1. Who we are and what this covers
Yum Express is a food, grocery and delivery platform in Tanzania, developed and operated by Klikcell Technologies Ltd ("we", "us"), the developer named on our app store listings. This Privacy Policy explains what personal data we collect, why, who we share it with and your rights. It covers the yum-express.com website, the vendor dashboard and these apps:
- Yum Express, the customer app (Android package com.yumexpress.yum_express)
- Yum Riders, the rider app (Android package com.yumexpress.yumriders)
- Yum Partners, the vendor app (Android package com.yumexpress.yum_vendor)
We handle personal data in line with the Personal Data Protection Act, 2022 of Tanzania. This policy should be read with our Terms & Conditions.
2. Information we collect from everyone
- Account details: first and last name, email address, phone number, profile photo (optional) and password (stored only as a secure hash).
- Sign-in with Google or Apple: your name and email address from that provider. We never receive your Google or Apple password.
- Verification: one-time codes sent by SMS or email, stored only in hashed form and for a short time.
- Device and app data: device type, operating system, app version and push-notification token, so we can send you notifications.
- Security logs: sign-in attempts, IP address, browser or device user agent, and account activity such as password changes and deletion requests.
- Support: messages, tickets, feedback and contact-form submissions you send us.
- Referrals: your referral code and who signed up with it.
3. Additional information from Customers
- Addresses and location: saved delivery addresses, map pins and, if you allow it, your device's location (GPS). We use this to show nearby Vendors, work out delivery fees and deliver your order.
- Orders: cart contents, orders, delivery instructions, substitution choices, order history, tips, reviews and ratings.
- Payments: payment method type, mobile money number used for payment, card brand and last four digits only, transaction references, refunds and wallet transactions. Full card numbers and mobile money PINs are handled by our payment partners, not stored by us.
- Parcels: pickup and drop-off addresses, recipient name and phone number, and a description of the parcel.
- Events and tickets: bookings, tickets and check-in scans, plus any attendee details the organiser requires. Wedding hosts give us their guests' names and phone numbers so tickets can be sent. Hosts must have their guests' permission to share them.
- Global Shop: product links you submit, quotes, and your order and shipping details.
- Shopping lists and Yumi: lists you create, photos of lists you upload, and your conversations with Yumi, our AI assistant.
4. Additional information from Vendors
- Business details: business name, type, description, address, phone, email, logo and cover images, branch locations (with map coordinates), business hours and outlet status.
- Verification: business licence, TIN and other documents you upload for verification.
- Catalogue: menus, products, prices, photos and stock, including menu files or photos you upload for AI menu import.
- Financial: commission agreement, sales, earnings, payout requests and your payout account details.
- Performance: order acceptance, preparation times, cancellations, ratings and reviews.
5. Additional information from Riders
- Identity and vehicle: driving licence number, vehicle type, registration number and model, and verification documents you upload.
- Live location: while you are online in the Rider app and during active deliveries, we collect your GPS position, accuracy, speed and heading. We do not collect your location while you are offline.
- Delivery records: jobs offered, accepted and completed, status updates with timestamps, waiting times, and proof-of-delivery and parcel pickup photos.
- Earnings: delivery earnings, waiting-fee share, tips, incentives, weekly rewards, bonuses, payouts and your payout account details.
- Performance: ratings, on-time rate, acceptance and cancellation history.
6. Location data
Our apps access your device's location. We collect it only for the purposes below, and only after you give permission in your device settings.
Customer app and website
- What we collect: your precise location (GPS) or approximate location (network-based), depending on what you allow, plus the delivery addresses and map pins you save.
- When: only while you are using the app, for example when you open the home screen, pick a delivery address or check out. The customer app does not collect your location in the background.
- Why: to find your delivery address, show Vendors that deliver to you, work out delivery fees and estimated times, and deliver your order.
Rider app, including background location
- What we collect: your precise location (GPS), with accuracy, speed and heading.
- When: while you are online and during active deliveries, including when the app is closed or not in use (background location). A persistent notification, "Yum Riders is tracking your location", is shown whenever this is active. Collection stops when you go offline or sign out.
- Why: to offer you nearby delivery jobs, show customers where their order is, calculate distances, delivery and waiting fees and arrival times, confirm pickups and drop-offs, and detect GPS spoofing and fraud.
Sharing and your choices
- A Rider's live location is shared with the customer whose order they are delivering, and with Yum Express support, only while that order is active.
- A customer's delivery address is shared with the Vendor and with the Rider assigned to that order.
- Location data is sent to Google Maps to show maps, search addresses and calculate routes.
- We do not sell location data or use it for third-party advertising.
- You can turn location access off at any time in your device settings. Customers can still enter an address by hand. Riders need location access to go online and receive delivery jobs.
- Retention is described in the section on how long we keep information.
7. How we use your information
- To create and secure your account, verify your phone number or email, and keep you signed in.
- To take orders, process payments, refunds and payouts, and run the wallet, tips, referrals and promotions.
- To match orders and parcels to nearby Riders, show live tracking and estimated arrival times, and calculate delivery and waiting fees.
- To send order updates, receipts, reminders and important notices by push notification, SMS, email or in-app message.
- To personalise what you see, such as nearby Vendors, search results, recommendations, and reminders about lists or unfinished orders.
- To provide Yumi, read photos of shopping lists and import vendor menus using AI.
- To handle support requests, disputes and claims.
- To detect and prevent fraud, promotion abuse, fake orders, GPS spoofing and other misuse, and to protect the safety of users and Riders.
- To measure and improve service quality, for example Vendor preparation times and Rider on-time performance.
- To meet legal, tax and accounting obligations.
8. Marketing messages
We may send you offers, flash-sale alerts and news about Yum Express by push notification, SMS or email. You can turn marketing notifications off in your device or app settings, or by contacting support. Order and account messages will still be sent because they are needed to provide the service.
9. Who we share information with
We do not sell your personal data. We share only what is needed, with:
Other users, to complete an order
- Vendors receive the order details and the customer information needed to prepare and hand over the order.
- Riders: before accepting a job, a Rider sees only the customer's first name and an approximate drop-off area. After accepting, the Rider sees the customer's name, phone number, delivery address and instructions for that job only. Riders cannot see other Riders' jobs, and your email address is never shared with Vendors or Riders.
- Customers see the assigned Rider's name, phone number, vehicle details and live location while their order is on the way.
- Event organisers and wedding hosts see bookings and check-ins for their own events.
Service providers working for us
- Payment partners (such as ClickPesa and mobile money networks) to process payments, refunds and payouts.
- SMS and email providers to deliver one-time codes and notifications.
- Google Firebase and Apple to deliver push notifications.
- Google and Apple for sign-in, if you choose to use it.
- Google Maps for maps, address search, distances and routes.
- OpenAI to power Yumi, read shopping-list photos and extract menus from vendor uploads. Only the content needed for that task is sent.
- Hosting and cloud storage providers that store our data and files.
- Couriers (such as DHL or FedEx) for Global Shop international shipping.
Legal and safety
We may disclose information if the law requires it, to respond to lawful requests from authorities, to investigate fraud or safety incidents, or to protect the rights and safety of our users, Riders, Vendors and Yum Express. If Yum Express is involved in a merger or sale, data may be transferred to the new owner under this policy.
10. Proof-of-delivery photos
Riders photograph the package at the drop-off point, not the customer. These photos are stored privately, are never public, and are shown only to authorised Yum Express staff through links that expire after a few minutes. Every time someone views a photo, it is recorded in an audit log together with who viewed it. We use the photos only to confirm delivery and resolve disputes.
11. International transfers
Some of our service providers (for example cloud hosting, push notifications, maps and AI) process data outside Tanzania. When this happens we use providers with appropriate safeguards and share only what is needed for the service.
12. How long we keep information
- Account information is kept while your account is active.
- If you delete your account, it is deactivated straight away and kept for 30 days so it can be restored if you change your mind. After that, or immediately if you choose permanent deletion, your profile is deleted.
- Orders, payments, refunds, payouts and earnings records are kept for as long as tax and accounting law requires, even after an account is deleted. Where possible they are no longer linked to your profile.
- Rider location history, security logs and delivery photos are kept only as long as needed for operations, safety, disputes and fraud prevention, then deleted.
- One-time verification codes expire within minutes.
13. How we protect your information
- Data is sent over encrypted HTTPS connections.
- Passwords and one-time codes are stored only as secure hashes.
- Sign-in sessions use signed tokens that can be revoked on all devices, for example after a password change.
- Repeated failed sign-in and verification attempts are rate-limited and locked.
- Sensitive files, such as verification documents and delivery photos, are stored privately and not publicly accessible.
- Staff access is limited to people who need it for their work.
14. Your rights
Subject to the law, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data (most details can be edited in your profile);
- delete your account and data, from your profile settings or by contacting us;
- object to or restrict certain processing, including marketing;
- withdraw consent, for example to location access or notifications, in your device settings;
- complain to the Personal Data Protection Commission of Tanzania.
To use these rights, email support@yum-express.com. We may need to verify your identity before acting on a request.
15. App permissions, cookies and local storage
- Location (precise and approximate): the customer app uses it while you use the app to find your address and nearby Vendors; the Rider app uses it while you are online and on deliveries, including in the background. See Location data.
- Camera and photos: to upload a profile picture, shopping lists, menus, verification documents or delivery photos.
- Notifications: for order, delivery and account updates.
On the website we use your browser's local storage to keep you signed in, remember your cart (including a cart session key before you sign in) and save preferences such as your location. We also use a service worker cache to make pages load faster. You can clear these in your browser settings, but you will be signed out and your cart may be lost.
16. Children
Yum Express is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
17. Changes to this policy
We may update this policy when our services change. We will show the new "Last updated" date, and for significant changes we will notify you in the app, by email or by SMS.