Privacy Policy

1. Data Collection

We collect the information you provide when you sign up, publish a listing or an offer, and communicate on the platform: first and last name, email, phone number, city, pickup and delivery addresses, messages, reviews and delivery information. For drivers, this also includes identity verification (ID document and photo, processed by Stripe), vehicle details, insurance certificates provided, and the phone's location while the driver app is in use, to track deliveries. Card details are entered directly with Stripe: DELIPACK never sees them.

2. How we use your data and legal basis

Your data is used to:

• run the matching service: accounts, listings, offers, messaging, calls and delivery tracking (legal basis: performance of the contract, i.e. our terms and conditions);
• handle payments, payouts to drivers and identity verification (legal basis: performance of the contract and legal obligations to prevent fraud and money laundering);
• keep the platform secure, prevent abuse and handle disputes (legal basis: DELIPACK's legitimate interest);
• measure website traffic and the effectiveness of our ads (Google Analytics, Google Ads, Microsoft Clarity), and send you news if you asked for it (legal basis: your consent, which you can withdraw at any time);
• meet our accounting and tax obligations and respond to the authorities (legal basis: legal obligation).

3. Recipients and service providers

Your data is processed by the DELIPACK team. Other users only see what is needed for the delivery: a driver's first name, last-name initial, city, photo and reviews; the selected driver receives the addresses and contact details needed for the delivery. We use the following service providers:

• Supabase: database, accounts and files — Germany (European Union);
• Hostinger: website and server hosting — France;
• Stripe: payments, payouts and identity verification — United Kingdom, Ireland and United States;
• Resend: sending emails — United States;
• OVH: DELIPACK mailboxes — France;
• Expo and Google Firebase: phone notifications — United States;
• LiveKit: in-app calls — United States;
• Google (Analytics, Ads): traffic measurement and advertising, only with your consent — United States;
• Microsoft Clarity: recording of browsing sessions on the website (clicks, scrolling), only with your consent — United States;
• Base Adresse Nationale (France) and Photon (Germany): address search.

Data may also be disclosed to the competent authorities in the event of a legal requisition. It is never sold.

4. Data Retention Period

Your data is retained for the duration of the contractual relationship and beyond, in accordance with applicable legal limitation periods (notably 5 years for payment accounts).

5. Your Rights

You have the right to access, rectify, erase, restrict, object to and port your data, to withdraw your consent, and to set instructions regarding your data after your death. You can request the deletion of your account from your profile, or exercise these rights by writing to contact@delipack.fr; we reply within one month. If you believe your rights are not being respected, you may lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

6. Cookies

The website uses cookies required for it to work (login, preferences). Delipack also measures, without identifying you, the pages viewed and the links or buttons clicked, to understand what is useful and improve the website. If you accept cookies, these measurements are linked to your account when you are logged in (the Delipack team can then see the pages you viewed, for example to help you), Google's analytics and advertising cookies are enabled, and Microsoft Clarity records your browsing sessions (clicks, scrolling) to help us find what gets in the way on the website. Delipack's measurements are kept for 90 days. Refusing has no consequence on your use of Delipack; you can change your mind at any time by clearing the website's cookies in your browser.

7. Transfers outside the European Union

DELIPACK is published by a British company and some service providers are located in the United Kingdom or the United States. The United Kingdom benefits from an adequacy decision of the European Commission. Transfers to the United States rely on the EU–US Data Privacy Framework when the provider is certified, and otherwise on the European Commission's standard contractual clauses.