Legal
Privacy Policy
In the event of any discrepancy, the French version of this document shall prevail. The English and Arabic versions are provided for information purposes only.
Contents
- 1. Who we are
- 2. What HopIn does — and does not do
- 3. The data we collect
- 4. Why we process this data
- 5. Your GPS location
- 6. Who your data is shared with
- 7. Transfer of your data outside Morocco
- 8. How long we retain your data
- 9. Lost items
- 10. Your rights
- 11. Security
- 12. No automated decision-making
- 13. Minors
- 14. Changes to this policy
- 15. Contact
1. Who we are
HopIn is a mobile application that connects passengers with drivers of licensed petit taxis holding a valid operating authorization.
The controller responsible for processing your personal data is:
HopIn SARL AU Société à Responsabilité Limitée à Associé Unique (single-member limited liability company) Trade Register No. 693317 — Casablanca Commercial Court ICE: 003773327000047 Registered office: 144, Rue Mohamed Smiha, Résidence Jawharat Mohamed Smiha, 6th floor, Apt 35, Casablanca, Morocco
Contact for any question regarding your data: privacy@hopin.ma
This processing is subject to Law No. 09-08 on the protection of individuals with regard to the processing of personal data.
A prior authorization request to the National Commission for the Control of the Protection of Personal Data (CNDP) is in progress. The authorization reference details will be published on this page as soon as they are issued.
2. What HopIn does — and does not do
This clarification is important to understand what data we process.
HopIn is a matching service. We are not a carrier. We do not set the fare for the ride: it is determined by the taxi’s meter, in accordance with applicable regulations. We do not take part in payment for the ride, which is made directly between the passenger and the driver.
We therefore collect no banking data, and we do not process any payment.
3. The data we collect
3.1 Data you provide to us
If you are a passenger:
| Data | Why |
|---|---|
| First name | Allows the driver to identify you at the pickup point |
| Phone number | Account creation, verification by SMS code, contact during the ride |
| Date of birth | Verification of the minimum age requirement (18 years) |
| Ride rating and optional comment | To collect your feedback on the ride (optional) |
| Profile photo (optional) | To identify you visually in the app |
If you are a driver:
| Data | Why |
|---|---|
| Full name | Identification for the passenger |
| Phone number | Account creation and verification |
| Professional documents (national identity card, driving licence, permis de confiance, professional card, vehicle registration card) | Prior verification of your authorization to operate |
| Vehicle information (registration plate, model, colour) | Identification of the vehicle by the passenger |
| Passenger rating | To collect your feedback at the end of the ride (optional) |
| Profile photo (optional) | To identify you visually in the app |
Driver verification is carried out manually by HopIn before the account is activated. The retention terms for these documents are set out in Article 8.
3.2 Data collected automatically
| Data | Why | When |
|---|---|---|
| GPS location | To connect you with a nearby taxi and enable tracking of the ride | Only while the app is being used for a ride |
| Ride data (time, pickup sector, destination sector, duration, status) | Operation of the service and history of your rides | For each ride |
| Technical crash reports (device model, system version, app version, nature of the error) | Fixing app malfunctions | In the event of a technical error |
Crash reports are collected via Firebase Crashlytics, with user identifiers disabled: these reports cannot be used to identify you.
We do not collect your location when the app is closed or when no ride is in progress. We use no audience measurement, advertising, or behavioural tracking tools.
4. Why we process this data
| Purpose | Legal basis (Law 09-08) |
|---|---|
| Create and manage your account | Performance of the requested service |
| Connect you with a driver | Performance of the requested service |
| Verify drivers’ authorization | Legal obligation |
| Ensure the safety of passengers and drivers | Legitimate interest |
| Handle your assistance requests and lost items | Performance of the requested service |
| Collect and handle ride ratings | Legitimate interest |
| Fix technical malfunctions | Legitimate interest |
Collection of your GPS location is based on your consent, given when you first use the app and which you may withdraw at any time in your phone’s settings. Withdrawing this consent prevents the matching service from functioning, but does not result in the deletion of your account.
5. Your GPS location
We treat this data with particular care.
- Your location is collected only while you are using the app for a ride.
- It is never collected in the background, or when the app is closed.
- Before a driver accepts your ride, they receive neither your identity nor any geographic coordinate. They receive a proximity indication, the approximate distance and duration to the pickup point, the approximate distance and duration of the trip, the destination place or street name and its sector, and the number of seats requested. These distances and durations are rounded before transmission.
- Your precise pickup point is communicated to the driver only after they accept the ride.
- The app displays the approximate position of nearby available taxis on the map, to show you the availability of the service. These positions are rounded to a grid of approximately one kilometre before being broadcast, and are accompanied by no data that could identify the driver or vehicle: no identifier, name, registration plate, or taxi number. Drivers’ precise positions are accessible to no passenger.
- At the end of the ride, GPS coordinates are retained for 7 days, then erased. Your ride history is then retained with no coordinates whatsoever.
6. Who your data is shared with
Your data is never sold, rented, or transferred for commercial purposes.
It is accessible only to:
- The driver of your ride — your first name, your pickup point (after acceptance), and your destination, for the duration of the ride.
- The passenger, with respect to the driver — the vehicle’s make, model, colour, and registration plate.
- Google (Firebase), our technical hosting and authentication provider, acting as a processor solely on our instructions.
- The relevant professional taxi drivers’ association, where applicable, and only with respect to driver data: the amount of matching fees owed per taxi, for remittance purposes. No passenger data is communicated to it.
- The competent judicial or administrative authorities, upon lawful request.
No other recipient.
Each of these recipients is required, by contract or by law, to provide your data with a level of protection equivalent to that described in this policy, and to use it only for the purposes for which it is transmitted to them.
7. Transfer of your data outside Morocco
Google’s servers, which host HopIn’s technical infrastructure, are located outside Moroccan territory.
Your personal data is therefore subject to a transfer outside Morocco. In accordance with Articles 43 and 44 of Law 09-08, this transfer will be the subject of a separate authorization request submitted to the CNDP, following the prior authorization request mentioned in Article 1.
The reference details of the transfer authorization will be published on this page as soon as they are issued.
8. How long we retain your data
| Data | Retention period |
|---|---|
| Account data (first name, phone number, date of birth) | Lifetime of the account, then 30 days after your deletion request |
| GPS coordinates of rides | 7 days |
| Profile photo (optional) | Kept only on your device. It is transmitted to no server and communicated to no one. It is deleted when you remove it, when you delete your account, or when you uninstall the app |
| Destination transmitted to the driver with the offer (place or street name, sector) | 7 days |
| Ride history (without coordinates) | 1 month |
| Copies of drivers’ professional documents | Duration of the driver’s activity, then 3 months — at the end of which the copies are returned to the driver or destroyed |
| Driver verification register (document numbers, expiry dates, date of check) | 12 months after the end of activity |
| Lost item reports | 30 days |
| Correspondence with support | 3 months |
| Ratings and reports | 6 months |
| Records of ride cancellation and abandonment | 6 months |
| Driver abandonment reports | 6 months |
| GPS position inconsistency reports | 6 months |
| Technical diagnostic logs | 30 days |
| Technical crash reports | 3 months |
The 30-day period applicable to account data allows a mistakenly deleted account to be restored. After this period, deletion is final.
For drivers, we distinguish two levels. Copies of documents are retained for the duration of activity and three months beyond, to allow the driver to retrieve them; they are then returned or destroyed. Only a register — document numbers, expiry dates, and verification date, with no copies whatsoever — is retained for twelve months, in order to be able to demonstrate, in the event of a claim concerning a past ride, that verification had indeed been carried out.
Certain data is retained with no predefined time limit, for legal or technical reasons: the matching fee register, retained in accordance with applicable accounting and tax obligations; the administrative action log, retained for traceability and security purposes; and internal technical counters, which serve only the proper functioning of the service, contain no data relating to your trips or identity, and reset automatically.
These periods may be extended for a specific piece of data if a claim, dispute, or legal proceeding is under way, and only for as long as necessary to handle it.
