Privacy Policy

Effective date: 18 September 2026 · Version 1.4

Plain-English summary. We collect your phone number, name, pickup and delivery addresses, and order history so we can dispatch a rider to you and notify both of you about the order. We share what's needed with the assigned rider, our SMS partners (Hubtel, Twilio), our map providers, and our database host (Neon). We don't sell your data. You can ask us to show, correct, or delete it at any time by contacting info@muveltlogistics.com.

1. Who we are

This Privacy Policy describes how Muvelt Logistics LTD (“Muvelt,” “we,” “our”) collects, uses, and shares personal information when you use our delivery and ride-booking platform via our web application, mobile applications, or any related services (the “Service”).

Muvelt is a data controller for the purposes of Ghana's Data Protection Act, 2012 (Act 843). Our registered address is Yarewa Zongo, Pipe Tank Lane, Agona Swedru, Central Region, Ghana. Our registration with Ghana's Data Protection Commission is in progress; we will update this policy with our registration number once it is granted.

2. Data we collect

2.1 Data you give us directly

Account details: mobile phone number (used as your unique account ID), your name, and your account type (Personal or Business).
Order details: pickup and delivery addresses, recipient name and phone (for deliveries), package description, payment method selected (cash or mobile money), any free-text instructions you add.
Saved addresses: any addresses you save to your profile for faster booking.
Contacts you pick (mobile app): if you fill in a recipient from your contacts, your phone shows its own contact picker and returns only the one contact you choose. We never read or upload your address book — only that contact's name and number, attached to the order.
Ratings & feedback: star ratings and free-text comments you leave about completed trips.
Rider verification (riders only): Ghana Card number (used to verify your identity at approval and stored securely), a photo of your Ghana Card only if we separately ask you for one, motorbike registration, profile photo, and bank or mobile-money payout details.

2.2 Data we collect automatically

Location (customers): your device's precise location, if you allow it, when you book — to set your pickup point — or tap “Use my current location”. It is only read while you are using the app; we never collect a customer's location in the background.
Location (riders): while you are online or on a job, the rider page shares your position so customers can track their order and we can estimate arrival times.
Order events: a log of state changes on your orders (e.g. Requested, Assigned, Picked Up, Completed), used to send you status updates and to resolve disputes.
Device & session data: your IP address, browser/user-agent, and push-notification tokens if you allow notifications (a device identifier issued by Firebase or your browser, used only to deliver them). Your sign-in token is kept in your browser's local storage on the web, and in your phone's encrypted secure storage in the mobile app.
Proof of delivery: for delivery orders, a photo your rider takes when handing over the package. The photo is linked to your order.

2.3 Data we receive from third parties

SMS delivery receipts: our SMS providers (Hubtel and Twilio) confirm whether messages were delivered to your phone.
Geocoding results: when you type a place name, we ask map providers to resolve it to coordinates. We don't share who you are with them — only the place text.

3. How we use your data

To create and authenticate your account using one-time passcodes (OTP) sent to your phone.
To dispatch riders, calculate prices, and complete the orders you book.
To send you order updates — by in-app notifications, push notifications, WhatsApp, or SMS — at each step of your order.
To show your assigned rider your name, phone, pickup, and delivery information so they can complete the trip.
To process and record payments (cash or mobile money paid directly to your rider), calculate rider earnings, and our commission.
To improve rider quality through your ratings and feedback.
To prevent fraud and abuse (e.g. blocking phones reported for misuse).
To comply with our legal obligations under Ghanaian tax, accounting, and consumer-protection laws.

4. Lawful basis for processing

We rely on the following lawful bases under the Data Protection Act, 2012:

Performance of a contract: processing necessary to deliver the Service you book (account, dispatch, status updates, payment reconciliation, ratings).
Consent: push notifications, optional marketing messages, and any feature that explicitly asks you to opt in. You can withdraw consent at any time.
Legitimate interests: fraud prevention, security, debugging, and protecting our riders and customers, balanced against your privacy interests.
Legal obligation: retention of order and tax records as required by Ghanaian law.

We share the minimum data necessary, only with the following recipients:

