Privacy Policy

WapiRider is operated from Nairobi, Kenya. For any privacy question, or to have your data deleted, write to support@wapirider.com.

Shop owners and riders — name, phone number, email address, and an optional profile photo. You sign in with your email and a password. Passwords are stored only as a salted hash — nobody at WapiRider can read yours. A one-time code is emailed when you first confirm your address, and again if you need to reset a forgotten password.

Rider location — while a rider has accepted a delivery and is carrying it, the app records their GPS position and sends it to the shop and the customer waiting for that delivery. Location is collected only during an active delivery. It is not collected when the rider is off duty, has no assigned delivery, or has completed one.

Background location — the Android app continues to read location while it is in the background or the screen is locked, because a rider cannot hold their phone open while riding. Android shows a persistent notification whenever this is happening. If you would rather not grant it, the browser version works without background access, at the cost of tracking pausing when the screen locks.

Customers — a shop enters the customer's name, phone number, optional email, and delivery destination so the rider knows where to go and the customer can be sent a tracking link. Customers do not create accounts and are never asked for a password.

Proof of delivery — on completion, the app may record a photo, a signature, the name of the person who received the parcel, and the GPS position at handover, so a shop can resolve any dispute about whether a delivery arrived.

We do not collect payment card details, contacts, call logs, messages, or any advertising identifier.

Only to run the service: showing a customer where their delivery is, letting a shop manage its riders and deliveries, proving a delivery happened, and signing you in.

We do not sell personal data, we do not share it with advertisers, and we do not use it to build advertising profiles.

Live rider position is deleted the moment a delivery is completed. We keep no ongoing history of where a rider has been.

A public tracking link stops working 24 hours after the delivery is completed.

Delivery records and proof of delivery are kept while the shop's account is active, because a shop needs its own order history. Account details are kept until the account is deleted.

A shop can see its own deliveries, its own riders, and the location of a rider currently carrying one of its deliveries. It cannot see any other shop's data — this is enforced by the database, not only by the application.

A customer holding a tracking link can see the rider's position, the shop name and the delivery status for that one delivery, and nothing else.

A rider can see the deliveries assigned to them.

Reviews left by customers stay private to the shop unless the shop chooses to publish them. Shops are listed publicly on this website only if they opt in.

We use Supabase for database, authentication and file storage; Vercel for hosting; Resend to send sign-in codes and notifications, with Google's mail servers as a fallback; OpenFreeMap and OpenStreetMap for map tiles and address lookup; and OSRM for route calculation. These providers process data on our behalf in order to deliver the service.

Under Kenya's Data Protection Act, 2019 you may ask us to show you the personal data we hold about you, correct it, delete it, or stop processing it. Email support@wapirider.com and we will respond within 30 days.

A rider can revoke location permission at any time in their phone's settings, or leave a shop from the account screen. Revoking location stops tracking; it does not delete the account.

WapiRider is a tool for businesses and is not intended for anyone under 18. We do not knowingly collect data from children.

If this policy changes materially we will update the date at the top and notify account holders by email.