Privacy Policy.

1. Who is responsible for your information

Jolt is developed and its website and technology platform are currently operated by NULL ORIGIN (PTY) LTD, a South African private company, registration 2026/801266/07. Null Origin is responsible for the purposes and means of the personal-information processing it determines in these current operations.

The registered office and correspondence address is 5826 Neli Mokele Street, Tshepiso, Vanderbijlpark, Gauteng, 1901, South Africa. This address is not advertised as a passenger service centre or walk-in facility. The Information Officer is Ruben Vincent Caleb.

For Jolt support, email support@nullorigin.tech. For privacy, access, correction or deletion requests, email privacy@nullorigin.tech. These channels cover passengers, drivers, applicants and delivery recipients.

Jolt is in development and testing. A separate business is intended to manage future commercial transport and delivery operations. No future business is represented here as already appointed or as having assumed Null Origin’s current responsibilities. Its identity, contracting role and data responsibilities will be explained before the relevant commercial service is introduced.

This notice covers this public website and the Jolt client, driver, applicant and administration applications to the extent they are used in current development or authorised testing. Descriptions of a technical capability do not mean that it is publicly or commercially available.

2. Information we collect

Accounts and communication

We collect the information needed to create and manage an account, communicate with you and respond to requests. Depending on your role and the features you use, this includes your name, contact details, account identifier, authentication information and messages you send to support. The relevant forms identify required and optional fields.

Bookings and deliveries

We collect the pickup and destination details, service selected, booking instructions, booking status, relevant journey or delivery records and transaction information. A sender may give us a recipient's name, contact information, address and delivery instructions. We may also receive information about a booking from the driver, sender, recipient or another participant.

Provide only information needed for the service. When you supply another person's information, make sure you have an appropriate basis to share it and give them access to this policy. This does not remove Jolt's own responsibility to handle their information lawfully.

Driver applications and participation

We process information needed to assess driver applications and administer approved participation. This includes the driver and vehicle information requested in the application, documents actually required by the application process, review records, availability, job records and applicable payment or settlement details.

The application notice explains the specific documents required and their purpose. Driver application documents are not published as part of the ordinary customer profile. Access is restricted to the people and providers who need it for authorised review, administration or another lawful purpose.

Device and technical information

When you use Jolt, our systems and active service providers process technical information needed to deliver and secure the service. This can include an IP address, browser or device information, session identifiers, access times and relevant error or security logs. We describe any optional tracking separately below.

Payment and transaction information can include a booking reference, amount and currency, collection method, payment-provider reference, verified status, refund or dispute records, cash confirmations, commission snapshots and settlement records. Hosted test checkout may collect information directly for the provider. Do not send card numbers or passwords to support.

Information can come from you, a sender or recipient, a driver, an authorised reviewer, the browser/device or an active service provider. Required fields and the consequence of not providing information depend on the feature being used.

Where ratings are used in authorised tests, we process the rating, optional review, booking and participant references and any moderation decision. Rating visibility depends on the application feature and authorised role. A support or safety report can include information about other participants; include only what is needed.

3. Google sign-in

The Jolt interface currently uses Supabase email and password authentication and does not currently offer a Google sign-in action. Google is enabled as a provider in the connected authentication service, but provider configuration alone does not make Google sign-in available through the Jolt interface.

No Google OAuth permissions are requested by this public website. If Google sign-in is made available in the applications, it may supply an account identifier, name, email address and profile picture according to the actual permissions. The requested scopes, information used and any token handling must be explained before that feature is released. Google Maps directions links are separate from Google account authentication.

4. Location information

Customers can choose to share their current location to select a pickup point. They can instead search for an address or choose a point on the map. Pickup and destination coordinates are saved with a booking. Nearby-driver discovery uses the location or area selected in the customer app.

When a driver chooses to go online, the driver web app requests a precise location and sends availability and location information to Jolt. While the app considers the driver online, it requests location updates about every 25 seconds, including while serving a job. The online timer stops when the app changes to offline or is closed; an already pending browser request can still finish. Browser and device restrictions can interrupt updates. This is a browser feature, not a promise of continuous native background tracking.

The service stores the driver’s latest position, accuracy, heading and update time. Customers see approximate nearby-driver positions without names before booking. For an assigned active booking, the booking owner can see fresh precise driver coordinates and relevant driver and vehicle information. Authorised operations staff can see driver positions. Booking-event records can include location information supplied with a job update.

Going offline stops the browser update timer but does not prove that the last stored position or booking-event location has been deleted. A request already in progress may finish. Location freshness checks affect display and dispatch; they are not a verified age-based erasure schedule.

5. How and why we use information

We use relevant information to administer accounts, receive and manage bookings, support matching and dispatch, coordinate pickups and deliveries, maintain service records, handle payment or settlement activity, communicate operational updates and resolve support requests.

We also use appropriate information to investigate suspected misuse, protect account and service security, resolve disputes and meet applicable legal obligations.

