Privacy Policy

Effective Date: August 29, 2026 | Last Updated: October 16, 2026 Document Version: 2.1 (Kenya DPA & Google Play Compliant)
✓ Kenya Data Protection Act, 2019 Compliant 📍 Foreground & Background Location Disclosed 🔒 Zero Sale of Personal Data & No Ad-ID Tracking

Welcome to Wanaag. At Wanaag Technologies Ltd. (also operating as Wanaag Delivery Company Limited, referred to in this policy as "Wanaag", "we", "us", or "our"), we recognize that when you order meals, deliver packages, or partner with us as a merchant, you place your trust in how we handle your personal information.

This Privacy Policy provides a transparent, comprehensive explanation of how we access, collect, use, store, share, retain, and protect your personal data when you use the Wanaag mobile applications for Android and iOS (covering both Customer and Delivery Rider modes), our websites (https://wanaag.app), our Merchant Portal (https://merchants.wanaag.app), and our backend APIs (https://api.wanaag.app) (collectively, the "Services").

📍 Prominent Summary: How Wanaag Accesses & Uses Location Data

1. Customers (Foreground Location Only): Wanaag collects precise or approximate location data from Customer devices only while the Wanaag app is open and running in the foreground on screen. This is used to display nearby restaurants, calculate accurate distance-based delivery fees and ETAs, and pin your delivery drop-off address. Customers may decline GPS access and enter their delivery address manually.

2. Delivery Drivers / Riders (Foreground & Background Location): For registered Delivery Riders, Wanaag accesses and collects precise GPS location data in both the foreground (while the app is open) and the background (even when the Wanaag app is minimized, closed, or not in use, or when the device screen is locked) strictly while the rider is toggled "Online" or completing an active delivery. Background location is required to stream live order tracking to the customer, dispatch the closest available rider to a restaurant pickup, provide route navigation, and calculate distance-based rider earnings. Tracking stops immediately when the rider toggles "Offline".

3. Zero Monetization of Location Data: Wanaag never sells, rents, or shares your location history with third-party data brokers or advertising networks.

1. Scope & Data Controller Details

For the purposes of the Kenya Data Protection Act, 2019 (Act No. 24 of 2019), the Data Protection (General) Regulations, 2021, and applicable international data protection laws, the Data Controller responsible for your personal data is:

This policy applies to all individuals who interact with our Services, divided into four primary user categories:

  1. Customers: Individuals who browse menus, place food or grocery orders, and track deliveries using the Wanaag mobile or web application.
  2. Delivery Partners ("Riders" or "Drivers"): Independent couriers who register, complete identity/KYC verification, and accept delivery jobs through the Wanaag Rider interface.
  3. Merchant / Restaurant Partners: Restaurant owners, managers, and staff who onboard stores, manage menus, and fulfill orders via the Wanaag Merchant Portal.
  4. Website Visitors & Support Contacts: Anyone visiting our public web pages or communicating with our customer support teams.

2. Categories of Personal Data We Collect

We practice strict data minimization: we only collect personal data that is necessary to operate a safe, reliable, and legally compliant on-demand delivery marketplace.

2.1 Information Provided by Customers

2.2 Information Provided by Delivery Partners (Riders / Drivers)

To ensure customer safety, road compliance, and fraud prevention, Riders undergo mandatory Know-Your-Customer (KYC) verification before being permitted to go online:

2.3 Information Provided by Restaurant & Merchant Partners

2.4 Payment & Financial Data

2.5 Device, Network & Diagnostic Telemetry

3. Detailed Location Data Disclosure (Foreground & Background)

Location data is core to coordinating hyperlocal food delivery between customers, kitchens, and couriers. We handle location permissions differently depending on whether you use Wanaag as a Customer or as a Delivery Partner (Rider).

