Privacy Policy

1. Introduction & Scope

noda delivery ("noda", "we", "our", or "us") operates a next-generation decentralized delivery protocol and marketplace software connecting consumers, independent merchants (restaurants, grocers, pharmacies, and retailers), third-party delivery couriers, and crowdsourced onboarding representatives ("Hunters").

This Privacy Policy explains how we collect, use, disclose, and protect personal data across all user touchpoints, including interactions via the Meta WhatsApp Cloud API, our Progressive Web Apps (PWAs), the Vendor Terminal, and the Global Hunter Portal. By accessing or using noda, you acknowledge that you have read and understood this policy.

2. Key Ecosystem Roles

To understand how your data is handled, please note the distinct roles across our platform:

• Consumers / Customers: Individuals placing orders for goods via WhatsApp or our web catalog.
• Merchants / Partners: Independent stores, kitchens, pharmacies, and retailers fulfilling orders.
• Couriers / Drivers: Independent dispatchers picking up and transporting packages to doorstep destinations.
• Crowdsourcing Hunters: Independent field representatives who onboard merchants, configure digital vertical menus, and maintain store network capacity.

3. Information We Collect

3.1 Information You Provide Directly

• Contact Information: Phone numbers (used as primary unique identifiers), names, and optional email addresses.
• Delivery Addresses & Geolocation: Street addresses, building landmarks, and live or dropped GPS coordinate pins shared in WhatsApp chats to calculate distance gradients and dispatch delivery couriers.
• Order Details: Basket line items, order special instructions, fulfillment mode preferences, and order history.
• Customer Service Records: In-chat WhatsApp correspondence, order issue reports, and resolution transcripts.

3.2 Crowdsourcing Hunter & Identity Verification Data

To maintain network integrity, prevent synthetic account fraud, and ensure independent Hunters are legally of adult age, Hunters must undergo biometric identity verification:

• Government Identification: Official government documents (e.g. National Identification Number (NIN), Voter's Card, Driver's License, or International Passport) including document number, issuing country, and date of birth.
• Biometric Data (Facial Geometry & Liveness): Live 3D facial selfies ("SmartSelfie™") processed exclusively by our certified biometric verification partner, Smile ID, to establish human liveness and match the portrait against the government document.
• Telecommunication Line Intelligence: Automated carrier inspection conducted via the Twilio Lookup API to confirm that the submitted phone number corresponds to an authentic mobile SIM card, programmatically filtering out virtual VoIP lines and burner numbers.

3.3 Transaction & Financial Information

All consumer payments are made in local fiat currencies (e.g. NGN, KES, ZAR, BRL, AED, GBP) via authorized payment processors. We store transactional metadata (payment reference, timestamp, amount, status). We do not store raw debit/credit card numbers or banking passwords on our servers.

For protocol governance, automated 2% GMV micro-tolls and 1% Hunter royalties are processed programmatically. Public blockchain transactions (e.g., on Polygon or Base) record only pseudonymous wallet addresses and transaction hashes without personally identifiable consumer details.

4. How We Use Your Information

We process personal data strictly for legitimate operational purposes, including:

• Fulfillment & Dispatch: Transmitting order items and delivery coordinates to assigned merchants and couriers.
• Automated Notifications: Sending order confirmations, live kitchen progress alerts, Pickup PINs, and doorstep Delivery OTP codes via WhatsApp.
• Fraud Mitigation & Identity Assurance: Validating that Hunters and merchants are genuine, non-duplicate entities operating within designated geofences.
• Network Governance: Enforcing the 30-partner quota per Hunter and the automated 7-day inactivity forfeiture protocol to maintain an active marketplace.
• Legal & Regulatory Compliance: Complying with applicable tax, commercial, and financial record-keeping mandates.

5. Legal Bases for Processing (GDPR, NDPA & Global Standards)

Under the Nigeria Data Protection Act (NDPA), the EU/UK General Data Protection Regulation (GDPR), and equivalent global laws, we rely on the following lawful bases:

• Performance of a Contract: Fulfilling consumer orders, settling merchant revenues, and paying Hunter royalties.
• Legitimate Interests: Preventing fraud, securing protocol rails, maintaining operational uptime, and enhancing delivery efficiency.
• Explicit Consent: Processing biometric facial verification for Hunter onboarding and accessing customer device geolocation.
• Legal Obligation: Maintaining accounting, tax, and anti-financial crime records.

6. Data Sharing & Third-Party Processors

We do not sell, rent, trade, or monetize personal information. Information is shared only with verified service providers strictly necessary to execute the service:

7. Biometric Data Protection Policy

8. Data Retention & Deletion Schedule

• Active Account Data: Retained for the duration of the active user, merchant, or hunter relationship.
• Order & Transaction Records: Retained for 7 years to satisfy statutory accounting, tax, and commercial audit requirements.
• Verification Sessions: Ephemeral selfie and document images uploaded during KYC are scrubbed from cache within 30 days of completed verification.
• Inactive Hunter Accounts: If an account is deactivated, associated metadata is anonymized after legal limitation periods expire.

9. User Data Deletion Instructions

In accordance with global privacy mandates and Meta Platform Policies, users have the absolute right to request the deletion of their personal information:

1. Submit an email from your registered address to [email protected].
2. Include the subject line: [Data Deletion Request] - Registered Mobile Number.
3. State clearly that you request the permanent erasure of your account, contact details, and associated records.
4. Our Data Protection team will verify account ownership and process the deletion within 30 calendar days, providing confirmation of removal (subject only to records required by financial or tax laws).

10. Your Privacy Rights

Depending on your geographic jurisdiction, you may exercise rights to:

• Request access to the personal data we hold about you.
• Request rectification of incorrect or outdated records.
• Request restriction of processing or object to automated profiling.
• Withdraw consent previously provided for location or biometric checks.
• Lodge a complaint with your national supervisory authority (e.g. NDPC in Nigeria, ICO in the UK, ANPD in Brazil).

11. Cross-Border Transfers & Security Safeguards

noda maintains server infrastructure in secure data centers (Hetzner Cloud) enforcing TLS 1.3 encryption in transit and AES-256 encryption at rest. Cross-border transfers between our regional nodes (Nigeria, Kenya, UK, Brazil, UAE) are conducted under Standard Contractual Clauses (SCCs) and robust technical safeguards.

12. Contact Information

For inquiries, rights requests, or data protection matters, contact our privacy team: