Privacy Policy

1Who we are

Alo Express is a delivery marketplace in the Kurdistan Region of Iraq. In the Alo Express app, customers order from partner restaurants, grocery stores and shops, and our drivers deliver the orders. Members of partner businesses use the same app to manage their shop, and our drivers use the Alo Express Driver app.

The service is operated by Alo Express, Duhok, Iraq (“we”, “us”). We are responsible for the personal information described in this policy.

This policy covers the Alo Express app (for customers and partner businesses), the Alo Express Driver app and this website.

2Information we collect

Everyone who uses our apps

• Phone number. We use it to log you in with a one-time code and to contact you about your orders.
• Name. It is shown on your orders so the shop and the driver know who the order is for.
• Language and settings, such as your notification choices.
• Device and connection information: an installation ID created by the app, your push-notification token, app version, device model, operating system and IP address. We use it to keep your login secure, send notifications and prevent abuse.
• Crash and error reports. If an app crashes or hits an error, a report goes to our error-monitoring service. It contains technical details (the error, app version, device model and operating system) and our internal account number, but not your phone number, addresses or payment details.

Customers

• Delivery addresses: the point you choose on the map, the landmark and details you type (such as building, floor and directions) and the contact phone for the delivery. We use the map point to check that we deliver there, to calculate the delivery fee and to guide the driver. The app uses your device location only when you tap “Use my current location”, and never in the background.
• Orders: the shop, items, prices, delivery fee, payment method, order status, your notes and any problem you report, including photos you choose to attach.
• Search by photo. When you search with a photo, the app sends it to our server, where our own software finds the items in it and matches them with products in nearby shops. The photo itself is not stored: it is deleted as soon as the answer is sent. So that you can switch between the items found, we keep only their outlines, the types of product recognised and a numeric description of each item, without the picture, for up to 2 days.
• Support and reports: messages you send to our support team, notes our staff add about your request, and reports you make about a shop or product.

Members of partner businesses

• Your name, phone number and role in the business (owner, manager or staff).
• What you do in the app for the business, such as accepting or rejecting orders and changing products, prices, stock or opening hours. We keep this record to run the service and to resolve disputes.
• Product photos and descriptions you upload. They belong to the shop's catalogue, are shown publicly in the app and are analysed by our own software so that customers can find the products by photo.
• Remove background. When you remove the background of a product photo, the photo is sent to our server and the cleaned copy comes straight back to your phone. Our server keeps neither of them; only the photo you then choose to upload becomes part of the shop's catalogue.

Information about the business itself, such as its licences, contract, commission and payout details, is handled under the business's partner agreement.

Drivers

• Your name, phone number, identity and driving-licence documents, and vehicle details. Our staff collect these when they create your driver account.
• Precise location while you are Online in the Alo Express Driver app, including when the app is in the background or the screen is off. Location sharing starts when you tap “Go online” and stops when you go Offline. We use it to offer you nearby jobs, to show dispatchers where drivers are and to check deliveries when there is a dispute.
• Your jobs and trip times, the cash you collect and hand over, your earnings, and photos you take as proof of pickup or delivery.

Payments

• FIB (First Iraqi Bank). You approve FIB payments in the FIB app. We never see your FIB login, PIN, card or bank-account details. We keep the FIB payment reference, amount, status and dates, and the details of any refund. We do not store the payer's name or account number (IBAN); if we need them to send you money back, we request them from FIB at that time.
• Cash on delivery. We record the amount the driver collected.

3How we use your information

• To provide the service: logging you in, showing shops and delivery fees for your area, placing, preparing and delivering orders, and handling payments and refunds.
• To communicate with you: order-status notifications, one-time login codes sent by WhatsApp or SMS, and answers from our support team. We send offers and news only if you turn on “Offers and news” in the app, and you can turn it off at any time.
• To keep the service safe: limiting login-code requests, detecting fake orders and fraud, and limiting cash on delivery for accounts that repeatedly refuse deliveries.
• To fix and improve our apps, using crash reports and service statistics.
• To meet legal obligations, such as keeping accounting and tax records and answering lawful requests from authorities.

We do not sell personal information. We do not show third-party advertising, use advertising trackers or build advertising profiles.