3.1 Customer Location Data (Foreground Only)

  • Permissions Used: android.permission.ACCESS_FINE_LOCATION and android.permission.ACCESS_COARSE_LOCATION (while using the app).
  • When Accessed: Strictly in the foreground when the Wanaag app is open and visible on your screen, and only after you review our in-app Prominent Disclosure dialog and grant permission. The Customer app never accesses your location in the background when the app is closed.
  • How It Is Collected: Via your device's GPS receiver, Wi-Fi access points, and cell tower triangulation.
  • Exact Purposes:
    1. Restaurant Discovery: Filtering and sorting restaurants, cafes, and grocers that deliver to your current neighborhood.
    2. Accurate Pricing & ETAs: Calculating road distance between the restaurant kitchen and your location to display exact delivery fees and estimated arrival times before checkout.
    3. Map Pinning & Address Auto-Fill: Placing your delivery pin on the checkout map so you do not have to type complex directions manually.
    4. Order Handover: Sharing your confirmed delivery coordinates and address notes with the specific Rider assigned to deliver your active order.
  • Customer Control & Opt-Out: You can decline location permissions and still use Wanaag by typing or searching your delivery street address manually. You can also toggle "Use precise location" off at any time inside the app under Profile → Privacy & Data, or revoke permission in your phone's OS settings.

3.2 Delivery Partner / Rider Location Data (Foreground & Background)

  • Permissions Used: android.permission.ACCESS_FINE_LOCATION, android.permission.ACCESS_COARSE_LOCATION, android.permission.ACCESS_BACKGROUND_LOCATION, and android.permission.FOREGROUND_SERVICE_LOCATION.
  • When Accessed: In both the foreground (while viewing the app) and the background (even when the Wanaag app is minimized, closed, or not in use, or when the device screen is locked), starting from the moment a verified Rider taps "Go Online" or accepts a delivery job, and continuing until the delivery is completed or the Rider switches to "Offline".
  • Why Background Location Is Strictly Necessary for Riders:
    1. Live Customer Order Tracking: Riders rarely keep the Wanaag app open on screen while riding a motorcycle or driving; they either lock their phone in a mount or switch to turn-by-turn navigation apps (such as Google Maps). Background location streaming over WebSockets allows the waiting customer to watch the rider's real-time progress toward their doorstep on the live order tracking map.
    2. Proximity-Based Order Dispatch: Our dispatch engine evaluates the live coordinates of online riders to assign new restaurant pickups to the closest courier, ensuring food arrives hot and reducing unnecessary travel distance.
    3. Route Navigation & Arrival Detection: Assists riders with route guidance from the restaurant pickup point to the customer drop-off location and provides accurate live ETAs.
    4. Verified Mileage & Fair Earnings: Accurately measures actual distance ridden during an active order so riders are compensated fairly for distance-based delivery fees.
    5. Rider Safety & Emergency Support: Enables Wanaag's operations and support team to locate and assist a rider if an accident, safety incident, or order dispute occurs while in transit.
  • Prominent In-App Disclosure & Persistent System Notification:
    • Before requesting location permissions for the first time, the Wanaag Rider interface displays a dedicated Prominent Disclosure Modal explaining clearly that Wanaag collects location data in the background even when the app is closed or not in use.
    • Whenever background location tracking is active on Android, a persistent Foreground Service Notification is visible in the device's notification tray so the rider is continuously aware that location sharing is active.
    • When a rider toggles their status to "Offline" or logs out of the app, background location collection stops immediately.

4. Device Permissions We Request & Why

The Wanaag mobile app requests the following operating system permissions only when a specific feature requires them:

Permission Applies To When Requested Purpose & Consequence of Declining
Precise & Coarse Location
ACCESS_FINE_LOCATION
ACCESS_COARSE_LOCATION		 Customers & Riders After viewing the in-app Prominent Disclosure modal when browsing nearby stores, opening the map, or going online as a rider. Shows nearby restaurants, calculates delivery fees/ETAs, and pins addresses. Customers who decline can still enter addresses manually.
Background Location
ACCESS_BACKGROUND_LOCATION
FOREGROUND_SERVICE_LOCATION		 Riders Only After the Rider explicitly accepts the Rider Background Location Prominent Disclosure prior to going online or accepting a delivery job. Enables live customer map tracking, smart order dispatch, and mileage calculation while the rider's screen is off or using another navigation app. Riders cannot accept live tracked deliveries without location enabled.
Camera
CAMERA		 Customers & Riders Only when you tap to capture a profile picture, scan a KYC identity document, or take a biometric verification selfie. Captures rider KYC documents/selfies for identity verification and optional user profile photos. Never accessed in the background.
Photos / Media Selection
READ_MEDIA_IMAGES / System Photo Picker		 Customers, Riders & Merchants Only when you choose to upload an existing photo from your gallery (e.g., driver license scan, insurance document, or profile photo). Allows uploading verification documents or profile images.
Push Notifications
POST_NOTIFICATIONS		 Customers & Riders Upon sign-in or order placement. Delivers real-time alerts when your order is accepted by the kitchen, picked up by a rider, or arriving at your door, and alerts riders to new delivery offers.
Internet & Network State
INTERNET
ACCESS_NETWORK_STATE		 All Users Granted automatically at install time. Required to communicate with api.wanaag.app over HTTPS/WSS.

