Privacy Policy
01Who we are
CarryMate Ltd is the data controller for all personal data processed through the CarryMate platform. We are registered with the UK Information Commissioner's Office (ICO).
Our Data Protection Officer can be reached at dpo@carrymate.io.
02What data we collect
| Category | Data collected | Who it applies to |
|---|---|---|
| Account data | Full name, email address, phone number, password (hashed), account role (sender/traveler/both), date of registration | All users |
| Identity verification | Passport or national ID scan, selfie photograph, liveness check result, KYC decision and status, PEP/sanctions screening result | Travelers; senders for high-value transactions |
| Trip and parcel data | Flight details, departure and arrival cities, luggage capacity, parcel descriptions, declared values, item categories, OTP records, parcel photographs | All users |
| Payment data | Escrow transaction records, payout records, payment provider references (Stripe payment intent IDs, Paystack references). We do not store full card numbers — these are handled by our payment processors. | All users |
| Communication data | In-app messages between senders and travelers, support messages sent to CarryMate | All users |
| Device and usage data | IP address, device type, operating system, app version, pages visited, features used, crash reports | All users |
| Location data | Approximate location (derived from IP address). We do not continuously track GPS location. | All users |
| Push notification tokens | Expo push notification token for delivering delivery alerts and account notifications | Mobile app users |
| Ratings and reviews | Delivery ratings (1–5 stars) and written reviews submitted after deliveries | All users |
03Why we collect it and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and managing your account | Contract performance |
| Matching senders with travelers | Contract performance |
| Processing payments and managing escrow | Contract performance; legal obligation (financial regulations) |
| Identity verification and fraud prevention | Legal obligation; legitimate interests |
| Anti-money laundering screening | Legal obligation |
| Providing customs guidance | Legitimate interests (protecting users from legal risk) |
| Sending transactional notifications (match found, OTP, delivery confirmed) | Contract performance |
| Sending marketing communications | Consent (you can withdraw at any time) |
| Improving the platform (analytics, crash reports) | Legitimate interests |
| Complying with legal requests from authorities | Legal obligation |
04How long we keep your data
- Account data: For as long as your account is active, plus 6 years after closure (for legal and tax purposes)
- Identity verification documents: 5 years from the date of verification, in accordance with UK anti-money laundering regulations
- Transaction records: 7 years from the transaction date (required by financial regulations)
- Parcel photographs: 90 days after delivery is confirmed, or until a dispute arising from that delivery is resolved
- In-app messages: 2 years from the date of the conversation
- Marketing data: Until you withdraw consent or unsubscribe
- Device and usage data: 13 months (standard analytics retention)
05Who we share your data with
We share your data only with parties that are necessary to operate the CarryMate platform. We do not sell your data to anyone.
| Recipient | Purpose | Location |
|---|---|---|
| Sumsub / Smile Identity | Identity verification (KYC) | EU / Africa |
| Stripe | Payment processing and escrow (GBP/EUR) | USA (SCCs in place) |
| Paystack | Payment processing (NGN/GHS) | Nigeria |
| Flutterwave | Payouts (mobile money, East Africa) | Nigeria/USA |
| Termii | SMS delivery for OTP and notifications | Nigeria |
| Twilio | SMS delivery (UK/US fallback) | USA (SCCs in place) |
| Firebase (Google) | Push notification delivery | USA (SCCs in place) |
| AWS S3 | Parcel photograph and document storage | South Africa (af-south-1) |
| Supabase | Database hosting and authentication | EU (Ireland) |
| Railway | API server hosting | USA |
| Other users | Your name, rating, and carrier tier are shown to other users as part of the matching process | N/A |
| Law enforcement / customs authorities | When required by law or to investigate suspected fraud or illegal activity | Varies |
All third-party processors are bound by Data Processing Agreements that require them to process your data only on our instructions and to maintain appropriate security measures.
06International transfers
Some of our service providers are based outside the UK and EEA. Where we transfer data to countries that do not have an adequacy decision from the UK ICO, we rely on Standard Contractual Clauses (SCCs) approved by the ICO as the safeguard for that transfer. A list of our transfer mechanisms is available on request from dpo@carrymate.io.
07Your rights
Under UK GDPR you have the following rights. To exercise any of them, contact us at privacy@carrymate.io. We will respond within one month.
Right of access
Request a copy of all personal data we hold about you.
Right to rectification
Ask us to correct inaccurate data or complete incomplete data.
Right to erasure
Ask us to delete your data. This right is not absolute — we may need to retain some data for legal reasons.
Right to restriction
Ask us to stop processing your data while a dispute about its accuracy or lawfulness is resolved.
Right to portability
Receive your data in a structured, machine-readable format and transfer it to another provider.
Right to object
Object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds.
Right to withdraw consent
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
Rights relating to automated decisions
We use automated tools to screen for fraud and prohibited items. You have the right to request human review of any automated decision that significantly affects you.
08Cookies
We use cookies and similar tracking technologies on our website. For full details of the cookies we use, what they do, and how to control them, please see our Cookie Policy.
09Children
CarryMate is not directed at or intended for use by anyone under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a child, please contact us immediately at privacy@carrymate.io and we will delete it promptly.
10Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. The current version is always available at carrymate.io/legal/privacy.
11Contact and complaints
Privacy enquiries
Data Protection Officer: dpo@carrymate.io
General privacy questions: privacy@carrymate.io
Complaints: If you are unhappy with how we handle your data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would always appreciate the chance to address your concerns first before you contact the ICO.