Privacy Policy

1. Who this policy covers

Zippa operates a Delivery Capacity Network connecting Organizations (businesses that need deliveries) with Delivery Partners (independent riders and drivers) across Sri Lanka, through Zippa Business (the web portal) and Zippa Rydo (the delivery partner app). This policy explains what personal data we collect from Organizations, Delivery Partners, and the recipients of deliveries, and how we use it.

2. What we collect

• Account data — name, email, mobile number, and business details for Organizations; name, contact details, and vehicle information for Delivery Partners.
• KYC documents — identity and vehicle documents Delivery Partners submit for verification before they can accept jobs.
• Location data — a Delivery Partner's live location while online, used to show nearby jobs and live tracking to Organizations and recipients during an active delivery.
• Job and delivery data — pickup/drop-off addresses, package details, delivery status, photo proof of delivery, and OTP verification records (the OTP code itself is stored only as a hash, never in plaintext).
• Financial data — ledger entries for fees, COD collections, and settlements. We do not store full payment card details.
• Device and usage data — basic technical data (device type, app version, crash logs) needed to operate and secure the service.

3. How we use it

We use personal data to:

• Operate the marketplace — matching published jobs with nearby, verified Delivery Partners.
• Verify identity through KYC before a Delivery Partner can go live on the marketplace.
• Confirm pickup and delivery through OTP and photo proof, and maintain the audit trail these actions require.
• Calculate and record every financial movement as an immutable ledger entry, and run settlement cycles.
• Send transactional notifications (job status, OTP codes, settlement confirmations) by push, SMS, or email.
• Investigate disputes, fraud, or safety incidents, and meet legal or regulatory obligations.

4. Who we share it with

Organizations see the data needed to track their own jobs (Delivery Partner name, vehicle, live location during an active assignment). Delivery Partners see the job details needed to complete a delivery. We use infrastructure and communication providers (hosting, SMS, push notification, email delivery) strictly to operate the service — they process data on our instructions and are not permitted to use it for their own purposes. We do not sell personal data.

5. How long we keep it

Ledger entries and audit logs are retained indefinitely and cannot be edited or deleted, by design — this is what makes every financial movement and critical action independently verifiable. Other account data is retained for as long as the account is active plus a reasonable period after closure for legal, tax, and dispute-resolution purposes.

6. Your rights

Subject to applicable law, you can request access to, correction of, or deletion of your personal data (deletion requests are subject to our record-keeping obligations for financial and audit data described above). Contact us using the details at the bottom of this page to exercise these rights.

7. Children

Zippa is not directed at children and is not intended for use by anyone under 18. Organization and Delivery Partner accounts require legal capacity to enter into a contract.

8. Changes to this policy

We may update this policy as the product evolves. Material changes will be reflected in the "Last updated" date above.