Who we are
MyLyft Technologies Ltd provides MyLyft ride booking, driver, payment, support, and account services for users in the United Kingdom.
For privacy questions, data rights requests, or account deletion questions, contact privacy@mylyft.co.uk.
Personal data we collect
We collect the information needed to create accounts, verify users, request rides, match drivers, process payments, provide support, keep records, and keep the platform secure.
- Account data: name, username, email address, phone number, password credentials, profile image, user type, verification status, and login method.
- Trip data: pickup and drop-off addresses, coordinates, route, ride type, fare estimate, schedule time, assigned driver, vehicle, plate, status history, cancellation reason, ratings, and support notes.
- Location data: rider pickup/drop-off location and driver location while drivers are online or assigned to a trip, including live tracking updates.
- Payment data: payment method type, Stripe or PayPal payment references, payment status, refund records, receipts, and billing metadata. Full card numbers are handled by the payment provider and are not stored by MyLyft.
- Communications: rider-driver chat messages, push notification tokens, SMS/email verification logs, complaints, and support messages.
- Device and technical data: IP address, device identifiers, app version, browser, operating system, security logs, cookies, local storage, and diagnostics.
How we use personal data
We use personal data to provide the service users ask for, operate the platform safely, meet legal obligations, prevent fraud, and improve reliability.
- Create and secure accounts, including login, social login, phone verification, password reset, and account recovery.
- Find pickup and drop-off addresses, calculate route previews, estimate fares, dispatch ride offers to drivers, and show live trip status.
- Process card, PayPal, and cash-payment records, issue receipts, handle refunds, and investigate payment disputes.
- Send service messages such as OTP codes, booking confirmations, driver arrival updates, ride chat notifications, and safety notices.
- Review complaints, safety reports, fraud signals, chargebacks, driver conduct, rider conduct, and support history.
- Meet private-hire, tax, accounting, insurance, safety, law-enforcement, and regulatory record requirements where applicable.
Lawful bases
Where UK data protection law applies, we rely on different lawful bases depending on the processing activity.
- Contract: to create accounts, provide ride booking, process payment, send service updates, and deliver support.
- Legal obligation: to keep records required for accounting, tax, licensing, safety, fraud, or lawful requests.
- Legitimate interests: to prevent fraud, protect users, improve reliability, investigate disputes, and secure the service.
- Consent: for optional marketing, non-essential cookies, certain device permissions, and push notifications where required.
Location data
Location data is central to a ride-booking service. Riders provide pickup and destination information. Drivers provide live location while they are online, receiving ride offers, or completing a trip.
The rider app and driver app should request device permissions only when needed and should show clear in-app disclosures before collecting sensitive location data, especially if background location is used for driver availability or live trip tracking.
Who we share data with
We share data only where needed to run the service, complete a trip, process a payment, comply with law, or protect users.
- Riders and drivers receive limited trip information needed to complete a ride, such as name, pickup/drop-off, vehicle, plate, ETA, and chat messages.
- Payment providers such as Stripe and PayPal receive payment information needed to process payments and refunds.
- Google Maps and related mapping services process address search, maps, geocoding, and routing information.
- Firebase, SMS, email, hosting, analytics, crash reporting, and support providers may process operational data on our behalf.
- Licensing authorities, insurers, auditors, courts, regulators, law enforcement, or professional advisers may receive data when legally required or reasonably necessary.
Retention
We keep personal data only for as long as needed for the purposes in this policy, including service delivery, safety, complaint handling, fraud prevention, accounting, tax, regulatory, and legal reasons.
- Account records are kept while the account is active and for a limited period after closure where needed for safety, disputes, tax, fraud prevention, or legal compliance.
- Trip, payment, complaint, and safety records may be kept longer where required by private-hire licensing conditions, accounting rules, insurance, dispute resolution, or law.
- Push tokens, session tokens, and diagnostic records are deleted or rotated when no longer needed.
Your rights and choices
Depending on the lawful basis and circumstances, UK users may have rights to access, correct, delete, restrict, object to, or receive a copy of their personal data. Users can also withdraw consent where processing is based on consent.
To exercise rights, email privacy@mylyft.co.uk. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
Account deletion
Users can request account deletion inside the app/account area or through the public account deletion page. Deleting an account removes or anonymises account data where possible.
Some records may be retained where necessary for safety, fraud prevention, chargebacks, tax, accounting, licensing, insurance, dispute resolution, or legal obligations. We will explain retained categories when responding to a deletion request.
Children
MyLyft is not intended for children. Users must be old enough to enter into a ride-booking agreement in their country and must not create an account using false identity information.
Security
We use technical and organisational measures designed to protect personal data, including HTTPS, access controls, encrypted secrets, payment provider tokenisation, logging, and restricted admin access.
No online service can guarantee absolute security. Users should use strong passwords, protect their devices, and contact support immediately if they believe their account has been compromised.