Privacy Policy

1. Who We Are and Who This Policy Covers

Traksend ("we", "us", "our") operates a white-label delivery tracking and dispatch platform used by courier and delivery businesses ("Operators") around the world — not only in Nigeria, where we're headquartered. This Privacy Policy explains how we collect, use, store, and protect personal data for everyone who touches the Service: Operators, their drivers, their team members, and the package recipients ("Recipients") Operators deliver to.

We are the data controller for the personal data we process about our own Operator accounts (signup details, billing, usage of our website and dashboard). For data an Operator uploads about their own drivers and Recipients, the Operator is the controller and we act as their data processor — we process that data only on the Operator's instructions, to provide the Service. Our Data Processing Terms, incorporated into every Operator's agreement with us, govern that processor relationship.

Depending on where you are, this policy is written to meet our obligations under the Nigeria Data Protection Act (NDPA) 2023, the UK GDPR and EU GDPR, South Africa's POPIA, Kenya's Data Protection Act 2019, and Ghana's Data Protection Act 2012 (Act 843). Section 12 sets out the rights specific to each.

2. Data We Collect

2.1 Operators (Courier Businesses)

When you create an account, we collect:

• Business name and operator code
• Email address and password (authentication is handled by our infrastructure provider, Supabase — we never see or store your password in plain text)
• Phone number (WhatsApp contact) and the country you selected at signup
• Business address (optional)
• Billing information for paid plans (processed via our payment partners — we do not store full card numbers)
• The date and time you accepted these Terms and this Privacy Policy

2.2 Drivers

Drivers added to the platform provide:

• Name and phone number
• Real-time GPS location — only while on an active, assigned delivery

GPS tracking stops automatically when a delivery is marked complete, cancelled, or the driver's session ends. Drivers are shown a clear disclosure before location sharing begins.

2.3 Recipients (Package Recipients)

Recipients do not create accounts. We process, on the Operator's behalf:

• Delivery address and contact phone number (provided by the Operator)
• Delivery status and tracking page view events (anonymised)
• Where used, pay-on-delivery payment confirmation details

2.4 Usage Data

We automatically collect standard server logs including IP address, approximate location derived from IP (used, for example, to suggest a locale on first visit), browser type, pages visited, and timestamps. This data is used solely for security monitoring, fraud prevention, and service improvement.

3. How We Use Your Data

We use collected data to:

• Provide the Service: Authenticate accounts, display delivery tracking, route GPS coordinates to tracking pages
• Extract orders from WhatsApp text you choose to paste: Our AI assistant, Tara, processes WhatsApp conversation text that an Operator's team member actively copies and pastes into the platform — we never connect to, read, or automate anyone's WhatsApp account directly
• Send notifications: WhatsApp/SMS delivery status updates to Recipients (sent on the Operator's behalf)
• Billing and payments: Process subscription fees and send receipts, in the currency applicable to your country
• Support: Respond to queries and troubleshoot issues
• Security: Detect and prevent fraud, abuse, and unauthorized access
• Product improvement: Analyse aggregated, anonymised usage patterns to improve features

We do not use your data for advertising, profiling, or sale to third parties, and we do not make any decision that produces a legal or similarly significant effect about you using solely automated means without human review.

4. Legal Basis for Processing

The specific legal basis we rely on depends on which law applies to you, but in every framework we rely on the same underlying grounds:

• Contract performance: Processing Operator account data to provide the subscribed Service (NDPA; GDPR Art. 6(1)(b); POPIA condition of lawful processing; Kenya DPA; Ghana Act 843)
• Legitimate interests: Security monitoring, fraud prevention, service improvement — balanced against your rights and never used to override them (GDPR Art. 6(1)(f) and equivalents)
• Consent: Driver GPS location tracking (consent obtained in-app before tracking begins); any optional marketing communications
• Legal obligation: Retaining transaction records as required by applicable tax and financial regulations in your jurisdiction

5. Data Sharing and Sub-Processors

We share personal data only with:

• Supabase: Database and authentication infrastructure
• Google Maps Platform: Geocoding and map rendering for tracking pages
• Payment processors: For processing subscription payments (we do not store full card numbers)
• WhatsApp Business API providers: To deliver status notifications on your behalf
• PostHog: Product analytics, configured to avoid collecting data from our marketing pages beyond what's needed to understand aggregate usage

All sub-processors are bound by data processing agreements requiring them to protect personal data to a standard consistent with this policy. We do not sell, rent, or trade personal data with any third party for their own purposes. We may disclose data if required by law, court order, or to protect the rights, property, or safety of Traksend, our users, or the public.

