Boda Ledger, operated by BodaLedger Technologies
Effective date: 2 November 2026
This policy explains what information Boda Ledger collects, why we collect it, how we protect it, and the choices you have. We wrote it in plain language. If anything is unclear, contact us using the details at the end.
1. Who we are
Boda Ledger is a fleet management app for motorcycle (boda boda) owners in Kenya. It helps owners record rider payments, track balances and costs, and see how much each bike earns.
The app is operated by BodaLedger Technologies, a business registered in Kenya, P.O. Box 15572-20100, Nakuru.
We follow the Data Protection Act, 2019 of Kenya.
2. Our role with your data
- For owners (people who sign up and use the app), we are the data controller. We decide how your account information is used.
- For riders and other records owners enter (rider names, phone numbers, payments, and so on), the owner is the data controller and we are the data processor. We store and process that information only to provide the app to the owner, following the owner's instructions.
3. What we collect
About owners
- Name, email address and phone number
- Login details (your password is stored securely and we cannot see it)
- Settings such as theme, defaults and auto lock time
Information owners enter about their fleet
- Bikes: plate number, make and model, purchase date, purchase price, modification costs, status and periods off the road
- Riders: name, phone number, optional national ID number, start date, daily rate, rest day and preferred messaging channel (SMS or WhatsApp)
- Payments: amount, date, method, optional M-Pesa transaction code, notes, and a record of any edits or cancellations
- Costs and documents: repair and service costs, insurance and licence expiry dates, and notes
Collected automatically
- Basic technical information needed to run the app securely, such as login times and error logs
- Information stored on your own device: your theme choice, your last activity time, your auto lock time and your login session. The login session is removed when you log out or are logged out after inactivity.
The app does not collect your phone's location, contacts, photos or SMS messages. GPS trackers fitted to bikes are covered in section 4.
4. Location tracking
Owners can fit a GPS tracker to a bike. The tracker reports to Boda Ledger, and the owner sees the bike on a map in the app.
What is collected
- The bike's position and speed, and the time of each report
- Whether the ignition is on, and the bike's battery state (including when the tracker is running on its backup battery because the bike's power was cut)
Reports come from the tracker on the bike, not from anyone's phone.
Who can see it
- Only the bike's owner. This is enforced by the database itself: no other owner, and nobody who is not logged in, can see a bike's location.
- Riders do not have access to the app.
How long we keep it
- Detailed location reports are kept for 90 days, then deleted.
Theft alerts
- Boda Ledger can alert the owner when a bike leaves an area the owner has chosen (for example their county), when its tracker goes silent or offline, when the tracker loses the bike's main power, or when the bike moves with the ignition off.
- To do this, our server compares each position the tracker sends with the area's boundary. This happens on our own server; the positions are not sent anywhere else.
- Each alert stores the bike, what happened, when, and the bike's last known position. Only the bike's owner can see alerts, the same as the locations. Alerts are kept 90 days after the alert is closed, then deleted. An alert that is still open (for example a bike that hasn't come back) is kept until it closes.
Riders
- The owner must tell each rider that their bike is tracked before they ride it, as part of the owner's responsibilities in section 8.
The map
- The map is drawn with tiles from Mapbox. To show the map, your phone asks Mapbox for the map area being viewed. Mapbox sees which area is shown on the screen, not the bikes' positions: those come only from our database.
- The map can show street maps or satellite photos, both from Mapbox.
- The "Directions" button opens Google Maps at the bike's position, only when you tap it.
Sharing a location
- A bike's location is only shared when the owner chooses to, by tapping "Share location". It sends one snapshot (the plate, the time of the location and a Google Maps link) through the app the owner picks, such as WhatsApp. It never includes the rider's name and is not a live location.
5. Why we use it
We use information only to:
- Provide the app: record payments, calculate balances, reliability scores and payback, and create reports
- Help owners send receipts to riders by SMS or WhatsApp (messages are sent from the owner's own phone)
- Keep accounts secure, including logging you out after inactivity
- Fix problems and improve the app
- Contact owners about their account, important changes or support requests
- Meet legal obligations
6. What we do not do
- We do not sell personal data, to anyone, ever.
- We do not show advertising in the app.
- We do not use rider data for lending or credit decisions. If we ever offer such a service, it will only use a rider's information with that rider's clear, separate consent, and we will update this policy first.
- We do not hold or move money. Payments go directly between riders and owners.
7. Who we share it with
We share information only with service providers that help us run the app, under agreements that require them to protect it:
- Supabase: secure database and login services
- Vercel: hosting for the app
- Mapbox: map tiles for the live map (it sees the map area being viewed, not the bikes' positions)
- Resend: sends our sign-up, email confirmation and password reset emails. It receives the owner's email address and the email itself, and sends from Ireland (EU)
These providers may store data on servers outside Kenya. Where that happens, we rely on providers with strong security and data protection safeguards, as required by the Data Protection Act.
We may also share information if required by Kenyan law, a court order, or to protect the safety and rights of users or others.
8. Owners' responsibilities for rider information
If you are an owner, you are responsible for the information you enter about your riders. Before adding a rider, you should:
- Tell the rider that you record their details and payments in Boda Ledger
- If the bike has a GPS tracker, tell the rider that the bike is tracked
- Only enter information you have a legitimate reason to keep
- Keep their information accurate and remove it when no longer needed
9. How we protect information
- Each owner can only see their own data. This is enforced by the database itself, not just the app.
- Connections to the app are encrypted (HTTPS).
- Passwords are never stored in readable form.
- Payment records cannot be deleted, only cancelled with a reason, so the history stays trustworthy.
- The app logs you out after a period of inactivity, which you can choose in Profile. Time spent in other apps counts as inactivity. To open it again, you log in with your email and password.
No system is completely secure, but we work to protect your information and will notify affected users and the Office of the Data Protection Commissioner of any serious breach as required by law.
10. How long we keep it
- We keep your information while your account is active.
- Detailed bike location reports are kept for 90 days, then deleted.
- If you delete your account, we delete your account and fleet records. Copies in our providers' backups are removed automatically within about 30 days.
- We may keep limited information longer if the law requires it.
11. Your rights
Under the Data Protection Act, 2019, you have the right to:
- Be told how your data is used
- Access the personal data we hold about you
- Correct inaccurate data
- Have your data deleted
- Object to certain uses of your data
- Receive your data in a portable format
Owners can view, edit and export most information directly in the app. For anything else, contact us.
Riders: if you want to access, correct or remove information about you, contact the owner of your bike first, since they control those records. You can also contact us and we will help.
If you are not satisfied with how we handle a concern, you can complain to the Office of the Data Protection Commissioner (ODPC) in Kenya.
12. Children
Boda Ledger is for people aged 18 and over. We do not knowingly collect information from anyone under 18.
13. Changes to this policy
We may update this policy. If we make important changes, we will tell owners in the app or by email before they take effect. The effective date at the top shows when it was last updated.
14. Contact us
BodaLedger Technologies
P.O. Box 15572-20100, Nakuru, Kenya
Phone / WhatsApp: +254 798 793 163
Email: bodaledger@gmail.com