5. Legal Bases for Processing Personal Data

Under Section 30 of the Kenya Data Protection Act, 2019 (and equivalent international frameworks such as the GDPR), we process your personal data only when at least one of the following lawful bases applies:

  1. Performance of a Contract: Processing is necessary to fulfill our contractual obligations to you when you create an account, place an order, accept a delivery job as a rider, or receive M-Pesa payments and payouts.
  2. Explicit Consent: Where we ask for your affirmative permission—such as granting foreground or background location access after our Prominent Disclosure, capturing biometric KYC selfies for rider verification, saving optional allergy preferences, or subscribing to promotional updates. You have the right to withdraw consent at any time.
  3. Compliance with Legal & Statutory Obligations: Processing required to comply with Kenyan laws, including the Kenya Revenue Authority (KRA) tax record-keeping mandates, National Transport and Safety Authority (NTSA) commercial transport rules, anti-fraud/AML regulations, and lawful orders from courts or the ODPC.
  4. Legitimate Interests: Processing necessary for our legitimate operational and security interests—such as preventing payment fraud, defending against automated bot attacks, maintaining audit logs, ensuring the physical safety of riders and customers, and improving app stability—provided those interests do not override your fundamental rights and freedoms.

6. How We Use Your Personal Data

We use the collected information strictly for the following purposes:

7. Data Sharing, Sub-Processors & Third-Party Disclosures

Wanaag does not sell, rent, or trade your personal data or location data to any third party. We share limited data only with the parties involved in fulfilling your transaction or providing essential technical infrastructure under strict confidentiality and data protection agreements:

Recipient / Category Data Elements Shared Why It Is Shared
Partner Restaurant / Merchant Customer first name, ordered items, quantities, allergy/dietary notes, and order reference ID. To prepare, package, and label your meal accurately. Restaurants do not receive your payment PIN or account password.
Assigned Delivery Rider Customer name, delivery street address/building, pinned drop-off GPS coordinates, phone number, and delivery notes. Strictly to navigate to the pickup/drop-off points and contact you upon arrival.
Ordering Customer Assigned Rider's first name, profile photo, vehicle type, license plate number, phone contact, and live GPS location during active delivery. So the customer can track the approaching delivery in real time and identify the courier safely at handover.
Payment Processors (Safaricom M-Pesa / Equity Jenga) Mobile money phone number, transaction amount, and order invoice reference. To trigger STK Push payment prompts, verify transaction completion, and disburse rider/merchant payouts.
Identity Verification Provider (Youverify) Rider government ID details, document scans, and live verification selfie. To perform automated KYC, document authenticity checks, and biometric liveness verification for Delivery Partners.
Mapping & Infrastructure Providers (Google Maps / Firebase / Cloud Hosting) Coordinates for geocoding/routing, FCM push tokens, and encrypted application data. To render interactive maps, calculate road routes, deliver push notifications, and host our backend databases securely.
Communications Gateways (Africa's Talking / Email Providers) Phone number or email address and transactional message content (OTPs, order receipts). To deliver SMS verification codes, password reset links, and order status notifications.
Regulators & Law Enforcement Specific account or transaction records formally requested under applicable law. Only when legally compelled by a valid court order, subpoena, or statutory requirement under Kenyan law (e.g., ODPC, KRA, NTSA).