4Who receives your information

• The shop preparing your order receives your name, the items and your notes for the shop.
• The driver delivering your order receives your name, phone number, delivery address, map point and delivery notes while the delivery is in progress.
• Customers see the first name of the driver delivering their order, the vehicle type and the plate number.
• Service providers that work for us and may use the information only to provide their service:
  • Bird, which sends login codes by WhatsApp and SMS and receives your phone number;
  • First Iraqi Bank (FIB), which processes FIB payments and refunds;
  • Sentry, which receives crash and error reports;
  • Expo, Google Firebase Cloud Messaging and Apple Push Notification service, which deliver notifications;
  • Google Maps (on Android) and Apple Maps (on iPhone), which show maps in the apps under their own privacy policies;
  • our hosting, network-security and backup providers, including Cloudflare.
• Photos for search by photo and remove background are analysed by our own software on our own server. No outside company analyses them.
• Authorities, when the law requires it, for example a valid request from a court, the police or the tax authority.
• A new owner, if Alo Express is merged or sold. This policy would continue to protect your information.

5Where your information is kept

Our servers are in Germany. Some of our service providers, such as Bird, Sentry, Cloudflare, Expo, Apple and Google, process information in other countries, including the European Union and the United States. We choose providers that protect information with appropriate security measures.

6How long we keep it

• Account information (phone number, name, addresses and settings): while your account is open. It is deleted when you delete your account.
• Order, payment, refund and invoice records: as long as Iraqi tax and accounting law requires. After you delete your account, we keep these records without your name, phone number or exact address.
• Driver location history: 30 days.
• Login-code records: 30 days.
• Login and security logs (phone number, IP address and device ID): 90 days.
• Notification records: 90 days.
• Crash reports: 30 days.
• Photos you use to search by photo or to remove a background: not kept. They are deleted as soon as the answer is sent.
• The details of a search by photo (item outlines, product types and numeric descriptions, without the photo): up to 2 days, or until you delete your account if that is sooner.
• Backups: our backups are kept for up to 30 days and then deleted. If we ever restore a backup, we apply your deletion again.

7Deleting your account

You can delete your account at any time:

• in the Alo Express app: Account › Delete account;
• on the web, without the app: aloexpress.app/delete-account.

We confirm it is you with a one-time code. When your account is deleted, we remove your name, phone number, saved addresses and map points, favourites and notification settings, and sign you out on all devices.

We keep your past orders and payments for accounting, without your name, phone number or exact address; the delivery point is reduced to an approximate area of about 100 metres. If an account was blocked for fraud, we keep a scrambled (hashed) form of its phone number to stop the same abuse again. We also ask our service providers to delete information they hold about you where they can.

If you have an order in progress, we sign you out immediately and finish the deletion automatically when the order and any refund are complete. For members of partner businesses and for drivers, our team completes the deletion within 7 days. The details are on the account deletion page.

8Your choices and rights

• See and correct your information. You can change your name, addresses and language in the app. You can also ask our support team for a copy of your information or to correct it.
• Notifications. You can turn off “Offers and news” at any time. Order updates are part of the service; you can turn off all notifications in your phone's settings.
• Location. Location permission is optional in the Alo Express app: you can always place the map point yourself. Drivers share their location only while Online.
• Delete your account, as described above.
• Questions and complaints. Contact us using the details below.

9Security

We protect your information with encrypted connections (HTTPS), one-time login codes, login sessions stored on our servers only in scrambled (hashed) form, staff access limited to what each role needs and recorded in an audit log, and private storage for identity documents, contracts and delivery photos. No system is completely secure. If a security incident affects your information, we will tell you and the authorities where the law requires.

10Age

Our apps are for people aged 18 or over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

11Changes to this policy

We may update this policy. We will publish the new version on this page with a new date and, for important changes, tell you in the app before they take effect.

12Contact us

For privacy questions and requests, email support@aloexpress.app or use the phone and WhatsApp details on our support page. Our address: Duhok, Iraq.

This policy is published in Kurdish (Badini and Sorani), Arabic and English. The Kurdish and Arabic versions are the official versions; the English version is a translation.