Privacy policy
This policy explains how Aloo collects, uses, shares and protects your personal data in the "Aloo!" customer app, the "Aloo! Sürücü" driver app, the aloobox.com website and the Aloo Business panel (together, the "Service"). Aloo is the controller of your data. Questions: privacy@aloobox.com.
1. Data we collect
| Data | From | When and how |
|---|---|---|
| Phone number | Customers, drivers | Sign-up and log-in (verified with an SMS code). |
| Name, optional email and profile photo | Customers, drivers | When you create or edit your profile. |
| Precise location (GPS) | Customers | Only while the app is open: to set your pickup point, show nearby drivers and track your order. The customer app does not collect location in the background. |
| Precise location (GPS), including in the background | Drivers | While the driver is "Online" and during a trip — even when the app is closed or not in use — to offer nearby orders, show the customer that the driver is approaching, and calculate route and distance. Collection stops when the driver goes "Offline". |
| Trip and order history | Customers, drivers | Pickup/drop-off addresses, route, times, distance, price, payment method, cancellations, ratings and reviews. |
| Parcel receiver's name and phone | Customers | For a courier order you type the receiver or pick one contact. The app reads only the contact you pick; your contact list is never uploaded. |
| Emergency (SOS) contacts | Customers, drivers | Only if you add them. |
| Delivery-proof photos and parcel description | Drivers / customers | The driver may photograph the parcel at pickup or handover; the customer may add a photo of the parcel. |
| Payment information | Customers | At the moment all orders are paid to the driver in cash; the amount and payment status are recorded. Online card payment is not active — when it is launched, card payments will be processed by a licensed payment provider, we will never see or store the full card number or CVV, and this policy will be updated in advance. |
| Driver documents and vehicle | Drivers | Driving licence, ID card, vehicle registration, plate number, motorcycle details and profile photo — to verify and approve drivers. Earnings and payout details. |
| Communications | Customers, drivers | In-app chat messages, support requests and emails. |
| Device and technical data | Everyone | Push notification token, device model, operating system, app version, language, IP address, crash reports (Firebase Crashlytics) and anonymous usage events (Firebase Analytics, e.g. "order created" — without names, phone numbers, addresses or coordinates). |
| Shop (Aloo Business) data | Shops | Shop name, contact person, email, phone, address, delivery orders and their receivers' contact details. |
We do not show ads, do not collect the advertising identifier (IDFA/AAID), do not sell your data and do not track you across other companies' apps or websites.
2. How we use data
- Create your account, verify log-in with an SMS code and keep the account secure.
- Take moto taxi and courier orders, match them with a driver, and calculate route, price and arrival time.
- Live tracking: show the customer the driver's location and send the receiver a tracking link and handover code.
- Process payments, issue receipts and statements, and calculate driver earnings.
- Safety: verify drivers, prevent fraud and abuse, provide the SOS feature and resolve disputes.
- Customer support and service notifications (order status, account).
- Improve the Service using crash reports and anonymous statistics.
- Comply with legal obligations (accounting, tax, lawful requests from authorities).
Legal bases: performance of our contract with you (providing the Service), legitimate interests (safety, fraud prevention, improving the Service), legal obligations and, where required, your consent (e.g. location, contacts, camera and notification permissions — you can withdraw it at any time in your device settings).
3. Who we share data with
- Between driver and customer: once an order is accepted, the driver sees the customer's name, pickup/drop-off points and (for calls/chat) contact; the customer sees the driver's name, photo, motorcycle details, plate number, rating and live location.
- Parcel receiver: receives an SMS with a tracking link and handover code; the link shows the driver approaching and the order status.
- Shops (Aloo Business): delivery status and proof photos for their own orders.
- Service providers acting on our behalf: Google Maps Platform (maps, address search, routes — location and addresses), Google Firebase (push notifications, Realtime Database for live location, Crashlytics, Analytics, anonymous authentication), Twilio (log-in code SMS and tracking SMS — phone numbers), Railway (server and database hosting). They may use the data only to provide their services to us.
- When required by law: in response to lawful requests from competent authorities, or to protect the safety of users.
- Business transfers: in a merger or sale, subject to this policy.
These providers' servers may be located outside Azerbaijan (for example in the USA or the EU). Data is transferred in line with the Law of the Republic of Azerbaijan "On Personal Data", only to the extent needed to provide the Service and with appropriate safeguards. By creating an account and using the apps you consent to such transfers for the purposes in this policy; you can withdraw consent by deleting your account.
4. How long we keep data
- Account data — while your account is active.
- Trip, payment and earnings records — for as long as accounting and tax law requires (usually up to 5 years); after account deletion they are kept in anonymised form.
- Driver live location — in the real-time system only while the driver is online and on a trip; the trip route is kept as part of the trip record.
- Log-in codes — a few minutes; crash reports — Firebase's standard period (90 days).
- Driver documents — until the driver account is deleted.
5. Deleting your account
You can delete your account at any time: in the app via My Account → Settings → Delete Account, or without the app at aloobox.com/delete-account. The account is closed immediately: your name, phone number, email, profile photo, saved places, saved cards, SOS contacts and driver documents are deleted or anonymised, and you are logged out everywhere. Trip and payment records we must keep by law are retained without your name or phone number.
6. Your rights
You have the right to access your data and get a copy, to correct or delete it, to restrict or object to processing, and to withdraw consent. Email privacy@aloobox.com with your account's phone number; we reply within 30 days. You may also complain to the competent authority under the Law of the Republic of Azerbaijan "On Personal Data".
7. Children
The Service is not directed to children under 13 and we do not knowingly collect their data. Ordering requires being 18 or having a parent's consent; drivers must be at least 18. If you believe a child has given us data, email privacy@aloobox.com and we will delete it.
8. Security
Data is sent over HTTPS, log-ins are verified with SMS codes, and access to servers and the database is restricted. No system is 100% secure; if a breach occurs we will notify you as required by law.
9. Changes
We may update this policy. We will announce material changes in the app or on the website in advance. The date above shows the latest version.
10. Contact
Aloo.
Privacy: privacy@aloobox.com · Support: support@aloobox.com