Efuka ("we," "us," or "our") is a Colorado-based rideshare platform that connects riders ("patrons") with licensed private drivers. This policy explains what personal information we collect when you use Efuka.com or the Efuka web application, how we use it, who we share it with, and what rights you have over your data.

Information we collect

From patrons

  • Account basics: name, email, phone number, password (hashed)
  • Payment data: card details are tokenized and stored by Stripe; we never see or store your full card number, CVV, or expiration date
  • Ride history: pickup and dropoff addresses, timestamps, fares, tips, and ratings
  • Communications: messages you send to drivers through the in-app chat, and any support requests you submit to us

From drivers

  • Identity & licensing: government ID, driver's license, PUC certification, commercial insurance documents
  • Banking: payout account details, processed by Stripe Connect
  • Trip data: same as patron ride history, plus GPS breadcrumbs recorded during active trips
  • Tax info: required 1099 reporting data, collected by Stripe Connect and surfaced through their dashboard

Automatically

  • Device & session: IP address, browser type, operating system, session cookie contents
  • Precise location: pickup and dropoff addresses, live trip location, and GPS breadcrumbs recorded during active trips. This is treated as sensitive personal information [PLACEHOLDER — pending legal review of classification under Colorado CPA and other state laws].
  • Error reports: anonymized stack traces and request context sent to Sentry when the application crashes

What we do NOT collect

  • We do not collect biometric data (fingerprints, face scans, voice)
  • We do not sell your data to advertisers, data brokers, or third parties
  • We do not track you across other websites
  • We do not use third-party advertising cookies

How we use your information

We use the data we collect to:

  • Operate the service: match riders with drivers, process payments, send trip-related notifications
  • Verify driver credentials: confirm PUC licensing, insurance coverage, and identity at onboarding and on an ongoing basis
  • Improve safety: review ratings, tip behavior, and incident reports to maintain a trusted community on both sides of the ride
  • Provide support: respond to questions, investigate disputes, resolve payment issues
  • Meet legal obligations: tax reporting (1099s for drivers), records retention, and responses to valid legal process

We do not use your data for advertising, profiling for automated decisions that produce legal effects, or any purpose not listed above without your consent.

Who we share data with

We share information only with the service providers we use to run Efuka. Each is bound by a contract that limits what they can do with your data.

Provider What they receive Why
Stripe Patrons' card tokens, drivers' bank details Payment processing and Connect payouts
Twilio Phone numbers, message contents Ride notifications and verification codes
Sentry Anonymized error reports Crash monitoring and debugging
Render All data at rest Hosting the application and database

We also share data:

  • With the other party to your ride (driver ↔ patron): first name, pickup/dropoff addresses, and in-app chat messages during the trip. Phone numbers are masked through the platform.
  • With the other party to a booked-for-someone-else ride (driver ↔ passenger): if a rider books a ride for a non-account passenger, we share the passenger's first name and the same pickup/dropoff addresses with the matched driver. That passenger does not need an Efuka account, but their ride details are processed as part of the booking.
  • With law enforcement when required by valid legal process. We will notify you of such requests unless we are legally prohibited from doing so.
  • In the event of a business transfer (acquisition, merger): your data would transfer to the new owner under the same privacy terms.

We do not sell your data, and we do not share it with advertisers.

AI agents and API tokens

You may connect an external AI assistant (such as Claude, ChatGPT, or similar) to your Efuka account using an API token. The token lets the assistant request rides on your behalf.

When connected, the assistant may receive the ride details necessary to book a trip (for example, pickup/dropoff addresses, preferred time, and any special instructions you provide). It does not receive your payment details, full card number, driver banking information, or password.

All bookings made through an AI assistant are logged to your Efuka account for audit, dispute, and billing purposes. You can revoke the token at any time in your account settings; revocation takes effect immediately.

[PLACEHOLDER — pending legal review: complete data-flow description, retention period for assistant actions, security safeguards, and any vendor obligations.]

This section is a placeholder pending legal review of AI agent data flows.

Background checks

Driver applicants consent to a consumer report and/or background check conducted by a third-party consumer reporting agency. The report may include driving record, criminal history, identity verification, and motor vehicle records as permitted by law.

Before taking adverse action based on a background check, Efuka will provide the driver with a copy of the report and a summary of their rights under the Fair Credit Reporting Act.

[PLACEHOLDER — pending legal review: specific vendor name, exact authorization language, adverse-action notice procedure, and retention of background-check records.]

Data retention

Data type Retention period
Account profile (name, email, phone) Until you delete your account + 30 days for recovery
Ride history 3 years from trip date (tax and dispute window)
Payment records 7 years (IRS recordkeeping)
Driver verification documents Length of driver account + 5 years
Sentry error reports 90 days
Server logs 30 days
Support messages 2 years from last contact

When you delete your account, we remove directly identifying details (such as names linked to the account) from ride records, but trip metadata including addresses and timestamps may remain for tax and dispute purposes. We purge everything else per the schedule above.

Your rights

Efuka is based in Colorado, and we extend the rights below to all users regardless of state because they are the right defaults.

Under the Colorado Privacy Act (and equivalent laws in other states), you have the right to:

  • Access a copy of the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data (subject to retention obligations above)
  • Portability — request a copy of your data in a commonly usable format
  • Opt out of data sales — we do not sell data, so this is a no-op for Efuka, but the right is yours under the law
  • Opt out of profiling for safety scoring — if we use ratings, tip behavior, or incident reports to produce a safety score that affects your account, you can ask to opt out
  • Withdraw consent for a background check — drivers may withdraw consent for ongoing consumer reporting, subject to adverse-action notice if required by law
  • Appeal if we deny a request

To exercise any of these rights, email privacy@efuka.com with the subject line "Privacy Request." We respond within 45 days; if we need more time, we will tell you why and when to expect a response.

If we deny your request, you may appeal by replying to our response email. If the appeal is denied, you may contact the Colorado Attorney General's office to file a complaint.

Open-board addresses

When a driver views available ride requests on the open board, they see approximate pickup and dropoff locations until they are matched or the ride is in progress. Full addresses are shown only to the matched driver while the ride is active. Patrons always see their own full addresses.

Driver payouts and dispute reserve

Driver payouts are processed through Stripe Connect. The default cadence is weekly; drivers may also opt in to an instant payout before the next scheduled batch. Efuka's platform fee is 7% of each fare. An additional 10% is held as a dispute reserve for 90 days from each ride's completion; the reserve is released as a single batched daily payout per driver. Once a driver reaches their reserve cap, the 10% hold stops and they receive 93% of each fare upfront. Reserve tiers are based on rolling 90-day ride volume: Standard ($500 cap), Pro ($1,500 cap), and Premium ($3,000 cap). Drivers can view their current tier, reserve balance, cap, and upcoming release dates in their dashboard.

Cookies and local storage

Efuka uses a minimal set of cookies:

  • Session cookie (_efuka_session): identifies you while you're signed in. Deleted when you close your browser.
  • Remember-me cookie (remember_user_token): keeps you signed in for 2 weeks when you check "Remember me." Encrypted; cannot be read by JavaScript.
  • CSRF protection token: stored inside the session cookie; helps prevent cross-site form submissions. Required for security.

All cookies are HttpOnly (not readable by JavaScript) and SameSite=Lax (not sent on cross-site requests). In production, all cookies are also Secure (sent only over HTTPS).

We do not use third-party tracking cookies, advertising cookies, or analytics cookies that follow you across the web.

Progressive web app (PWA) storage

Efuka can be installed as a progressive web app. When installed, your browser may store the following locally:

  • Service worker cache: app assets and an offline fallback page so Efuka works without a network connection. The cache does not contain personal data.
  • localStorage keys: pwaInstallDismissed (remembers if you dismissed the install prompt), efuka.context.active (remembers your last patron/driver context selection), and theme (remembers your light/dark mode preference).

These values are stored in your browser and are not sent to Efuka servers unless the application explicitly reads them to apply your preference.

Security

We take reasonable measures to protect your data:

  • All data is encrypted in transit (HTTPS) and at rest (database encryption)
  • Passwords are hashed with bcrypt; we never store plaintext passwords
  • Payment data is tokenized by Stripe; we do not see or store full card details
  • Access to production data is limited to a small number of authorized personnel with audit logging
  • Application errors are reported to Sentry with personal data scrubbed

No system is 100% secure. If we discover a data breach affecting you, we will notify you by email and (where required) file the appropriate state breach notification.

Children's privacy

Efuka is not directed to children under 16, and we do not knowingly collect information from anyone under 16. If you believe a child has created an account, contact privacy@efuka.com and we will delete it.

A rider who is 16 or older may book a ride for themselves or for another passenger who does not have an Efuka account. The booking rider is responsible for the ride and for any personal information they provide about the passenger. The passenger does not need an account, but their first name, pickup/dropoff addresses, and ride details are processed as part of the booking.

[PLACEHOLDER — pending legal review: unaccompanied minor policy, parental consent requirements, and any age-related restrictions on rides booked for someone else.]

Changes to this policy

We may update this policy as Efuka grows or as laws change. When we do, we will:

  1. Update the effective date at the top of this document
  2. Email all active account holders with a summary of changes
  3. Post a notice on the home page for at least 30 days

Material changes (anything that expands what we collect, who we share with, or how we use your data) will not take effect for at least 30 days after notice, so you have time to review and delete your account if you disagree.

Contact

  • Email: privacy@efuka.com
  • Mailing address: Efuka, 1500 N Grant St #10030, Denver, CO 80203
  • Response time: 45 days, per Colorado CPA

For anything not related to privacy (support, billing, partnership inquiries), please use our contact form. We try to respond within 1 business day.