سياسة خصوصية OrderStraight Driver
OrderStraight Driver Privacy Policy

Privacy Policy

1. Scope and operator

This Policy explains how Orderstraight LLC (“OrderStraight,” “we,” or “us”) collects, processes, and protects data when you use the OrderStraight Driver app, package com.orderstraight.driver. The app is for Drivers and delivery operations. Depending on who determines the purposes and essential means of processing, OrderStraight may act as a data controller or as a processor for the Driver’s associated Delivery Company.

2. Data we process

• Account and identity: name, phone number, email where provided, internal Driver identifier, profile photo, associated-company details, and account status. This may include required verification documents such as identification, driving licence, vehicle, insurance and permit data, and a Driver photograph.
• Authentication and consent: protected PIN or credentials, login tokens and sessions, login attempts and logs, and records of Terms acceptance and consent. We do not store a readable PIN where systems are designed to store its hash.
• Precise location: when you enable delivery tracking by going Online and grant the required device permissions, the app collects your current and background location, including latitude, longitude, speed and accuracy, and may continue sending it to OrderStraight’s dispatch service when the app is closed or not in use. Tracking continues until it is stopped; normally, successfully going Offline stops it, and you can also revoke Android location permission. While you have an active delivery, the app prevents going Offline until the delivery is completed. We use location to find nearby Drivers and dispatch orders; provide navigation; evidence arrival, pickup and delivery; track trip progress, time and distance; show progress to authorized parties; support safety and detect fraud or location manipulation; and resolve disputes.
• Order, delivery, trip and COD data: order number and status; offer, acceptance, arrival, pickup and delivery times; trip points and distances; delivery instructions and notes; merchant and customer details needed to perform the delivery; delivery fees; cash-on-delivery (COD) amounts; settlements; and operating records.
• Camera, photos, files and QR: photos or files the Driver chooses to upload, pickup/delivery proof or document images, and camera access to scan QR codes or capture feature-required content.
• Microphone: recordings a Driver intentionally creates and sends as voice messages through communication features. We do not use the microphone for continuous recording.
• Device, notifications and security: push token (including Firebase Cloud Messaging or platform notification services), delivery status, operating system, device type and available identifiers, IP address, app version, language, timestamps, crash, diagnostic and performance data, security events, and misuse indicators.
• Wallet and payment: balance, transactions, subscriptions, service fees, payment/refund status, and a provider-returned transaction ID, payment token, masked card number or last digits. Payments are processed by payment providers. We do not intentionally store a full card number or CVV. A reusable payment token may be retained for a feature the user selects until it is erased or expires.
• Communications and support: messages and support requests, phone numbers, and delivery status for operational push, WhatsApp or SMS communications.

3. Why we use data

We use data to create and manage accounts; verify identity, documents and company association; authenticate users and secure sessions; show Driver availability; dispatch, perform, navigate and track deliveries; enable communication and operational notifications; administer wallet, payment, billing, subscription, COD, reporting and settlement functions; provide support and resolve disputes; detect and prevent fraud, manipulation and abuse; diagnose failures and improve service reliability and security; enforce terms; and meet legal, regulatory and accounting obligations.

4. Legal basis, permissions and consent

We process data under the basis appropriate to the activity, including performing the service or contract, meeting legal obligations, proportionate legitimate interests, or consent where required. The app requests precise/background location, camera, photos/files, microphone and notification permissions when needed for a feature. You can manage permissions in operating-system settings, but refusing or withdrawing a necessary permission may prevent tracking, voice messages, proof of delivery or other features from working. Reading this Policy is not blanket consent. Separate, explicit in-app consent is requested where legally required.

5. Data sharing

We do not sell personal data, and we do not use it for third-party targeted advertising. We share only what is necessary with:

• the Driver’s associated Delivery Company and its managers and dispatchers for assignment, operations, billing, support and security;
• the merchant and customer connected to an active delivery, as needed to coordinate, communicate, display Driver status or location, and confirm delivery;
• hosting, cloud, mapping and navigation providers; Google Firebase for notifications and app services; communications, WhatsApp and SMS providers; and payment, storage, support, security and fraud-prevention providers; and
• government, regulatory, judicial and law-enforcement authorities where legally required or necessary to protect rights and safety or investigate misuse.

Service providers are required to handle data for services supplied to us under applicable contracts and law. Third-party services may also be governed by their own terms and policies.

6. International processing and transfers

Hosting, cloud, mapping, notification, communication and payment providers may process data in or outside Jordan. For international transfers, we apply requirements and available safeguards under Jordanian law, appropriate contractual and security measures, and consent or additional steps where legally required.

7. Retention

Unless a different period is required by law, an active dispute, or lawful instructions from a Delivery Company for which we act as processor, our framework is:

• account, profile and verification documents: for the account term and up to two years after closure;
• trip, delivery, billing, wallet and COD records: up to five years after the transaction;
• detailed trip location: up to 12 months after the trip, then deleted or de-identified;
• security and login logs: up to 12 months; and
• Terms, consent and legally required records: up to five years after account closure.

We may retain data longer to the extent required by law or needed for a claim, investigation or dispute, or delete/return it sooner under Delivery Company instructions where OrderStraight acts as processor and law permits. At the end of the period, data is deleted, de-identified or returned according to our legal role.

8. Security

We use reasonable and proportionate technical and organizational safeguards, such as access and authentication controls, credential protection, encryption in transit where available, security logging, backups, logical separation and reviews. No transmission or storage method is completely secure. We manage incidents and provide legally required notices under applicable law.

9. Rights and choices

Subject to applicable law, you may request information and access or a copy, correction or update, withdrawal of consent, restriction or objection, erasure or de-identification, and transfer of a copy where applicable. We may request reasonable information to verify identity and may deny or limit a request where retention is legally required or others’ rights would be affected. You may also go Offline and manage device permissions; prior records may still be retained under section 7.

10. Children

The app is a commercial and operational service and is not directed to children. A Driver account may not be created by anyone who is not legally eligible to drive and perform deliveries. If a minor’s data is incidentally processed in an order, it is used only as necessary to provide the service and as law permits.

11. Changes and Jordan law

We may update this Policy for service or legal changes. We will post the updated version and date, provide appropriate notice, and seek renewed acceptance or consent when required. This Policy and data processing are governed by the laws of the Hashemite Kingdom of Jordan, including Personal Data Protection Law No. 24 of 2023 and regulations and instructions issued under it.