Privacy Policy
Our promises, in plain words
- Your data is yours. We never sell it, never show ads, and never use it for advertising. Ask, and we'll delete it.
- Only what's needed. We collect only what it takes to run your deliveries. No ad pixels or tracking cookies, on our website or in the app.
- No surprises. We'll tell you at least 30 days before any price change, and you can cancel any time from your Billing page.
- Straight answers. If something goes wrong that affects you, we'll tell you plainly.
The rest of this policy is the detail behind these promises.
1. Who we are and who is responsible
Coodrop is run by Ahmad Hamra Badawi, an individual based in Tripoli, Lebanon, trading as Coodrop ("we"). For privacy questions or requests, email [email protected].
For the details of your own account (your email, your organization, how you use the service) we are the controller: we decide how that data is used. For the information you and your team put into Coodrop about your customers and drivers, your business is the controller and we process it for you, on your instructions. If you are a customer or a driver of a business that uses Coodrop, that business is the one to ask about your data.
2. What we collect
- Account information: your email address, password (stored only in a protected, hashed form), organization name, and the role you hold.
- What businesses enter: jobs, stop names and addresses, recipient names, phone numbers and email addresses, delivery notes, proof-of-delivery photos and signatures, and pricing or payment amounts.
- About drivers: name, contact details, a device token for notifications, and location while on shift (more often while working a job, less often when idle).
- Payments: Paddle, our reseller and merchant of record, handles subscription payments and card details; we receive only your subscription status, plan and billing period, never card numbers.
- Technical information: your IP address, browser and device details, and logs needed to run and secure the service.
3. Location data
A driver's position is collected while they are on shift and is shown to that business's dispatchers. While a delivery is under way, the recipient can see the driver's position on their tracking link. Drivers should be told this by their employer or the business they drive for.
4. How we use it, and why we're allowed to
- To provide the service you signed up for: accounts, jobs, live positions, tracking links, routes and notifications. The legal basis is our contract with you.
- To bill subscriptions, with Paddle. The legal bases are our contract with you and the tax and accounting rules we must follow.
- To keep the service secure, prevent abuse, fix problems, give support and improve the product. The legal basis is our legitimate interest in running a safe, working service.
- To meet legal obligations, such as keeping billing records or answering lawful requests from authorities.
Where a business uses Coodrop for data about its own customers and drivers, that business decides the legal basis for its use. We do not sell personal data, we do not use it for advertising, and we do not make automated decisions about people that have legal or similarly significant effects.
5. Who we share it with
We use these providers to run Coodrop, and share only what each needs:
- Supabase: database, sign-in, file storage and back-end functions.
- Cloudflare: hosting, content delivery and bot protection.
- Paddle: sells and bills subscriptions as merchant of record, including card details, invoices and sales tax.
- Resend: sends account and delivery emails.
- Contabo: the server that runs route optimization and the driver app's sync service.
- Expo and Google Firebase: deliver push notifications to the driver app.
- Meta (WhatsApp Business Platform): only if a business turns on WhatsApp updates for its customers.
- OpenStreetMap-based services: map images, and turning a typed address into a map position (so the address typed is sent to that service).
- Shopify or WooCommerce: only if a business connects its store, to bring in orders and mark them as shipped.
We may also share information with professional advisers, such as an accountant or lawyer, where needed, and with authorities where the law requires it or to protect people and the service.
6. Where it is processed
Data is processed in the countries where these providers operate, which may be outside your own. Where personal data from the UK or the European Economic Area goes to a country without an adequacy decision, we rely on recognised safeguards, such as the Standard Contractual Clauses in our providers' data processing terms.
7. How long we keep it
We keep account and business data while the account is active and for 30 days afterward so it can be exported, then delete it, except where we must keep records (for example billing records) for legal reasons. Businesses can delete their own jobs and drivers at any time. Proof-of-delivery photos and signatures are kept for 12 months after the delivery, then deleted. A driver's location history is kept for 30 days; after that only their latest position is kept.
8. Security
Data is encrypted in transit, access is restricted by organization at the database level, passwords are hashed, and payment details are handled by Paddle. No system is perfectly secure; if there is a breach that affects you we will tell you as the law requires.
9. Your rights
Depending on where you live, you may have the right to see the personal data we hold about you, to correct it, to delete it, to get a copy to take elsewhere, to restrict or object to some uses, and to withdraw consent where we rely on it. You can also complain to your data protection authority.
For your own account, email [email protected] and we will answer within 30 days. For data a business holds about its customers or drivers, contact that business; we will help it respond.
10. Cookies and local storage
We use only what is needed to keep you signed in and to remember preferences such as light or dark mode and screen layout. There are no advertising or cross-site tracking cookies. Our bot-protection check may set its own technical cookies to tell people from automated traffic. If you pay for a plan, the checkout of Paddle (our payment provider) may set its own cookies to process the payment and prevent fraud.
11. Children, changes and contact
Coodrop is for businesses and is not directed at children. We may update this policy and will tell you when a change matters.
Contact: Ahmad Hamra Badawi, trading as Coodrop, Tripoli, Lebanon. Email [email protected].