Privacy Policy

Last updated: 26 July 2026

Baas ("we", "us") operates the Baas mobile application and booking platform for intercity bus travel in East Africa. This policy explains what personal data we collect, why we collect it, and the choices you have.

Information We Collect

• Account information — name, phone number, and email address you provide when registering.
• Booking information — travel dates, routes, seat selections, and passenger details for each ticket you book.
• Payment information — mobile money phone number and transaction references. Payments are processed by PawaPay; we never see or store mobile money PINs.
• Location data (passengers) — approximate location, only while the app is in use, to show how far the bus is from you. You can decline this and the app still works.
• Location data (drivers) — if you are a registered driver and start a location-sharing session, we collect precise location data, including in the background when the app is closed or not in use, so ticketed passengers can see the bus's live position. Collection stops when you end the session or the trip completes.
• Device information — push notification tokens and basic device details needed to deliver booking updates.
• Usage events — in-app actions such as searches and bookings, used to improve the service. We do not use third-party advertising or tracking SDKs.

How We Use Your Information

• Process bookings and payments, and issue tickets and receipts via SMS and email.
• Show live bus positions to passengers holding tickets for that trip.
• Send service notifications (booking confirmations, departure reminders, price alerts you set).
• Provide customer support and resolve disputes.
• Detect and prevent fraud, and comply with legal obligations.

Data Sharing

We share necessary booking details (passenger name, seat, ticket reference) with the bus operator fulfilling your trip. Payment processing is handled by PawaPay under their own privacy policy. SMS delivery uses Africa's Talking. We do not sell your personal data, and we do not share it with advertisers.

Data Retention

Account data is retained while your account is active. Completed booking and payment records are retained for 7 years in anonymised form, as required by Ugandan financial regulations. Driver location fixes are retained only as long as needed to power live tracking and trip records.

Your Rights

• Access, correct, or delete your personal data.
• Delete your account at any time in the app (Profile → Settings → Delete Account) or via our account deletion page.
• Withdraw location and notification permissions at any time in your device settings.

Security

All traffic between the app and our servers is encrypted with TLS. Passwords are stored only as salted hashes. Authentication uses short-lived tokens stored in your device's secure keychain.