Privacy Policy / سياسة الخصوصية

Location — OIIAX Merchant

OIIAX Merchant may request your device location only when you choose to use it, for example to set or confirm a store or pickup location on the map. It shows the live position of the driver assigned to your shipment only where shipment-tracking rules permit.

Information processed and why

• Account and identity: driver name, mobile number, profile photo and the details you or operations provide; merchant owner and store name, mobile number, email address, store address/location, logo and store links; account identifiers, password hash, authentication tokens and account status. Used to authenticate, secure and administer accounts.
• Shipments and delivery activity: shipment details that merchants enter, including recipient names, phone numbers, addresses, cash-on-delivery amounts and notes; driver GPS coordinates and timestamps, assignments, arrival and status events, ratings and reviews. Used for dispatch, navigation, delivery verification, customer service and resolving disputes. Merchants must only enter recipient information they are allowed to share for delivery.
• Financial records: delivery fees and earnings, wallet balances, cash collections, settlements, statements, withdrawal requests and subscription packages. Used for reconciliation, payments and accounting. Do not send payment-card secrets in chat or privacy requests.
• Messages and support: chat text, participants, message/read timestamps and support information you submit, for communication between merchants, drivers and operations.
• Notifications and technical data: Firebase Cloud Messaging registration tokens, notification content/status, device identifiers used for sign-in sessions, IP addresses and security/activity records. Used for operational notifications, abuse prevention and error investigation. Both apps include Firebase Analytics, whose SDK may process app-instance identifiers, device/app information and interactions according to the installed build and Firebase configuration.
• Privacy requests: the selected app, supplied phone number and optional reply email, reference, verification and handling records. An optional account password is checked for verification and is not stored in the request. Short-lived keyed hashes support rate limits.

Transmission, access and sharing

Both apps send service requests to OIIAX servers over encrypted HTTPS connections. OIIAX’s hosting and technology providers process server data on our behalf. Authorized operations and support staff access data required for their duties. Assigned delivery participants may receive the driver’s identity/contact information and, where shipment-tracking rules permit, the driver’s current position; drivers receive the merchant and recipient details needed to complete a delivery.

Google/Firebase processes notification tokens and delivery information and may process analytics data. Google Maps, device geocoding services and external navigation providers process map/search/destination information when used. Where WhatsApp shipment notifications are enabled, recipient phone numbers and shipment status messages are sent through Meta’s WhatsApp Business platform. Opening WhatsApp, phone or external navigation links subjects those interactions to the selected provider’s policy. Information may be disclosed to competent authorities when required by applicable law.

Provider information: Google Privacy Policy, Firebase privacy information and WhatsApp Business policy. OIIAX does not sell personal data and the apps contain no advertising integration.

Security

Data is transmitted over HTTPS, new and changed passwords are stored as one-way hashes, and staff access is restricted by role and logged. No method of transmission or storage is completely secure; report suspected misuse through the privacy contact form.

Retention and deletion

The latest driver coordinates and location timestamps are kept on the driver record and replaced as updates arrive. Shipments, delivery events, financial records, messages and security logs are separate records. The current system does not apply a general automatic expiry schedule to those records. A stale-location display cutoff is not data deletion, and account deactivation alone does not erase personal data.

You can delete your account inside either app, or request deletion of your OIIAX Driver or OIIAX Merchant account and associated data using the account deletion form. After identity verification, OIIAX operations review the account, close access and remove or anonymize personal data no longer needed, including unnecessary profile, photo/logo, location, notification and messaging data.

Records needed for unsettled deliveries, cash collections or payments, accounting obligations, fraud/security investigations or legal claims may require limited retention. We retain only records necessary for a documented reason, with restricted access and a recorded expiry or review date. We do not assert a universal statutory number of years: the obligation and period depend on the record and circumstances. The handling response identifies retained categories, the reason and expiry/review date. Backups and provider copies are addressed during fulfilment; deleting live data does not by itself erase every backup immediately.

Your choices and contact

Control location and notification permissions in device settings, log out to stop driver location tracking, and ask for access, correction, privacy information or deletion. Choose “Privacy question” on the public form for a callback. If you cannot sign in or access your registered contact, submit without a password for assisted verification. We will not delete an account solely because someone knows its phone number. Keep the reference for follow-up with OIIAX operations.

The apps are business tools for drivers and merchants and are not directed at children. We may update this policy; the “Updated” date above shows the latest version.