Privacy Policy

1. Introduction

Shoppa ("Shoppa", "we", "us", or "our") operates a personal shopping and delivery marketplace serving Kigali, Rwanda. This Privacy Policy explains what information we collect and how we use it, whether you are a Customer placing orders, a Shopper fulfilling them, a Delivery Partner completing deliveries, or an Admin managing the platform. By creating an account or using Shoppa, you agree to the practices described here.

2. Information we collect

We collect the following categories of information depending on how you use Shoppa:

• Account information — name, email address, phone number, password, role (Customer, Shopper, or Delivery Partner), and location.
• Role-specific information — Delivery Partners provide their transport type and vehicle type (e.g. motorcycle, car, bicycle).
• Identity verification documents — Shoppers and Delivery Partners submit a national ID number and photos of their national ID (front and back) and a selfie; Delivery Partners using a motorcycle or car also submit a driving permit and a photo of their vehicle. See "Identity verification & document handling" below.
• Order information — delivery address, delivery coordinates, requested delivery time, order notes, and any photos or files you attach to an order.
• Payment information — mobile money number and provider, and billing/transaction references from our payment processor, IremboPay. Shoppa does not collect or store your card or mobile money PIN — all payments are processed directly by IremboPay.
• Payout information — Shoppers and Delivery Partners provide a mobile money number to receive earnings.
• Contact form submissions — name, email, phone number, subject, and message when you contact us via our website.
• Communications — in-app notifications and transactional emails we send you about your orders, account, or payouts. If you message us on WhatsApp, that conversation is also subject to WhatsApp's own privacy policy.

3. How we use your information

We use your information to:

• Create and manage your account and match you with the right dashboard experience for your role.
• Process and fulfil orders, including connecting Customers with Shoppers and Delivery Partners.
• Verify the identity of Shoppers and Delivery Partners to keep the platform safe and trustworthy.
• Process payments and payouts through our payment provider, IremboPay.
• Send order status updates, verification updates, and other service notifications by email, in-app, and (where you initiate it) WhatsApp.
• Respond to support requests submitted via our contact form.
• Investigate disputes, prevent fraud, and enforce our Terms & Conditions.

4. Identity verification & document handling

Because Shoppers and Delivery Partners handle Customers' money, property, and personal deliveries, we require identity verification before an account can accept orders. Verification documents are stored in a private file store, are never publicly accessible, and can only be viewed via short-lived, time-limited signed links generated for authorised admin review. Documents are reviewed manually by our admin team, who may approve, reject, or request that specific documents be resubmitted. Verification documents are retained for as long as your account is active and for a reasonable period afterward to meet legal, safety, and fraud-prevention obligations.

5. Sharing of information

We do not sell your personal information. We share information only as necessary to operate the platform:

• With the Shopper and/or Delivery Partner assigned to your order (name, delivery address, and phone number) so they can fulfil it.
• With IremboPay, to process payments and payouts on our behalf.
• With Cloudinary, our file storage provider, to securely host uploaded images and documents.
• With Resend, our email provider, to deliver transactional emails.
• When required by law, regulation, or a valid legal request from Rwandan authorities.

6. Data storage & security

Your data is stored in a managed PostgreSQL database with access restricted to authorised systems and personnel. We use encrypted connections for data in transit, role-based access controls, and audit logging of sensitive administrative actions. When an account or record is deleted, it is soft-deleted (marked inactive and excluded from normal use) rather than immediately erased, which allows us to recover from accidental deletions and meet record-keeping obligations.

7. Data retention

We retain your information for as long as your account is active, and afterward for as long as necessary to comply with our legal, tax, accounting, or dispute-resolution obligations. Order, payment, and payout records are retained for our financial record-keeping requirements even if you later close your account.

8. Your rights

You can:

• Review and update most of your profile information directly from your account settings.
• Request a copy of the personal information we hold about you.
• Request that we close your account or delete information we are not otherwise required to retain.

To make a request, contact us using the details in "Contact us" below.

9. Cookies & sessions

Shoppa uses a single, essential session cookie to keep you signed in securely. We do not currently use third-party advertising or analytics tracking cookies.

10. Children's privacy

Shoppa is intended for users aged 18 and older. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, please contact us so we can remove it.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our platform or legal obligations. We will update the "Last updated" date above when we do, and material changes will be communicated through the platform or by email.

12. Contact us

If you have questions about this Privacy Policy or how we handle your information, contact us at hello@shoppa.rw or through our contact page. Shoppa operates in Kigali, Rwanda.