Privacy Policy

Last updated: June 2026

Gahitwen Logistics ("we," "our," or "us") is a product of The Gahitwen LLC, the data controller responsible for your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use the Gahitwen Logistics mobile application and related services.

1. Information We Collect

1.1 Information You Provide

• Identity & Contact Data: full name, phone number, email address.
• Profile Data: profile photo, bio, vehicle license number, region preferences.
• Driver Documents: driver's license, permits, vehicle registration, insurance documents , required for driver and fleet owner verification.
• Cargo & Delivery Data: pickup/dropoff locations, cargo descriptions and photos, delivery instructions, saved addresses.
• Communication Data: in-app chat messages between customers and truckers.
• Payment Data: transaction records, payment method details (processed by secure third-party payment processors , we do not store full card numbers).

1.2 Information Collected Automatically

• Location Data: GPS coordinates for real-time tracking. Drivers share location continuously while on active jobs (foreground + background). Customers share location when browsing nearby truckers or during active delivery tracking.
• Device & Usage Data: device model, operating system, app version, IP address, crash logs, feature usage analytics.
• FCM Token: Firebase Cloud Messaging token for push notifications.

1.3 Third-Party Sources

• WhatsApp OTP Service: for phone number verification during sign-up and login.
• Google Maps: Places autocomplete, directions, and map rendering.

2. How We Use Your Information

• Service Delivery: matching cargo owners with truckers, facilitating bookings, processing payments, enabling real-time tracking.
• Driver Verification: reviewing submitted documents through our admin approval workflow before drivers and fleet owners can operate.
• Communications: sending booking confirmations, status updates, chat messages, and push notifications via Firebase Cloud Messaging.
• Pricing & Geofencing: calculating trip prices based on region-specific pricing configurations and detecting which service area a coordinate falls within.
• Platform Improvement: analyzing usage patterns to improve matching algorithms, pricing accuracy, and user experience.
• Legal Compliance: complying with applicable laws, regulations, and legal processes.

3. Data Sharing & Disclosure

We share your data only as necessary to provide the service:

• Between Users: when you accept a booking, your name, phone number, and real-time location are shared with the other party for the duration of the delivery.
• Supabase: our primary database, storage, and real-time infrastructure provider. All data is stored in Supabase-managed PostgreSQL databases with encryption at rest.
• Firebase (Google): used exclusively for push notification delivery via Firebase Cloud Messaging.
• Google Maps: Places API for address search, Directions API for route calculation, Maps SDK for map rendering.
• Payment Processors: third-party payment gateways that process transactions. We do not store your full payment card details.
• WhatsApp OTP Service: external service for phone verification during authentication.
• Legal Obligations: we may disclose data if required by law, court order, or governmental authority.
• Business Transfers: in the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.

We never sell your personal data to third parties.

4. Data Retention

• Account Data: retained while your account is active. Deleted within 30 days of account deletion request.
• Booking & Transaction Records: retained for 7 years for legal, tax, and accounting compliance.
• Driver Documents: retained while active plus 3 years after account closure.
• Cargo Photos: retained for the booking duration plus 90 days.
• Chat Messages: retained for 2 years from the date of the associated booking.
• Location Data: stored for 90 days in driver_locations table. Real-time streams are ephemeral.
• Usage Logs: retained for 24 months.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): request deletion of your personal data. You can submit a deletion request via our Delete My Data form.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to certain processing activities, including direct marketing.
• Restriction: request limitation of how we process your data.
• Withdrawal of Consent: withdraw consent where processing is based on consent (e.g., location sharing).
• Complaint: lodge a complaint with your local data protection authority.

To exercise these rights, contact us at privacy@gahitwen.com or use the forms on our Contact page. We will respond within 30 days as required by applicable data protection laws.

6. Children's Privacy

Gahitwen Logistics is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will delete it immediately.

7. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. Our infrastructure providers (Supabase, Firebase) operate data centers in the United States and European Union. We ensure appropriate safeguards , including Standard Contractual Clauses and adequacy decisions , are in place for cross-border data transfers.

8. Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: all data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Row-Level Security: Supabase RLS policies ensure users can only access data they are authorized to see.
• Authentication: custom session tokens managed via WhatsApp OTP verification; admin access uses Supabase Auth with email/password.
• Audit Logging: all administrative actions are logged in the admin_action_logs table.
• Access Controls: least-privilege access principles applied across all systems.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least 30 days before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights:

• Email: privacy@gahitwen.com
• Mail: The Gahitwen LLC, 131 Continental Dr Ste 305, Newark, DE 19713, USA
• Online: Contact page , includes forms for data deletion and profile deletion