and misuse; safety, incident investigation and dispute resolution |
| Legal obligation | Meeting tax, accounting and regulatory obligations; responding to lawful requests from authorities |
| Legitimate purpose | Improving the service, using aggregated or pseudonymised data where possible |
| Your consent, at the start of the call | Recording a telephone call |
| Your consent, through the cookie banner | Analytics and other non-essential cookies |
| Your consent, per channel, withdrawable at any time | Marketing and promotional messages |
| Your explicit consent | Health or accessibility information you volunteer |
| Contract, plus explicit parental consent | Data about a child using the nanny escort service |
4. Automated processing and AI
4.1 An AI assistant handles conversations on WhatsApp, interprets booking requests and applies the booking rules. Message content is processed by a third-party AI provider on our behalf, under a written data processing agreement that limits it to processing on our instructions and prohibits its use of your data to train models. Ask us and we will tell you who that provider is.
4.2 Some decisions are applied automatically — declining a booking for insufficient trips or kilometres, or recording a no-show once the waiting clock expires. These follow the published rules in our Terms. You may ask for human review of any automated decision affecting you, and a person reviews any decision that would restrict or end your access to the service.
4.3 We do not use your data for decisions about credit, insurance or employment, and we do not use a child’s data for profiling of any kind.
5. Who we share it with
| Fleet partners and drivers | Your name, mobile number, pickup and drop-off, declared stops and any instruction you give — for the journey in front of them only |
|---|---|
| Payment processor | Payment data. We receive back only a token, the last four digits and the receipt record. We also pass the processor your name, email and gozy ID so that they appear on your receipt. |
| Maps provider | The text you type when saving a place, so that the address and map location can be found |
| Billing, accounting, hosting and database providers | Operational data needed to run the platform, under contract and access control |
| Messaging and AI providers | Your mobile number and message content, to deliver and answer messages |
| Your employer | Where you travel on a corporate account, trip and cost information as set out in that employer’s contract with us |
| Professional advisers | Only what is necessary for legal, tax and audit work |
| Authorities and insurers | Only what is required by law, by a competent authority, or to establish or defend a legal claim |
| A buyer or successor | Subscriber records, subject to the same protections |
5.1 We do not sell your personal data, do not share your contact details with third parties for their own marketing, and do not trade personal data for reprocessing by others. Every processor acting for us is bound by a written contract to act only on our instructions, keep the data secure, and delete or return it when the engagement ends.
6. Transfers outside the UAE
6.1 Some providers process data outside the UAE. We transfer only where the receiving country offers an adequate level of protection recognised for this purpose, where appropriate safeguards are in place — typically contractual commitments equivalent to this policy, including standard contractual clauses where our provider offers them — or where a limited exception in the PDPL applies.
6.2 Ask us and we will tell you which providers process your data outside the UAE, where, and on what basis. We keep that record up to date.
7. How long we keep it
| Plan, payment and invoice records | Seven years from the end of the relevant tax period, to satisfy UAE corporate tax and commercial record-keeping obligations |
|---|---|
| Identity document images | Deleted within 30 days of verification. The document number stays on your account. |
| Journey and trip ledger records | Your last plan plus 24 months |
| GPS and location logs | 90 days, then deleted or aggregated into summary trip records |
| WhatsApp conversation history | 24 months |
| Call recordings | 6 months |
| Data about a child using the nanny escort service | 12 months after your last plan ends |
| Consent records | Your last plan plus six years — these evidence what you agreed to |
| Waitlist and prospects who never bought a plan 1 | 2 months from last contact |
| Marketing opt-outs | Indefinitely, so we do not contact you again by mistake |
7.1 At the end of a retention period data is deleted or irreversibly anonymised. Anonymised data that can no longer identify you may be kept for analysis.
8. Security
Encryption in transit and at rest, and row-level access controls so staff and systems see only what the task requires.
Card data handled entirely by a payment processor operating to card industry security standards — full card numbers never reach our systems.
Named staff access, reviewed when roles change and revoked when people leave, with access to subscriber records logged.
Fleet partners and drivers receive only journey-specific data and hold no standing access to your record.
Data about children is held on a strict need-to-know basis, separately from general operational records.
8.1 If a breach occurs that is likely to put your privacy, confidentiality or security at risk, we will notify the competent UAE data protection authority and, where required, you — setting out what happened, the likely effect and what we are doing about it.
9. Your rights
| Access | To know what we hold and how we use it, and to receive a copy |
|---|---|
| Correction | To have inaccurate or incomplete data corrected |
| Erasure | To have data deleted, except where we must keep it by law — tax and invoice records in particular |
| Restriction | To limit how we use your data while a question about it is resolved |
| Portability | To receive data you gave us in a machine-readable form and have it transferred where technically feasible |
| Objection | To object to processing based on legitimate purposes, and to automated decision-making |
| Withdraw consent | At any time, and as easily as you gave it. This does not affect processing already carried out or processing on another basis. |
9.1 Contact privacy@gozy.ai or message us on WhatsApp. We will verify who you are and respond within 30 days, telling you if we need longer. There is no charge unless a request is manifestly excessive or repetitive. If you are not satisfied with our response you may complain to the competent UAE data protection authority.
9.2 You can also manage your marketing choices, cookie choices and call recording preference yourself at any time from the privacy settings in your account.
10. Children
10.1 Plans are for adults and we do not knowingly allow anyone under 18 to open an account.
10.2 We process data about children as passengers — a named passenger profile, a school run schedule— only where a parent or legal guardian gives explicit consent at the point the service is booked, and we use it only to arrange and complete journeys safely.
10.3 We keep the minimum necessary about a child, share it only with the assigned driver and chaperone, never use a child’s data for marketing or profiling, and delete it 12 months after your last plan ends. A parent or guardian may withdraw consent at any time by writing to privacy@gozy.ai, in which case the service stops immediately, and may exercise all the rights in clause 9 on the child’s behalf.
11. Bookings you make for other people
11.1 When you book a journey for someone else, we ask you to confirm that you have that person’s permission and that they know their details will be shared with the driver. Please do not add someone without telling them.
11.2 We tell that person directly in the first message we send them about the journey, and point them to this policy so they can exercise their rights.
12. Marketing, cookies and changes
12.1 We send marketing only with your consent, given separately for each channel — at present by email only, never on WhatsApp — and within the hours and frequency limits UAE telemarketing rules permit. Every marketing message identifies gozy and tells you how to stop. Reply STOP or contact us and we will stop across every channel, and we keep a record of your opt-out. We do not make automated marketing calls and do not pass your number to anyone else for marketing.
12.2 gozy.ai and the account portal use cookies necessary to make the site work — session management, security, load balancing — which are set without consent because the site cannot function without them. Analytics and other non-essential cookies are set only with your consent through the cookie banner, and no such cookie is set before you accept. You can change your choice at any time from the link in the site footer.
12.3 Our checkout is hosted on gozy.ai and the payment fields are provided by our payment processor. Your card details are entered directly into the processor’s components and are not seen or stored by gozy.
12.4 We may update this policy. The current version and its effective date are always at gozy.ai/privacy, we keep dated previous versions available at a stable address, and where a change materially affects how we use your data we will tell you directly before it takes effect.
13. Contact
| Privacy questions and rights requests | privacy@gozy.ai |
|---|---|
| General service enquiries | support@gozy.ai |
| Postal | HD14A, First Floor, in5 Tech, Dubai Internet City, Dubai, UAE |
| Supervisory authority | The competent UAE data protection authority |
Published in English and Arabic at gozy.ai/privacy and gozy.ai/ar/privacy. Where the two texts differ, the English text prevails.