Your journey should move.
Your data should not.
This policy explains what GulfDelivery (“GD”, “we”, “us”) collects and how you can control it when using our web and mobile services.
1. Data we collect
We collect profile and contact information you provide, including your name, phone or email, nationality, country and accommodation. Google sign-in provides your Google account identifier and basic profile details. We collect journey details, parcel requests, recipient contacts, payment status and references, delivery events, disputes, notifications, device push tokens, security logs and risk signals.
For traveler checks, GD stores a ticket reference, only the last 4–6 characters of a resident ID, and an alternate trusted contact. Do not upload a full resident ID unless GD explicitly introduces a protected, legally reviewed upload flow.
2. Why we use it
Match journeys, manage capacity, collect the GD platform fee, unlock contacts at the correct milestone and record handover and delivery.
Prevent duplicate journeys, investigate fraud, moderate high-value parcels, resolve disputes and preserve an accountable audit history.
Send booking, payment, safety and privacy updates in the app or by push notification.
Maintain records required for payments, refunds, complaints, tax, law enforcement requests and other applicable legal duties.
3. Who sees what
Public journey listings show traveler initials—not a full name or contact. A sender and traveler receive direct contact details only after acceptance and confirmed payment of GD’s platform fee. Payment providers receive the minimum information needed to process M-Pesa or Paystack transactions. Firebase may process notification device tokens. Authorized GD administrators may access records needed for safety, support, reconciliation and privacy requests. We do not sell personal data.
4. International processing
GD connects people across Qatar, the UAE, Saudi Arabia, Bahrain, Oman, Kuwait, Lebanon, Kenya and Uganda. Data may therefore be processed outside your country. We limit transfers to service delivery and administration, use suitable provider safeguards, and apply access controls and data minimization.
5. Retention and deletion
Profile data is kept while your account is active. When you close your account, GD removes sign-in credentials, sessions, contact details, notification devices and other direct profile identifiers, then anonymizes the account. Unused journey evidence is removed. Delivery, payment, refund, dispute and security records may be retained in pseudonymous form for the period required to prevent fraud, resolve claims and satisfy applicable financial or legal duties.
You can also request deletion of selected data. We review the request against active deliveries and mandatory retention duties, tell you the decision, and delete or anonymize data that is no longer needed.
6. Your choices
- Review and correct your profile, journeys and open parcel requests.
- Delete an unused journey or withdraw an unpaid parcel request.
- Close and anonymize your whole account.
- Request deletion of selected profile, contact, journey, parcel or notification data.
- Withdraw optional notification permission in your device settings.
- Ask for access, correction, objection or deletion where applicable law provides it.
7. Security and children
GD uses authenticated access, role-based administration, hidden public identities, payment-provider callbacks, OTP milestones, audit logs and risk monitoring. No service is completely risk-free; report suspected misuse through the in-app dispute or privacy request flow. GD is intended for adults able to enter a delivery agreement and is not directed to children.
8. Applicable privacy frameworks
Our controls are designed around the privacy principles and data-subject rights in the markets we serve, including Qatar’s Personal Data Privacy Protection Law and Saudi Arabia’s Personal Data Protection Law. Local rights and exemptions differ, and the law that applies to a request depends on the user and processing location.
9. Contact and changes
Submit a privacy request from the GD privacy choices screen. This creates a tracked administrator case and sends status updates to your notification inbox. We may update this policy as services or laws change; the effective date above will change when a material update is published.