Privacy Policy

Welcome to Dream Ride. We rent motorcycles to riders in Sylhet, including expats, probashi guests and Bangladeshi travellers. We take your privacy seriously and this policy explains how we collect, use, store and protect your personal information when you book a bike, contact us or browse our website and mobile app.

To rent a motorcycle safely and legally in Bangladesh, we need to collect a few categories of information:

Account & contact:

• Full name, email address and WhatsApp / mobile number
• Pickup address inside Sylhet (for doorstep delivery)
• Date of birth, for confirming you meet the legal riding age

Identity verification (mandatory for every booking):

• Driving licence — front and back images
• National ID (NID) or passport — front and back images
• A clear selfie / facial photo for biometric matching

Booking & payment:

• Bike selection, rental dates, pickup & return locations
• Advance / security deposit details (bKash TrxID, bank reference or cash receipt number — we never store full card data)
• Communication history on WhatsApp, email and in-app chat about your booking

Technical:

• Device type, browser, operating system and IP address
• Pages viewed, search queries and clicks on our site and app
• Cookies for session, authentication and remembering your preferences

We use the information above strictly for the following purposes:

• Fulfil your booking: reserve the bike, arrange doorstep delivery in Sylhet and process the return.
• Verify your identity: confirm your driving licence is valid and that you are the same person picking up the motorcycle.
• Handle payments: match your bKash / bank / cash advance to your booking and issue receipts or refunds.
• Customer support: reply to your WhatsApp, email, phone or in-app questions and resolve issues quickly.
• Service updates: send booking confirmations, reminders, late-return notices and important policy changes.
• Safety & compliance: cooperate with police or regulators in case of accident, theft or legal request.
• Improve our service: understand which bikes are popular, find friction in the booking flow and improve the website & app.
• Marketing (only with your consent): tell you about seasonal offers, monthly discounts for probashi guests and new bikes joining the fleet. You can opt out at any time.

Dream Ride does not sell your personal information to anyone. We share only the minimum data required, and only with the following categories of partners:

• Payment partners: bKash and your bank, when you transfer an advance or security deposit. We see only the TrxID / reference; bKash and the bank handle the actual transaction.
• Cloud infrastructure: Supabase (database + authentication) and Cloudflare (hosting + CDN + bot protection) store your data on our behalf under strict contracts.
• Communication tools: WhatsApp Business and our email provider (Resend) deliver booking messages — they see the message contents and your contact details.
• Identity verification: our internal admin staff review your licence, NID and selfie. No third-party KYC vendor sees these images.
• Legal authorities: if Bangladesh police, courts or regulators require information in connection with an accident, theft or investigation, we will cooperate as required by law.
• Business transfers: in the unlikely event Dream Ride is sold or merged, your data may transfer to the new owner under the same protections described here.

Riding is risky enough — your data should not be. We use industry-standard controls:

• Encryption in transit: all traffic between you and Dream Ride is protected by HTTPS / TLS.
• Encryption at rest: licence photos, NID images and selfies live in encrypted Supabase storage with access restricted to authorised admin staff.
• Strong authentication: admin accounts use individual passwords (and 2FA where supported) and are scoped by role.
• CSRF, rate limiting & bot protection: every state-changing request is gated by origin and CSRF checks; Cloudflare Turnstile blocks automated abuse on bookings and contact forms.
• Backups: the database is backed up automatically by Supabase, with encrypted snapshots retained per their policy.
• Continuous monitoring: errors and security signals are forwarded to Sentry so we can react fast.

No system is 100% secure, and we cannot promise absolute protection. If we ever learn of a breach affecting your data, we will notify you promptly and explain what happened.

Dream Ride uses a small number of cookies and similar technologies:

• Essential cookies: keep you logged in, remember your booking in progress and protect against CSRF attacks. The site cannot function without these.
• Preference cookies: remember your language and display preferences so you do not have to set them every visit.
• Analytics: aggregate, anonymised metrics that help us understand which bikes and pages are popular. We do not run third-party advertising trackers.

You can clear cookies or block them in your browser settings, but doing so may break booking, sign-in or payment flows.

You always control your personal information. You can ask us to:

• Access: get a copy of the data we hold about you.
• Correct: fix anything inaccurate (e.g. updated phone, new licence number).
• Delete: close your account and remove your data, subject to records we are legally required to keep (see Data Retention below).
• Export: receive your data in a portable, machine-readable format.
• Object: opt out of marketing messages or specific processing.

To exercise any of these rights, write to Dream Ride at hello@dreamride.bike or message us on WhatsApp at +880 1627-341244. We will respond within 30 days.

We keep your data only as long as it is useful to you or required by Bangladeshi law:

• Active accounts: for as long as your account exists, plus 3 years after your last booking, so we can support repeat customers.
• Booking & payment records: 7 years, in line with financial recordkeeping obligations.
• Identity documents (licence, NID, selfie): until you delete your account or for the minimum period required by law, then permanently removed from our storage.
• Support conversations (WhatsApp, email, chat): 2 years after the last interaction.
• Marketing preferences: until you opt out or your account is deleted.

Dream Ride is intended only for riders who legally meet the minimum motorcycle age in Bangladesh and hold a valid driving licence. We do not knowingly collect data from anyone under 18. If we discover that a minor has registered, we will delete the account and associated data immediately. Parents or guardians who believe a minor has provided data to us can contact hello@dreamride.bike.

Some pages link to third-party services such as Google Maps, WhatsApp, YouTube embeds, bKash or your bank. Once you leave Dream Ride, the privacy practices of those services apply — not ours. We encourage you to read their policies before sharing any information.

Dream Ride is based in Bangladesh, but our hosting partners run their infrastructure globally. Your data may be processed and stored on servers operated by Supabase and Cloudflare outside Bangladesh, including in Singapore and the United States. We rely on the contractual and security commitments of those providers to protect your data wherever it travels, and we use them only because they offer the security and uptime we need to keep your bookings safe.

We may update this Privacy Policy from time to time — for example, when we add a new payment method or change hosting providers. When we do, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on the website for significant changes
• Email or WhatsApp registered customers when changes materially affect them

By continuing to use Dream Ride after a change takes effect, you accept the revised policy. If you disagree, you can close your account at any time.

If you have any question, concern or request about your privacy, please reach out:

• Email: hello@dreamride.bike
• WhatsApp / phone: +880 1627-341244
• Office: Dream Ride, Uposhohor, Sylhet, Bangladesh

We aim to respond to every privacy enquiry within 7 days, and to fulfil formal data requests within 30 days.