Your information on AlfaOne Journeys

When you request a trip

We collect the details you enter to send and manage your request: your name, phone number, email address, pickup and drop-off details, dates and times, passenger and luggage counts, and any flight details, stops, or special requests you add. We share the request with the transport operator named on that booking page and authorised members of its team so they can respond and manage the trip. The booking page explains when a trip can be confirmed immediately and when the operator must respond.

We give you a private status link with a booking reference and access token. Anyone with that link may be able to view the request, so keep it private. The link is not included in email updates. The private status page is excluded from session replay.

We use your email for a request receipt and certain trip updates. You can separately choose WhatsApp trip updates, which may be used for confirmations and reminders when the notification service is available; some updates still arrive by email, and email may replace a failed WhatsApp message. Travel offers by WhatsApp have their own optional choice. You can request a trip without choosing either WhatsApp option. WhatsApp updates are not yet active.

When an operator signs in

Operators and invited team members use Google to sign in. Through Google sign-in, our authentication provider, Supabase, receives an account identifier and email address and may receive basic profile information such as a name or profile image. We use this to recognise the account, control access to the operator workspace, and manage team invitations. Customers do not need a Google account to request a trip. Google's handling of sign-in is described in Google's privacy policy.

Operators also provide business and contact details, services, fares, availability, vehicles, and team invitations. Details an operator publishes on a booking page, including a public contact number or email, are visible to people with that page's link. The operator workspace, which includes booking and team details, is excluded from session replay.

We store your optional answer to “How did you hear about us?” If your first visit has utm_source, utm_medium or utm_campaign in the link, we keep those values in this browser and save them with your operator record when you sign up. Later visits do not replace that first visit record. Your workspace shows these details so we can assess which outreach brought operators to the service.

Site analytics and session replay

We use PostHog to understand visits and steps such as starting operator setup, choosing a route, and sending a request. Session replay reconstructs interactions with parts of our site so we can see where a workflow is confusing or fails. It records page layout, navigation, clicks, and changes on the page. It does not use your camera or make a video of your device screen.

Replays run on the landing, example, operator signup, and customer booking pages. We mask form entries and sensitive text, block booking confirmations and operator previews, and exclude private trip status pages and the operator workspace. We capture request timing and whether a request failed to help diagnose slow or broken steps, but remove URL parameters and do not capture request or response contents. Console logs and canvas content are off. PostHog receives an anonymous session identifier and may receive technical information such as browser and device details, IP address, and approximate location. We do not use replay data for advertising.

PostHog stores analytics and replay data for this site in its US region. Session replays are kept for 30 days. Analytics events may be retained separately under PostHog's event retention settings. If you want us to stop processing your analytics or replay data where we can locate it, contact us below.

Meta Pixel and advertising choice

When a Meta Pixel ID is configured, we ask before loading the Pixel. If you choose “Allow,” Meta may receive the page address and browser or device information to help us measure Facebook and Instagram ads. A page address can include campaign tags. We also send a Lead event when you click “Create your booking page,” and a CompleteRegistration event after your booking page is published. Our event calls do not include names, phone numbers or trip details. The Pixel stays off on private trip status links and during sign-in callbacks that carry a code or token. Meta may use its own cookies or similar technology. Choosing “No thanks” leaves the Pixel off. Your choice is saved in this browser.

Change Meta Pixel choice

WhatsApp and other services

Booking pages may offer a link to message the operator or AlfaOne on WhatsApp. Opening the link takes you to WhatsApp, where Meta's terms and privacy policy apply. Sending a booking request does not require WhatsApp. If the notification service is enabled, we will use the separate choices described above for trip updates and offers.

We use Supabase to provide authentication and store booking and operator records, Vercel to host the site, Google for operator sign-in, and PostHog for analytics and replay. These services may process data outside Kenya. We do not sell personal information.

How long we keep records and your choices

We keep booking and operator records while they are needed to provide the service, resolve issues, and meet applicable obligations. There is currently no fixed automatic deletion period for these records. Operators can delete their Journeys account in Settings. The review explains which businesses and past bookings will be deleted; unfinished trips must be resolved and shared businesses handed over first. Deleting a Journeys account does not delete the linked Google account. You can also ask to access, correct, delete, or object to processing of your information by emailing support@alfasystemscv.com. For a booking question, you can also contact the named operator through the public contact on its page. We may need to verify a request before acting on it.