The justification depends on the activity. It may involve performing an agreement with you, taking steps you request before an agreement, meeting a legal duty, protecting a recognised legitimate interest, or obtaining consent where required. We do not treat acceptance of the Terms of Service as consent to unrelated marketing or every possible use of your information.

Where information is necessary for a feature or application, not providing it can prevent us from supplying that feature or assessing the application. Optional information and optional permissions should be identified at the relevant point of collection.

Jolt remains a prelaunch platform. Review of some supplier-processing and international-transfer arrangements, and independent recovery arrangements for privacy-case records, is still outstanding. Publishing this notice does not represent those controls as completed or certify legal compliance. These follow-up items do not change your applicable rights or Null Origin’s responsibilities. Do not send unnecessary sensitive documents with an initial enquiry; contact the Information Officer for assistance.

6. Who receives information

Information is shared according to the feature and the recipient’s role. In authorised tests, relevant drivers can receive passenger or recipient contact details, collection and destination information and instructions for their assigned work. Customers can receive relevant assigned driver and vehicle details and active-booking location. Approximate nearby-driver positions do not establish that the information is anonymous.

Authorised reviewers and operational personnel can access information needed for driver review, dispatch, support, finance, security or dispute handling, subject to the controls and permissions applicable to their role.

Depending on the features enabled for development or authorised testing, Supabase supplies authentication, database, document metadata and realtime capabilities; Cloudflare R2 stores private driver-document file bytes; Vercel serves web applications; and Geoapify supplies address search and road routing. Address queries and relevant coordinates may be sent when these features are used. Configured map tiles may involve Mapbox and underlying map-data sources.

Paystack is integrated for test-mode hosted payment collection, independent verification and supported test refund processing. This is not a claim of live merchant approval, live card charging or automated driver payouts. Browser-platform push services may process subscription endpoints and delivery keys when push is enabled.

The connected Jolt authentication service uses Resend SMTP for authentication email. Incoming support and privacy mail is forwarded through ImprovMX to an existing personal Gmail mailbox monitored for Null Origin. These are separate from this website, which has no contact-submission form or newsletter. Include only information needed for your enquiry; do not send passwords, full payment-card details or unnecessary identity documents.

Necessary information may also be disclosed under a legal obligation, valid legal process or another applicable lawful basis connected with security, safety or a specific dispute. Information is not made generally public merely because it exists in an administration system.

The connected Supabase project uses the Frankfurt, Germany region for its core regional services. This does not establish that support, communications, logs or every onward recipient remains in Germany. Provider and contractual safeguards must be assessed for the processing involved.

This public information website is hosted on Cloudflare Pages. Cloudflare processes request and security metadata needed to deliver and protect it, including IP addresses and access times. The separate client and driver applications use their own hosting and application services; following an application link leaves this static website.

7. Processing outside South Africa

Hosting, authentication, storage, address search, test payment and browser delivery providers may process information outside South Africa. A database region or South African website address does not establish where every log, backup, support operation or subprocessor processes information.

Cross-border processing must have an applicable basis under section 72 of POPIA, such as adequate protection through applicable law or a binding agreement, or another permitted basis. The applicable arrangements depend on the provider and processing involved.

Contact privacy@nullorigin.tech to ask about the providers and international processing relevant to your information.

Cloudflare uses international infrastructure for content delivery, security and support. ImprovMX describes inbound processing in France and outgoing delivery infrastructure in France and the United States. The receiving Gmail service can also process information internationally. These descriptions do not mean that every support copy, log or backup is confined to a named country, or that publishing this notice certifies every provider agreement or deletion safeguard.

8. Cookies, local storage and optional messages

This public website renders static information without account cookies, a database connection, map requests, analytics, advertising pixels or a newsletter form. It uses your browser’s colour-scheme preference without storing a theme choice. Hosting infrastructure can still process IP addresses, access times and security logs.

The separate Jolt applications use host-scoped authentication cookies. Local storage can remember theme and device notification settings; session storage can hold launch-animation state and duplicate-request identifiers. These application behaviours do not mean that the public website creates an application session.

Optional browser notifications can store subscription endpoints, delivery keys and category preferences. Driver sound and vibration cues are separate device choices. Browser permission can be withdrawn; available application controls can update subscriptions and preferences.

Account, security and booking messages differ from promotional communication. Jolt’s authenticated marketing preference controls record a product-specific choice and withdrawal history; recording the preference does not prove that an email provider is configured or that a previous subscription has been removed. Marketing must use the applicable separate consent or other permitted basis and a withdrawal mechanism.

9. Retention and deletion

Information is retained only while an applicable purpose or lawful retention ground permits it. Relevant considerations include account administration, driver review, bookings, security, unresolved transactions, legal recordkeeping and disputes. A location update, rejected application and financial record do not necessarily have the same retention needs.

Our adopted category-specific schedule sets internal review and removal periods according to purpose, including separate treatment of accounts, driver documents, bookings, payments, precise locations, support records and backups. The process currently depends on reviewed manual handling; scheduled age-based erasure across these systems and provider backup expiry have not been fully verified. Going offline or closing a browser does not prove deletion. We assess information that is no longer lawfully needed for earlier deletion or de-identification and explain applicable exceptions in a request response.

