Privacy Policy

Effective date: 25 May 2026 · Version 1.0

Plain-English summary. We collect your phone number, name, pickup and delivery addresses, and order history so we can dispatch a rider to you and notify both of you about the order. We share what's needed with the assigned rider, our SMS partners (Hubtel, Twilio), and our database host (Neon). We don't sell your data. You can ask us to show, correct, or delete it at any time by contacting support@muvelt.com.

1. Who we are

This Privacy Policy describes how Muvelt Logistics LTD (“Muvelt,” “we,” “our”) collects, uses, and shares personal information when you use our delivery and ride-booking platform via our web application, mobile applications, or any related services (the “Service”).

Muvelt is a data controller for the purposes of Ghana's Data Protection Act, 2012 (Act 843). Our registered address is [REGISTERED ADDRESS — to be supplied before publication], and our Data Protection Commission registration number is [DPC NUMBER — to be supplied once registration is granted].

2. Data we collect

2.1 Data you give us directly

Account details: mobile phone number (used as your unique account ID), your name, and your account type (Personal or Business).
Order details: pickup and delivery addresses, recipient name and phone (for deliveries), package description, payment method selected (cash or mobile money), any free-text instructions you add.
Saved addresses: any addresses you save to your profile for faster booking.
Ratings & feedback: star ratings and free-text comments you leave about completed trips.
Rider verification (riders only): Ghana Card number, a photo of your Ghana Card (used to verify your identity at approval and stored securely), motorbike registration, profile photo, and bank or mobile-money payout details.

2.2 Data we collect automatically

Location: your device's approximate location when you tap “Use current location” or grant background location for live trip tracking. Location is used only to fulfil the trip you book and to show your rider where to go.
Order events: a log of state changes on your orders (e.g. Requested, Assigned, Picked Up, Completed), used to send you status updates and to resolve disputes.
Device & session data: your IP address, browser/user-agent, push-notification subscription tokens (if you opt in), and authentication tokens stored in your device's local storage.
Proof of delivery: for delivery orders, a photo your rider takes when handing over the package. The photo is linked to your order.

2.3 Data we receive from third parties

SMS delivery receipts: our SMS providers (Hubtel and Twilio) confirm whether messages were delivered to your phone.
Geocoding results: when you type a place name, we ask map providers to resolve it to coordinates. We don't share who you are with them — only the place text.

3. How we use your data

To create and authenticate your account using one-time passcodes (OTP) sent to your phone.
To dispatch riders, calculate prices, and complete the orders you book.
To send you order updates — by in-app notifications, push notifications, WhatsApp, or SMS — at each step of your order.
To show your assigned rider your name, phone, pickup, and delivery information so they can complete the trip.
To process and record payments (cash or mobile money paid directly to your rider), calculate rider earnings, and our commission.
To improve rider quality through your ratings and feedback.
To prevent fraud and abuse (e.g. blocking phones reported for misuse).
To comply with our legal obligations under Ghanaian tax, accounting, and consumer-protection laws.

4. Lawful basis for processing

We rely on the following lawful bases under the Data Protection Act, 2012:

Performance of a contract: processing necessary to deliver the Service you book (account, dispatch, status updates, payment reconciliation, ratings).
Consent: push notifications, optional marketing messages, and any feature that explicitly asks you to opt in. You can withdraw consent at any time.
Legitimate interests: fraud prevention, security, debugging, and protecting our riders and customers, balanced against your privacy interests.
Legal obligation: retention of order and tax records as required by Ghanaian law.

We share the minimum data necessary, only with the following recipients:

Assigned riders: your name, phone, pickup and delivery addresses, and package or trip details — but only for orders they are assigned to, and only while the order is active.
SMS providers (Hubtel, Twilio): your phone number and the message body (e.g. OTP code, order status). Twilio is used as a fallback when Hubtel is unavailable.
Database host (Neon): all the data described above is stored in our managed PostgreSQL database, currently provisioned on Neon (US-East region).
Push-notification gateways: Apple Push Notification Service, Firebase Cloud Messaging, or browser push services, when you opt in to push notifications.
Hosting provider: our server infrastructure runs on Railway.
Map and geocoding services: address text and approximate coordinates (no identifying information about you).
Professional advisers: our lawyers, accountants, and auditors, where strictly necessary.
Authorities: when required by Ghanaian law, court order, or to protect the rights, property, or safety of Muvelt, our users, or the public.

We do not sell or rent your personal data to advertisers, data brokers, or other third parties.

6. Where your data is stored

Our primary database is hosted on Neon in the United States (US-East region). When data is transferred outside Ghana, we rely on appropriate safeguards as required by the Data Protection Act, 2012, including contractual protections with our processors. By using the Service, you consent to this cross-border transfer.

7. How long we keep your data

Order records: retained for up to 7 years after the order date, to meet Ghanaian tax and accounting requirements.
Inactive customer accounts: phone and profile data are retained while your account is active. If you sign out and don't return for 24 months, we may anonymise your profile, keeping only the historic order records described above.
Proof-of-delivery photos: retained for 90 days after the order, then permanently deleted.
OTP codes: stored as a one-way hash and deleted within minutes of verification or expiry.
Notification log (SMS/push delivery receipts): retained for 180 days for debugging and dispute resolution.
Rider verification documents: retained while you remain a registered rider, and for 2 years after deactivation as required by transport-licensing rules.

8. Your rights under the Data Protection Act, 2012

You have the right to:

Access the personal data we hold about you.
Correct any inaccurate or incomplete information.
Request deletion of your data, subject to legal retention requirements (see Section 7).
Object to processing for any non-essential purpose (e.g. marketing).
Withdraw consent for any processing based on consent.
Receive a copy of your data in a portable format.
Lodge a complaint with Ghana's Data Protection Commission (dataprotection.org.gh).

To exercise any of these rights, email support@muvelt.com from the phone number or email associated with your account. We respond within 30 days.

9. Security

We protect your data with industry-standard measures, including TLS in transit, hashed passwords (bcrypt) for staff accounts, hashed OTP codes, rate-limiting on authentication endpoints, signed JWT session tokens with a 7-day expiry, and HTTP security headers via Helmet. No system is perfectly secure; you are responsible for keeping your device unlocked only by you and signing out of shared devices.

10. Children

The Service is not directed at, and we do not knowingly collect data from, children under 18 years old. If you believe a child has used the Service, please contact us and we will delete the account.

11. Cookies & local storage

Our web app uses your browser's localStorage to keep you signed in (we store your authentication token there) and to remember interface preferences such as theme. We do not use third-party advertising cookies or cross-site trackers.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the new version here with a revised effective date, and notify active users by in-app banner or push notification at least 14 days before the change takes effect.

13. Contact us

For privacy questions, data requests, or to report a concern, email support@muvelt.com.

Postal: Muvelt Logistics LTD, [REGISTERED ADDRESS — to be supplied before publication], Ghana.