Covers the DeliDelivers Customer app, Restaurant Partner app, and Rider app · Last updated: 8 September 2026
This Privacy Policy explains how DeliDelivers ("we", "us", "the Platform")
collects, uses, and protects personal data across all of our apps. We comply
with the EU General Data Protection Regulation (GDPR) and Irish data protection law.
1. Who we are (Data Controller)
DeliDelivers is a food-delivery marketplace operating in Ireland, connecting
customers, restaurants, and delivery riders through three apps. For all
data-related queries, contact
privacy@delidelivers.ie.
2. What data we collect
CUSTOMER APP
Name, email, phone number, hashed password
Delivery address and map-picked location
Order history: items ordered, restaurants, amounts, timestamps
Payment information — processed directly by Stripe; we never see or store your full card number
Push notification token (for order status updates)
Ratings and reviews you leave for restaurants and riders
RESTAURANT PARTNER APP
Business name, owner name, email, phone number, hashed password
Restaurant address, menu items, prices, opening hours
Stripe Connect account details (for receiving payouts) — bank details are held by Stripe directly, not by us
Order history and earnings records
Push notification token (for new order alerts)
RIDER APP
Name, email, phone number, hashed password
Delivery area and vehicle type/registration
Identity documents uploaded during verification: driving licence, vehicle registration, insurance
Live GPS coordinates while actively delivering an order (only while the app is running and an order is accepted)
Delivery history and ratings received from customers
Payment records for amounts owed and received
Push notification token (for delivery alerts)
3. Why we collect it (Lawful basis under GDPR Art. 6)
Contract necessity — to let you place orders, run your restaurant, or accept deliveries and get paid
Legal obligation — verifying riders are legally permitted to drive commercially, and tax/financial record-keeping
Legitimate interest — platform safety, fraud prevention, and customer trust
4. Who we share data with
Data is shared only with those needed to complete each order:
Restaurants receive: customer name, delivery address, order contents
Riders receive: customer name, phone, delivery address, live GPS during delivery
Customers receive: rider name, phone, live GPS during delivery; restaurant name and menu
Google Firebase — authentication and data storage (EU servers)
Stripe — payment processing and restaurant payouts (PCI-DSS compliant; we never see full card numbers)
Vercel — backend hosting
Cloudinary — encrypted storage for rider identity documents
Expo — push notification delivery
Rider identity documents are never shared with restaurants or customers — only platform administrators can access them for verification. We do not sell personal data to third parties.
5. Where data is stored
Data is stored within the European Union (Firebase, europe-west1, Ireland).
Rider identity documents are stored on Cloudinary's encrypted EU infrastructure.
6. How long we keep data
Account profiles: while active + 30 days after deactivation
Rider identity documents: while active + 6 months after deactivation, then permanently deleted
Order and delivery history: 7 years (Irish tax law)
Live GPS coordinates: deleted 30 days after each delivery completes
Payment and payout records: 7 years (Irish tax law)
Ratings/reviews: while account is active + 30 days
Push notification tokens: deleted after 90 days of inactivity
7. Your rights under GDPR
Access — request a copy of your data by email
Rectification — correct inaccurate data via your app's Profile/Edit screen
Erasure — deactivate your account (Profile → Delete Account) in any of our apps
Portability — receive your data as a JSON export on request
Restriction — ask us to stop processing specific data
Objection — object to processing based on legitimate interest
Complaint — lodge a complaint with Ireland's Data Protection Commission
To exercise any right, contact privacy@delidelivers.ie.
We respond within 30 days. Note: order records identifying past customers,
restaurants, or riders must be retained for 7 years under Irish tax law even
after account deletion — identifying details are anonymised on those records.
8. Identity documents (riders) — extra sensitive
Stored encrypted on Cloudinary's EU servers
Access-restricted to platform administrators only, for verification purposes
Never shared with third parties for marketing or profiling
Permanently deleted 6 months after a rider leaves the platform
9. Location data — extra sensitive
Collected only while a rider's app is running and an order is actively being delivered
Tracking stops the moment an order is marked delivered
Coordinates are deleted 30 days after each delivery
Location access can be revoked anytime via phone Settings, though this prevents accepting new delivery jobs
Background location tracking requires explicit permission via your device's system dialog
10. How we protect data
Passwords hashed via Firebase Authentication
All connections use HTTPS (TLS 1.2 or higher)
Rider documents encrypted at rest on Cloudinary
Role-based access — only administrators can view rider verification documents
Payments handled entirely by Stripe (PCI-DSS compliant); we never see full card data
11. Data breach procedure
If a breach affecting personal data occurs, we will notify Ireland's Data
Protection Commission within 72 hours and notify affected users directly by
email or SMS.
12. Cookies and tracking
Our apps do not use tracking cookies, advertising IDs, or third-party analytics/advertising SDKs.
13. Changes to this policy
We may update this Privacy Policy occasionally. Significant changes will be
notified in-app and by email. The "Last updated" date above reflects the
latest version.