Privacy Policy
Justice Action Services (Pty) Ltd ("JAS", "we", "us") respects your privacy and is committed to protecting your personal information in line with the Protection of Personal Information Act, 2013 (POPIA). This policy explains what we collect, why, how we use it, and what rights you have.
1. Who this applies to
This policy covers anyone who uses the SamDriver app (drivers and, where applicable, passengers), the SamDriver Association Portal (association and JAS staff), or interacts with SAM, our WhatsApp claims-intake assistant.
2. What we collect
Identity and contact information: full name, phone number, taxi association membership, and (for drivers) a South African ID number, driver's licence number and expiry, PDP number and expiry, and vehicle registration.
Health information (special personal information): where you use the passenger/emergency-contact feature, we collect blood group, chronic conditions, medication, medical aid details, and an emergency contact's name and phone number, for use only in a genuine emergency.
Documents and photos: photographs of your ID, licence, PDP, and other compliance documents; photographs of fuel/oil/fluid purchase receipts and vehicle odometer readings; photographs or voice notes attached to incident or hazard reports.
Location information: where a feature requires it (submitting an emergency alert, reporting a road hazard, filing an incident report), we capture your GPS location at that moment and attach it to that report. We do not track or store your location continuously, and no location is stored outside those specific actions.
Usage information: how often you open the app and when you last used it, so we can understand engagement and, for example, recognise active drivers for association rewards.
Ratings and feedback: star ratings and badges left for drivers by passengers (kept anonymous to the driver — see section 5), and suggestions submitted through the app.
3. How we use an AI service to read your photos
When you photograph a fuel receipt or odometer reading, that photo is sent to Anthropic's Claude AI service to automatically read the amount, litres, and mileage, so you don't have to type them in. The photo is sent directly for this one-time reading and is not used by us to train any AI model. You always see the numbers it reads before saving, and can correct them.
4. Why we process your information, and on what legal basis
- To provide the service you signed up for — creating your account, verifying your association membership, showing you notices, weather warnings, and road alerts relevant to you. (Necessary to perform our agreement with you.)
- To protect life and safety in an emergency — the Emergency feature captures your location specifically so help can reach you. This is processed on the basis of protecting your vital interests, not consent — we do not delay or condition emergency features on a consent step.
- Because you've told us to — where you've given consent, such as agreeing to this policy at sign-up, or turning on a specific notification or location-sharing setting.
- To run the driver benefits/reward and sponsorship programme — sponsors and advertisers only ever receive aggregate reach numbers, never your name, contact details, or individual activity. [TO CONFIRM: any additional lawful basis JAS wants documented here.]
5. Who we share it with
Your association's admins and JAS staff can see driver information relevant to managing your membership. Other drivers never see who left them a rating — this is enforced at the database level, not just hidden in the app. Sponsors/advertisers receive only aggregate, anonymised reach and impression counts.
We use the following service providers to run the app, each of whom processes data on our behalf: Supabase (database, authentication, and file storage), Anthropic (reading receipt/odometer photos, see section 3), Expo (push notifications), and mapping/weather data providers (TomTom, OpenWeather) for the Road Alerts and Weather features — these providers do not receive your name or contact details, only the location query needed to answer "what's near me."
6. Where your information is stored
Our database and file storage are hosted by our service provider, Supabase, in their Frankfurt, Germany (EU) region. This means your information is transferred outside South Africa. Germany, as an EU member state, applies the General Data Protection Regulation (GDPR) — a data protection framework widely regarded as providing a level of protection substantially similar to POPIA's own conditions, which is the basis on which this transfer is permitted under POPIA section 72. [TO CONFIRM: final sign-off from a South African attorney on this basis, though hosting within the EU is a materially stronger position than a non-EU host would be.]
7. How long we keep your information
[TO CONFIRM: JAS's decided retention periods. As a starting proposal — account and compliance-document data for the duration of your membership plus a reasonable period after (e.g. one year) for record-keeping; incident/hazard report data retained longer given its evidentiary purpose; app usage/activity data may be reset periodically. This section will be finalised once a retention schedule is approved.]
8. Your rights
Under POPIA, you have the right to:
- Ask us to confirm what personal information we hold about you, and get a copy of it;
- Ask us to correct information that's inaccurate, out of date, incomplete, or misleading;
- Object to our processing of your information, and withdraw any consent you've given, at any time;
- Ask us to delete information we no longer have a lawful basis to hold;
- Complain to the Information Regulator of South Africa if you believe we've handled your information unlawfully.
To exercise any of these rights, contact us using the details in section 10.
9. Security
We restrict access to your information so that, by default, only you can see your own documents, ratings you've received, and account details — enforced at the database level, not just in the app's interface. Documents and photos are stored privately and only ever shared with you via time-limited links, never public URLs.
10. Our Information Officer and how to contact us
[TO CONFIRM: the name and direct contact details of JAS's registered Information Officer, as required by POPIA. Until this is confirmed, general privacy enquiries can be sent to hello@justiceactionservices.com.]
11. Children
Our services are intended for licensed drivers and adults. We don't knowingly collect information from children. [TO CONFIRM: any specific age-verification approach JAS wants to adopt.]
12. Changes to this policy
We'll update the date at the top of this page whenever this policy changes, and let you know in the app if a change materially affects how we use your information.