6. Data Retention

• Active accounts: Data retained for the duration of the account
• Closed accounts: Deleted within 30 days of account closure, except where retention is required by law
• GPS location history: Retained for 90 days for delivery dispute resolution, then permanently deleted
• Delivery records: Retained for 12 months by default (configurable by Operator)
• Server logs: Retained for 90 days

7. Security

We implement industry-standard technical and organisational measures to protect your data including:

• TLS encryption for all data in transit
• AES-256 encryption for data at rest
• Industry-standard password hashing via our authentication provider (we never store passwords in plain text)
• Role-based access controls limiting internal data access
• Regular security reviews and dependency vulnerability scanning

Despite these measures, no system is completely secure. In the event of a data breach that poses a risk to your rights, we will notify affected individuals and the relevant regulator within the timeframe each applicable law requires — see Section 12 for the specific timelines and regulators that apply to you.

8. Cookies

We use only strictly necessary cookies to maintain your login session and to remember region/currency preferences. We do not use advertising cookies or third-party tracking cookies. No cookie consent banner is needed for strictly necessary cookies under any of the frameworks this policy covers, but you can disable cookies in your browser — doing so will prevent you from staying logged in.

9. Children's Privacy

The Service is intended for businesses and is not directed at individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with their data, contact us and we will delete it promptly.

10. Cross-Border Data Transfers

Traksend is headquartered in Nigeria, and some of our sub-processors (including Supabase and Google) store or process data outside the country you're in. Where we transfer personal data internationally, we rely on the mechanism required by the law that applies to you:

• EU/UK: Standard Contractual Clauses (with the UK Addendum for UK transfers), or an applicable adequacy decision
• Nigeria: A Commission-approved transfer instrument, an adequacy determination, or — where neither applies — your informed consent or contractual necessity, consistent with the NDPA's restrictive default on cross-border transfer
• South Africa: A binding agreement imposing protections substantially similar to POPIA's conditions, consent, or another ground listed in POPIA section 72
• Kenya: Contractual safeguards consistent with Data Protection Act 2019 requirements; note that remote access to Kenyan personal data from outside Kenya is itself treated as a transfer
• Ghana: Consent and appropriate safeguards, consistent with Data Protection Commission guidance under Act 843

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service at least 14 days before changes take effect. The "Last updated" date at the top of this page will always reflect the current version.

12. Your Rights, by Jurisdiction

Every user has a baseline set of rights with us regardless of location: to access a copy of the personal data we hold about you, to correct inaccurate data, to request deletion (subject to legal retention requirements), to receive your data in a portable, machine-readable format, to withdraw consent at any time for consent-based processing, and to object to processing based on legitimate interests. To exercise any of these, email hello@traksend.com.

If you're in the EU or UK

You have the rights above under the GDPR / UK GDPR, plus the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk). We respond to rights requests within one calendar month, as UK/EU law requires.

If you're in Nigeria

You have the rights above under the NDPA 2023, and the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng. In the event of a breach posing risk to your rights, we notify the NDPC within 72 hours, as required by law.

If you're in South Africa

You have the rights above under POPIA, plus the right to object to processing of your personal information and to complain to the Information Regulator at inforegulator.org.za. We notify the Regulator and affected individuals of a qualifying breach as soon as reasonably possible after discovering it.

If you're in Kenya

You have the rights above under the Data Protection Act 2019, and the right to complain to the Office of the Data Protection Commissioner (ODPC). We notify the ODPC within 72 hours of becoming aware of a likely-risk breach.

If you're in Ghana

You have the rights above under the Data Protection Act 2012 (Act 843), and the right to complain to Ghana's Data Protection Commission. Ghana's data protection framework is currently being updated — a replacement Act has passed Parliament but is not yet in force at the time of this policy's last update. We'll update this section once it takes effect.

Everywhere else

If your country isn't listed above, you still have the baseline rights described at the top of this section, and we apply the same security and data-handling standards to your data regardless.

13. Contact

For privacy questions or to exercise your rights:

• Email: hello@traksend.com
• Address: Lagos, Nigeria