Assigned riders: your name, phone, pickup and delivery addresses, and package or trip details — but only for orders they are assigned to, and only while the order is active.
SMS providers (Hubtel, Twilio): your phone number and the message body (e.g. OTP code, order status). Twilio is used as a fallback when Hubtel is unavailable.
Database host (Neon): all the data described above is stored in our managed PostgreSQL database, currently provisioned on Neon (US-East region).
Push-notification gateways: Apple Push Notification Service, Firebase Cloud Messaging, or browser push services, when you opt in to push notifications.
Hosting provider: our server infrastructure runs on Railway.
Google (Maps, Places, Geocoding and Routes): the addresses and map coordinates of your order, to look up places and draw your route. Not your name or phone number.
OpenStreetMap (Nominatim): the place text you type and the coordinates of your order, to turn an address into a point on the map. Not your name or phone number.
OpenRouteService: the pickup and delivery coordinates of your order, to measure the road distance between them so we can estimate the fare and arrival time. Not your name or phone number.
OpenFreeMap: supplies the map images shown in the apps. It sees the IP address of your device and the area of the map you are looking at, and nothing that identifies you.
Sentry (error monitoring): when part of the Service fails, technical details of the failure — the request that broke, your IP address, and the error itself — are sent to Sentry so we can fix it.
Cloudinary (older rider ID photos only): riders who uploaded a photo of their Ghana Card before August 2026 have that image stored with Cloudinary. We no longer collect these photos, and stored ones are shown only to authorised Muvelt staff.
Professional advisers: our lawyers, accountants, and auditors, where strictly necessary.
Authorities: when required by Ghanaian law, court order, or to protect the rights, property, or safety of Muvelt, our users, or the public.

We do not sell or rent your personal data to advertisers, data brokers, or other third parties.

6. Where your data is stored

Our primary database is hosted on Neon in the United States (US-East region). When data is transferred outside Ghana, we rely on appropriate safeguards as required by the Data Protection Act, 2012, including contractual protections with our processors. By using the Service, you consent to this cross-border transfer.

7. How long we keep your data

Order records: kept for 7 years from the order date, to meet Ghanaian tax and accounting requirements. After that, the names, phone numbers, addresses, map coordinates and proof-of-delivery photos on them are erased automatically, leaving only amounts, dates and statuses.
Proof-of-delivery photos, order event logs and SMS/push delivery receipts: kept with the order they belong to, on the same 7-year schedule.
Your account (name, phone number, account type): kept until you delete your account — see Section 9. We don't delete accounts for inactivity.
Saved addresses and in-app notifications: kept until you remove them or delete your account.
Sign-in codes (OTP): stored only as a one-way hash and valid for 10 minutes. Codes that have been used are deleted within a few hours, and all of your codes are deleted when you delete your account.
Rider verification documents: kept while you are a registered rider. When you stop riding, ask us to delete them and we will, unless transport-licensing rules require us to keep them for longer.

8. Your rights under the Data Protection Act, 2012

You have the right to:

Access the personal data we hold about you.
Correct any inaccurate or incomplete information.
Request deletion of your data, subject to legal retention requirements (see Section 7).
Object to processing for any non-essential purpose (e.g. marketing).
Withdraw consent for any processing based on consent.
Receive a copy of your data in a portable format.
Lodge a complaint with Ghana's Data Protection Commission (dataprotection.org.gh).

To exercise any of these rights, email info@muveltlogistics.com from the phone number or email associated with your account. We respond within 30 days.

9. Account deletion

You can delete your Muvelt account at any time, whether or not you still have the app installed.

In the app

Open Muvelt, go to Profile → Account Details, and tap Delete Account near the bottom of the screen. Confirm when prompted — this takes effect immediately.

Without the app

Email info@muveltlogistics.com with the subject “Delete my account” and the phone number your account is registered under. We verify the request against that phone number and process it within 30 days.

What is deleted

Immediately and permanently: your name, your phone number, your saved addresses, your in-app notifications, your notification tokens and your sign-in codes, along with any written comments on your ratings (the star ratings themselves stay, so riders' averages remain accurate). You are signed out on every device.

What we keep

Order records, for the 7 years described in Section 7 because Ghanaian tax and accounting rules require it — with your name and phone number, and the recipient's name and phone number, removed. They are no longer linked to you and are not restored if you sign up again with the same number: a new account starts empty.

To stop one-time referral discounts being claimed twice, we also keep a one-way, keyed fingerprint of your phone number. It cannot be turned back into your number and is used for nothing else.

An account can't be deleted while one of its orders is still in progress. Finish or cancel the order first.

10. Security

We protect your data with industry-standard measures, including TLS in transit, hashed passwords (bcrypt) for staff accounts, hashed OTP codes, rate-limiting on authentication endpoints, signed session tokens that expire and are revoked when you sign out or delete your account, and HTTP security headers via Helmet. No system is perfectly secure; you are responsible for keeping your device unlocked only by you and signing out of shared devices.

11. Children

The Service is not directed at, and we do not knowingly collect data from, children under 18 years old. If you believe a child has used the Service, please contact us and we will delete the account.

12. Cookies & local storage

Our web app uses your browser's localStorage to keep you signed in (we store your authentication token there) and to remember interface preferences such as theme. We do not use third-party advertising cookies or cross-site trackers.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the new version here with a revised effective date, and notify active users by in-app banner or push notification at least 14 days before the change takes effect.

14. Contact us

For privacy questions, data requests, or to report a concern, email info@muveltlogistics.com.

Postal: Muvelt Logistics LTD, P.O. Box 133, Agona Swedru, Central Region, Ghana.