8. Data Retention Schedule & Deletion Timelines

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable Kenyan statutory retention laws. Our specific retention periods are detailed below:

Data Category Active Retention Period Post-Deletion / Expiry Handling
Customer Profile, Saved Addresses & Allergy Preferences For the duration of your active Wanaag account. Permanently erased or irreversibly de-identified within 30 days of an account deletion request.
Real-Time GPS Location Stream Ephemeral during active session / delivery. Live location pings are overwritten continuously. Historical route summaries linked to orders are de-identified upon account deletion.
Rider KYC Documents & Verification Records Duration of active Rider partnership. Retained in restricted compliance storage for up to 5 years after partnership termination to satisfy transport safety, fraud-audit, and legal defense requirements, then securely destroyed.
Customer Support Chats & Dispute Tickets Up to 24 months from ticket closure. De-identified or deleted after resolution and expiry of the dispute review window.
Order Invoices, Payment Logs, Payouts & Tax Records 7 years from the transaction date. Retained in access-restricted, de-identified accounting archives as required by Kenyan tax and financial record-keeping laws (KRA).
Encrypted Database Backups Rolling 35-day disaster recovery cycle. When data is deleted from our live production database, any residual copy in encrypted backups expires and is automatically overwritten within 35 days.

9. Technical & Organizational Security Measures

We implement rigorous engineering and organizational safeguards to protect your personal data against unauthorized access, alteration, disclosure, or destruction:

10. Cookies, Local Storage & Tracking Technologies

On our web applications (wanaag.app and merchants.wanaag.app) and mobile apps, we use strictly necessary local storage and session cookies for:

We do not use third-party advertising cookies, behavioral retargeting pixels, or cross-app tracking SDKs.

11. International Data Transfers

While Wanaag primarily serves users in Kenya, our cloud hosting infrastructure, mapping services, and identity verification sub-processors may process or store encrypted data on servers located outside Kenya (including secure data centers in the European Union and the United States).

Whenever personal data is transferred outside Kenya, we ensure compliance with Part VI (Sections 48 and 49) of the Kenya Data Protection Act, 2019 by verifying that the recipient jurisdiction maintains commensurate data protection laws (such as EU GDPR adequacy) or by executing enforceable Standard Contractual Clauses (SCCs) and data processing agreements that require equivalent technical and organizational encryption safeguards.

12. Your Rights Under the Kenya Data Protection Act, 2019 & Global Law

Under Section 26 of the Kenya Data Protection Act, 2019 (and applicable international privacy laws), you have the following enforceable rights regarding your personal data:

13. Account Deletion & Data Export Procedure

You can permanently delete your Wanaag account and associated personal data at any time without needing to contact support, or you can submit a deletion request on the web:

  1. In the Wanaag Customer App: Open Profile → Privacy & Data → Delete Wanaag account (or Profile → Manage Account → Delete Account) and confirm permanent deletion.
  2. In the Wanaag Rider App: Open Profile → Manage Account → Delete Account and confirm permanent deletion.
  3. On the Web (Without Opening the App): Visit our dedicated Account & Data Deletion Page or send an email from your registered email address to [email protected].

Upon confirmation, your login sessions are terminated immediately, and your active profile data is erased or anonymized within 30 days (with encrypted backups expiring within 35 days), subject only to the statutory financial and safety retention exceptions described in Section 8.

14. Children's Privacy (18+ Requirement)

Wanaag's Services are intended exclusively for adults aged 18 years and older. We do not knowingly solicit, collect, or process personal data or location information from children under the age of 18. Delivery Partners must be at least 18 years old and hold a valid national ID and driving license. If we discover or are notified that a minor under 18 has created an account or submitted personal data, we will immediately deactivate the account and purge the associated personal data from our active records. If you believe a minor has provided data to Wanaag, please alert us at [email protected].

15. Changes to This Policy & Contacting Our Data Protection Officer

We may update this Privacy Policy periodically to reflect new app features, operational changes, or evolving legal and Google Play requirements. When we make material changes, we will update the "Last Updated" date at the top of this page and notify you via an in-app notice, push notification, or email prior to the change taking effect.

If you have any questions, data access/deletion requests, or concerns regarding this Privacy Policy or our location data practices, please reach out to our team:

Data Protection Officer (DPO) & Privacy Team
Wanaag Technologies Ltd.
Email: [email protected]
Account Deletion: api.wanaag.app/delete-account
Customer, Rider & Security Support
General Support: [email protected]
Security & Vulnerability Reports: [email protected]
Web Platform: https://wanaag.app