Privacy policy

Draft — requires legal review before use

Last updated: 8 November 2026

This policy explains what personal data Zadi GO collects, why we use it, who receives it, how long we keep it, and the choices you have. It covers the Zadi GO website, the merchant app, the partner API and webhooks, the private partner docs, and the Zadi GO courier app.

1. Who we are

Zadi GO is a delivery and logistics system for businesses and their customers. It is owned and run by Aigon Technology and Integrated Systems Ltd ("the Company", "we", "us").

• [Company registration number: to be confirmed]
• [Registered address: to be confirmed]
• Website: www.aigon-ltd.com (opens in a new tab)

The Company decides why and how the data in this policy is used. The one exception is recipients' data, which we handle on behalf of the business that sends the order (section 3.4).

2. Who this policy covers

• Website visitors, and people who send a form on the website or message us on WhatsApp.
• Partner businesses: the business account and the people who use the merchant app, the partner API and the partner docs.
• Couriers who sign up and work in the Zadi GO courier app.
• Area partners, and people who apply to become one.
• Recipients: the people who receive deliveries from our partner businesses.

Zadi GO serves businesses. We do not offer a service directly to individuals.

3. What we collect

3.1 The website and its forms

You do not sign in to the website, and it uses no cookies or tracking. See the Cookie notice.

When you send a form, we receive what you type: your name and phone number and, depending on the form, your company name, the area you are interested in, or your message. We also receive the type of form, the page it was sent from, and the language of the page.

To stop spam, we keep a one-way coded value made from your IP address. We do not keep the IP address itself. Our hosting servers may also keep short technical logs, such as the time and the page requested, to keep the site secure and fix faults.

If you message us on WhatsApp, we receive your WhatsApp name, number and messages. WhatsApp is run by Meta under its own privacy policy.

3.2 Partner businesses

• The business account: legal and trading name, tax number, registration number, country and address, and a contact person's name, email and phone number.
• Documents for approval, such as a trade licence, tax certificate, ID card or bank letter.
• Merchant app users: name, email, role, the phone number for the two-step sign-in code (if turned on), sign-in times and failed sign-in attempts. Passwords are stored only as a one-way code (a hash).
• API keys: a public id, label, permissions, expiry date, allowed IP addresses and the time of last use. The secret part is shown once, when you create the key, and is then stored only as a hash.
• Webhooks: your endpoint address, the events you chose, and a log of each message we send (the message, and the first part of your server's reply), so that failed messages can be retried and checked. The signing secret is stored encrypted.
• Orders and money: the orders you send (pickup, recipient and parcel details, fees, status and proof of delivery), and your settlements and statements.

3.3 Couriers

When you sign up and work in the Zadi GO app, we collect:

• Account details: your name, phone number (checked with a code sent by SMS), email, profile photo, language and app settings. If you sign in with Google or Apple, we also receive your Google or Apple account id.
• Identity and vehicle documents: photos of your national ID or passport, driving licence, vehicle registration and vehicle, and a photo of you. You also type the ID or passport number, the licence number and expiry date, and the plate number.
• How we keep those numbers: as a keyed one-way code (a hash), so that one person cannot open several accounts, and as an encrypted ("sealed") copy. The app shows only the last four characters; only our document-review staff can see the full number.
• Vehicle details that our team sets when it activates you: type, brand, model, year, plate number and colour.
• Location: while you are online, including during a trip, the app sends your position, direction, speed and accuracy. We use it to offer you nearby orders and to let the business and the recipient follow the delivery. The app keeps sending your location when it is in the background, and the phone shows that it is in use. It stops when you go offline. We keep your last known position on your account.
• Device details: a random device id that the app creates, your push-notification token and the app version.
• Device safety checks: the app checks on your phone whether the phone is rooted or jailbroken, is an emulator, has no SIM card, or is giving a fake location. If a check fails, the app does not let you work.
• Work and money: the offers you receive and accept, your orders and trips, delivery photos (with the place each one was taken), the cash you collect and hand in, your wallet and its transactions, withdrawals and the bank details you give for them, fines and adjustments, ratings, and performance counts.
• Scheduled fleet: if you become a Zadi Verified Courier, also your courier code, delivery capacity, work zones and available hours.
• Safety: SOS alerts (the type of alert, your note, and your position while the alert is open) and the problems you report during a trip.
• Chats: the messages, photos and voice notes you send in support chat or in an order chat.
• Wallet PIN: stored only as a hash. If you unlock with your fingerprint or face, that check happens on your phone. We never receive your fingerprint or face data.
• Crash reports and app speed data (section 5).

3.4 Recipients

When a partner business sends an order, we receive the recipient's name, phone number, address, location on the map and any delivery note. The courier sees these details so that they can deliver, and may call the recipient. The courier may take a photo at hand-off as proof of delivery.

We handle recipients' data on behalf of the business that sent the order, and only to deliver it and deal with problems. The business is responsible for having the right to share this data with us and for telling its customers about it. Recipients with questions should contact that business first. They can also contact us (section 12).

3.5 Area partners

When you apply, we receive the details in the form (section 3.1). If we work together, we also keep your contact details, our agreement and the records of running the area.

4. Why we use data

• To deliver: price and plan orders, find nearby couriers, offer them orders, follow trips, prove delivery and handle problems.
• To check before work starts: review couriers' and businesses' documents, and stop fraud and duplicate or banned accounts.
• To handle money: pay couriers, settle with businesses and keep financial records.
• To keep couriers safe: send SOS alerts to our support team and, unless the courier turns this off before sending, to nearby couriers.
• To give support: answer forms, messages and reported problems.
• To keep our systems secure and fix faults.
• To meet legal duties, and to make or defend legal claims.

We use data because it is needed for the service or agreement you have with us, because the law requires it, because we have a fair interest in safe and fraud-free operations, or with your consent where the law requires consent.

We do not sell personal data, and we do not use it for advertising.

5. Who receives data

People in the delivery. Each side sees what it needs:

• The courier sees the pickup and the recipient's name, phone number and address.
• A business that uses a customer app, such as Zadi Menu, may show its customer the courier's name, phone number, photo, vehicle, rating and position during the delivery.
• Scheduled-fleet businesses see the name, phone number, courier code and vehicle type of the verified couriers linked to them.
• Webhooks to a business carry the recipient's details, and only an id for the courier.

Nearby couriers during an SOS. When you send an SOS, nearby couriers are also alerted unless you turn this off before sending. They see your name, phone number, the type of alert, your note and your position.

Area partners who run Zadi GO in an area may see the courier and order data of that area. They use it only to run the area, and only on our instructions.

Service providers who work for us:

Authorities, when the law requires it, or when it is needed to protect someone's life or safety.

A buyer or successor, if the Zadi GO business is sold or merged, under the same protections as this policy.

6. Where data is stored

Our servers are run by [hosting provider: to be confirmed]. Some providers in section 5, such as Google, Apple and Meta, process data in other countries. We share with each provider only the data it needs for its job.

7. How long we keep data

• Courier accounts: while the account is open. When you delete your account, your personal details are removed at once (see Courier account deletion).
• What we keep after a courier account is deleted: the orders you delivered, with their delivery-proof photos (and the place each was taken) and ratings; your wallet records, withdrawals (with the bank details you gave for them) and cash settlements; the messages, photos and voice notes you sent in chats (your name and photo on them are replaced); your SOS records, with your notes and positions; and the reason you gave for deleting. These records are no longer linked to your name, phone number or email, but some still hold personal details, such as a bank account or what you wrote in a chat. We keep them for 5 years (to be confirmed) after deletion. [deletion after this period: to be implemented]
• Suspended or banned couriers: if such an account is deleted, we keep only one-way coded copies of its phone number, email, Google or Apple id, device id and document numbers, so that the same person cannot open a new account. We do not keep the numbers themselves or the document photos.
• Businesses: while the partnership lasts, and afterwards for as long as the law requires us to keep financial records.
• Orders, including recipients' data: with the order records, for as long as the law requires us to keep financial records.
• Website enquiries: [retention period for enquiries: to be confirmed].
• Sign-in codes: deleted automatically soon after they expire.

8. How we protect data

• Identity document numbers are kept as a keyed hash and an encrypted copy. The app shows only the last four characters; only our document-review staff can see the full number.
• Passwords, API key secrets and wallet PINs are stored only as hashes. Webhook signing secrets are stored encrypted.
• Merchant app users sign in with a password, and can turn on a two-step code sent by SMS. The session cookie cannot be read by scripts on the page, and a second cookie protects against forged requests.
• Data travels over encrypted connections (HTTPS).
• Our staff see only what their role needs, and their actions in our admin tools are logged.

No system is perfectly secure. If a data breach affects you, we will tell you as the law requires.

9. Your choices and rights

You can ask us to:

• tell you what data we hold about you, and give you a copy;
• correct data that is wrong;
• delete your data, unless the law requires us to keep it;
• stop using your data for a purpose you object to.

We may need to check who you are before we act. We answer within a reasonable time, and within any time limit the law sets.

Couriers can delete their account in the app (My account → Delete account), or follow Courier account deletion. You stop sending your location by going offline, but the app cannot offer you orders while you are offline. You can turn notifications off in the app settings or on your phone.

Recipients should contact the business they ordered from. We will help the business answer.

10. Children

Zadi GO is a service for businesses and is not meant for children. Couriers must be old enough under the law to work and to drive. We do not knowingly collect children's data.

11. Changes to this policy

We may update this policy. When we do, we change the date at the top. If a change is important, we also tell couriers and businesses in the app or by message.

12. Contact us

For questions about your data, or to use your rights:

• WhatsApp: 0901237352 (opens in a new tab)
• Email: [email to be confirmed]
• Post: the registered address in section 1.