9. Lost items
If you report an item left behind in a taxi, we may communicate your first name and phone number to the driver of the relevant ride, so that they can return the item to you directly.
These reports are retained for 30 days, then erased.
The practical arrangements for returning items and the responsibilities of each party are described in our Terms of Service.
10. Your rights
In accordance with Law 09-08, you have the following rights:
Right of access. You may obtain confirmation that we are processing data concerning you and receive a copy of it.
Right of rectification. You may have inaccurate, incomplete, or outdated data corrected.
Right to object. You may object, on legitimate grounds, to the processing of your data.
Right to erasure. You may request the deletion of your account and associated data, directly from the app or by writing to us.
The deletion of your account does not result in the deletion of data that we are legally required to retain, nor of the driver verification register provided for in Article 8 with respect to drivers. This data is retained only for the period indicated in Article 8, then erased.
To exercise these rights, write to us at privacy@hopin.ma. We will respond within a maximum of 30 days. We may ask you to prove your identity before proceeding, to prevent a third party from accessing your data.
You may also request the deletion of your account without installing the app, from the page hopin.ma/delete-account.
Complaints. If you believe your rights are not being respected, you may lodge a complaint with the CNDP:
Commission Nationale de contrôle de la protection des Données à caractère Personnel www.cndp.ma
11. Security
We implement technical and organizational measures designed to protect your data: encryption of communications between the app and our servers, access rules restricting data reading to only those persons concerned, and administrative access limited to the company’s manager.
Paper copies of drivers’ professional documents are kept under lock and under the exclusive control of the manager. They are neither photographed, nor scanned, nor transmitted to any third party, and are returned or destroyed under the conditions set out in Article 8.
12. No automated decision-making
No decision producing legal effects concerning you is taken in an automated manner.
In particular:
- A driver’s refusal or cancellation of a ride results in no automatic penalty.
- No reliability score, acceptance rate, or equivalent indicator reduces priority in ride allocation.
- Ratings trigger no automatic action on an account.
- Any report is reviewed by a human being before any decision whatsoever is made.
- Any account suspension or termination is subject to prior human review, and you may contest it by writing to privacy@hopin.ma.
Certain events — cancellation of a ride after acceptance, abandonment of an accepted ride, manifest inconsistency in transmitted GPS positions — are recorded and tallied, for service monitoring, security, and possible review purposes. This record produces no automatic effect: it changes neither your access to the service, nor the priority of ride allocation. Any consequence is a matter of human decision, taken after individual review.
13. Minors
The app is reserved for persons 18 years of age or older. We do not knowingly collect data concerning minors. If we learn that an account has been created by a minor, we proceed to delete it.
14. Changes to this policy
We may amend this policy, in particular to reflect changes to the service or to applicable regulations.
Any substantial change will be notified to you in the app before it takes effect. The date of the last update appears at the top of this document, and the version history is published below.
15. Contact
For any question relating to your personal data:
For any other question:
HopIn SARL AU — 144, Rue Mohamed Smiha, Résidence Jawharat Mohamed Smiha, 6th floor, Apt 35, Casablanca, Morocco
Version history
| Version | Date | Change |
|---|---|---|
| 1.0 | 12 August 2026 | Initial publication |
| 1.1 | 4 September 2026 | Clarifications on retention periods (abandonment reports, GPS inconsistencies, technical logs, legally retained data) and on the scope of the right to erasure |
| 1.2 | 4 September 2026 | Correction of the wording regarding the transfer authorization request (Article 7) and clarification on technical counters (Article 8) |
| 1.3 | 4 September 2026 | CNDP regime clarified (prior authorization, Articles 1 and 7); ratings added to the data collected (Articles 3 and 4); mention of the approximate display of available taxis (Article 5) |
| 1.4 | 8 September 2026 | Clarification on the information transmitted to the driver before acceptance (Article 5) and on the retention period of the destination transmitted with the offer (Article 8) |
| 1.5 | 9 September 2026 | Declaration of the optional profile photo (Articles 3 and 8) |