Privacy Policy

• Account details — your name, phone number, email address and, if you add one, a profile photo.
• Shipment details — sender and receiver names, phone numbers and addresses, parcel descriptions, weights, photos taken at pickup and delivery, and delivery confirmation codes.
• Location — when you use it, your location to find nearby stations and set pickup addresses. If you are a driver, your location is shared while you are on duty so customers and dispatch can follow deliveries; it is not collected when you are off duty.
• Payments — payment amounts, wallet transactions and, for drivers, the bank account you choose for payouts. Card payments are handled by Paystack; we store only a card token, the last four digits, card type and expiry — never the full card number or CVV.
• Driver records — licence and vehicle documents, inspection results, trips, earnings and ratings.
• Communications — support chat messages, in-app calls (audio is relayed live and not recorded), and notifications we send you.
• Device data — device type, app version and a push-notification token, used to deliver notifications and keep the app secure.

• To create and secure your account, including sending sign-in codes by SMS.
• To book, move, track and deliver shipments, and to show live tracking to the sender and receiver.
• To take payments, hold them in escrow, pay drivers and handle refunds and disputes.
• To verify drivers and vehicles and keep deliveries safe.
• To provide customer support and send service notifications about your shipments and account.
• To prevent fraud and meet our legal, tax and accounting obligations.

We do not sell your personal data and we do not use it for third-party advertising.

Only with the people and service providers needed to deliver the service:

• The other party to a shipment — couriers see the pickup or delivery contact and address; senders and receivers see the assigned driver's first name, photo, vehicle and live location during delivery.
• Paystack (payments and payouts), Termii (SMS), Resend (email), Firebase Cloud Messaging (push notifications), Agora (in-app calls), Google Maps Platform (maps and addresses), Cloudinary (photo and document storage) and Supabase (database hosting).
• Authorities — when required by law or to protect the safety of our users and staff.

Some of these providers store data outside Nigeria; we rely on their contractual and security safeguards for those transfers.

We keep your account data while your account is open. Shipment and payment records are kept for up to six years after a transaction to meet tax and accounting rules and to resolve disputes. For drivers we keep only the most recent location, not a location history. When you delete your account, we delete or anonymise your personal data unless we must keep it for these reasons.

• View and update your name, email and photo in the app under Profile → My profile.
• Turn off location or notification permissions in your phone's settings at any time (some features, such as live driver tracking, need them).
• Ask for a copy of your data, a correction, or that we stop processing it.
• Delete your account — see how to delete your account.
• Complain to the Nigeria Data Protection Commission if you think we have mishandled your data.

Data is encrypted in transit (HTTPS) and access is limited to staff who need it for their work. Sign-in uses one-time codes sent to your phone, and you can turn on biometric unlock and login alerts from the app's security settings.

CataVelo is not intended for anyone under 18, and we do not knowingly collect data from children.

We will post any changes on this page and update the date above. For questions or requests about your data, email support@catavelo.com.