Passengers, drivers, applicants and recipients can request deletion or account closure at privacy@nullorigin.tech. The account deletion information page explains how to submit a request. There is no verified automatic full-account deletion button in the current applications; signing out only ends the session.

The request must be assessed across authentication, database records, R2 documents, notifications, financial records, logs, exports and relevant provider systems. Some information may need to be retained for a lawful obligation, unresolved payment, safety matter or legal claim. Any applicable exception and next steps should be explained for the request.

Where information is no longer lawfully needed it should be deleted or de-identified through the applicable process. Provider backups, other participants’ lawful records and previously exported copies require separate consideration. No immediate deletion of every backup or a fixed completion deadline is promised.

10. Your choices and information rights

Subject to POPIA and applicable exceptions, you may ask whether information about you is held, request access or correction, request destruction or deletion where retention is no longer authorised, object to qualifying processing, and withdraw consent where processing relies on it.

Withdrawal does not undo earlier lawful processing or prevent processing supported by another lawful basis. A feature may be unavailable if it needs information you choose not to provide.

Email privacy@nullorigin.tech with the account email, your role and the request. Appropriate verification may be needed to prevent disclosure or deletion of another person’s records. Do not send a password, full payment-card details or unnecessary identity documents. A suitable channel will be arranged if more sensitive verification is necessary.

The Information Officer oversees the manual request process. We assess identity and authority, identify the relevant systems, review applicable exceptions and arrange an appropriate response. You can ask for a usable copy or export of your information; its scope and format depend on your rights and the records held. This is not an automated export or deletion service.

The application supports rule-based dispatch, eligibility and account controls that can affect service access or the jobs shown to a driver. This notice does not describe the dispatch rules as a machine-learning system. Contact support@nullorigin.tech to raise an account or dispatch concern and request human review; applicable POPIA protections for decisions based solely on automated processing remain available.

Access-to-records requests may also engage PAIA. A privacy request does not replace the applicable PAIA process. Null Origin’s Information Officer confirms adoption of the company’s PAIA manual on 17 October 2026. The physical manual and English and Afrikaans PAIA Guides are available for free weekday inspection through the authorised on-site custodian at the registered principal office. Contact the Information Officer for assistance and copies.

11. Children and information supplied about other people

Current booking-account access is intended for adults aged 18 or older. The passenger eligibility interface states that unaccompanied-minor rides are unavailable and that minors may travel with a responsible adult. Commercial passenger rules remain subject to the adopted launch arrangements; this notice does not authorise a ride or create a service entitlement.

Adult-only accounts do not mean that no information about children can arise in a passenger booking, recipient detail, support message or safety report. Where information about a child is processed, an applicable legal basis and any required competent-person authorisation must be established.

Do not create an account for a child or supply unnecessary information about a child. Raise concerns about an unauthorised child account or child information with privacy@nullorigin.tech.

12. Security

We apply reasonable technical and organisational measures appropriate to the information and risks involved. The relevant safeguards include the access, authentication, storage and operational controls actually implemented for the service.

No website, device or network can be guaranteed to be completely secure. This does not remove our responsibility to maintain appropriate safeguards and respond to incidents. Where a security compromise requires notification, we follow the applicable notification requirements.

Null Origin’s Information Officer initially oversees security incidents and privacy complaints, supported by developers and service providers where needed. The documented process covers containment, investigation, evidence preservation, notification assessment, remediation and records. It does not establish continuous monitoring or a guaranteed response time.

13. Concerns and complaints

The Information Regulator publishes its current complaints process at https://inforegulator.org.za/complaints/.

14. Changes to this policy

We publish the current version and effective date on this page. Where a change materially affects how your information is handled, we provide an appropriate notice and obtain any fresh permission required before introducing the changed processing.

Optional payment setup and saved payment methods

Payment setup is optional. You may skip it, choose cash where available, or enter payment details directly on Paystack when a booking is ready for payment. Jolt does not collect or store your full card number, CVV, PIN or online banking password. Payment methods available in checkout depend on the channels enabled by Paystack for the merchant account.

If you choose to save a card and Paystack marks it reusable after a successful payment, Jolt stores a reusable provider authorisation reference, the provider-linked payment email, card brand, last four digits and expiry month/year. Jolt also records your payment preference and the booking-specific save choice and consent version. Provider authorisation references are held privately for payment processing and are not included in passenger, driver or ordinary administrator displays. They are used when you select the saved method for another quoted booking. Saving is optional and is separate from marketing permission.

You can change payment preferences and remove a saved card in Account → Payments. Removal prevents new reuse through Jolt and removes the reusable reference from Jolt’s active saved-method store. It does not cancel an already requested payment, cancel a booking, reverse a charge, erase transaction records needed for reconciliation or lawful retention, or require immediate deletion from provider backups. Bank transfers and non-reusable methods may require fresh authorisation each time. Jolt remains in authorised testing: test references and test checkout do not establish live merchant approval or public commercial availability.