Privacy Policy & Data Handling

1. Information we collect

• Account & Identity Credentials: Full legal name, verified email address, phone number, hashed authentication tokens, and user classification (Customer Sender, Independent Courier, or Commercial Business account).

• Precise Real-Time Geolocation: When a customer tracks an active delivery or when an independent courier is on-duty, we collect precise device GPS coordinates, heading, and speed telemetry. Courier locations broadcast strictly while on duty or fulfilling an accepted dispatch. Real-time geofencing validates that couriers arrive within 20 feet of designated pickup and drop-off doorsteps.

• Delivery Route & Cargo Metadata: Origin and destination street addresses, apartment/suite numbers, building gate codes, recipient names, recipient contact numbers, package size tiers (Envelope, Small, Medium, Large), declared dimensions, weight, and delivery handling notes.

• Visual Proof-of-Delivery Photos: High-resolution timestamped and geotagged photographic evidence captured at pickup and drop-off locations. Photos are transmitted over TLS 1.3 and stored in private AES-256 encrypted cloud object storage.

• Financial & Direct Deposit Data: Payment card tokens, transaction identifiers, itemized delivery amounts, and courier payout destination bank accounts (account holder name, account type, routing number, and account number). Payment card processing is executed exclusively through Stripe (PCI-DSS Level 1 certified); KURYEP never stores raw 16-digit card numbers or CVV security codes.

2. Biometric and courier identity verification

To protect senders, merchants, and the general public, prospective courier partners undergo automated identity verification and compliance screening prior to receiving dispatch offers:

• Biometric Facial Verification: Powered by Stripe Identity, couriers submit a photo of their government-issued driver's license alongside a live biometric selfie liveness scan. Biometric geometry compares facial authenticity in real time to prevent fraud and account sharing.

• Background & MVR Screening: In compliance with the Fair Credit Reporting Act (FCRA), couriers authorize a Motor Vehicle Record (MVR) review and criminal history screening. Pre-adverse and adverse action notices, along with formal dispute mechanisms, are provided in strict adherence to federal and Florida employment screening standards.

3. In-app communications and privacy severing

• Ephemeral Order Coordination: In-app chat between sender and courier exists solely to resolve real-time logistics questions, such as parking instructions, security gates, or doorstep navigation.

• Automatic Post-Delivery Privacy Severing: Immediately upon parcel handover confirmation or order cancellation, all direct communication channels between customer and courier are permanently terminated. Neither party can view historical chat transcripts, send new messages, or access telephone relay numbers. Redacted audit transcripts remain accessible exclusively to authorized dispatch safety personnel to investigate disputes.

4. How we use your information

• Proximity Dispatch Matching: Pairing delivery requests with the closest available courier based on vehicle tier (Motorcycle, Car, SUV, Van) and cargo volume capacity.

• 4-Digit Recipient Security PIN: Enforcing a unique 4-digit recipient verification PIN at drop-off to eliminate delivery mix-ups, theft, and false non-delivery disputes.

• Automated Direct Deposit Payouts: Settling courier delivery compensation, transparent stop fees ($5.00 per stop), and 100% of customer tips directly to the courier's linked checking or savings account.

• Safety & Fraud Prevention: Monitoring route geofences, detecting suspicious cargo or multi-account abuse, and maintaining commercial platform safety.

5. Sharing and third-party service providers

We share personal data strictly with verified enterprise infrastructure providers bound by contractual Data Processing Agreements:

• Financial Infrastructure: Stripe Payments and Stripe Connect for payment execution, direct deposits, and 1099-NEC tax reporting.

• Geocoding & Mapping: Google Maps Platform, OpenStreetMap, and Apple CoreLocation for route distance calculation, geocoding, and map rendering.

• Cloud Database & Storage: Supabase and AWS (us-west-2) for encrypted relational records and private photo evidence vaults.

• Push & Communications: Apple Push Notification service (APNs), Expo Push, Twilio, and Resend for mission-critical dispatch alerts and 2FA authentication codes.

KURYEP NEVER SELLS, RENTS, MONETIZES, OR TRADES PERSONAL DATA TO THIRD-PARTY ADVERTISERS, MARKETING NETWORKS, OR DATA BROKERS.

6. Data retention schedule

• Active Delivery Records: Order details remain active until delivery is completed and finalized.

• Post-Delivery PII Redaction: Customer street addresses, recipient phone numbers, and contact names are automatically redacted from courier earnings screens and route history archives.

• Statutory Accounting Ledgers: Under IRS regulations and federal accounting standards, completed delivery transaction ledgers, itemized payouts, and 1099-NEC records have a mandatory 7-year retention period measured from the close of the tax year.

• Purge on Account Deletion: When an account is deleted, personal profile data, saved addresses, personal contacts, vehicle photos, and non-statutory records are immediately and permanently erased from active databases.

7. Account deletion and user controls

Customers can permanently delete their account at any time in Customer App Settings → Delete Account. Couriers can delete their account directly in Courier App Profile → Delete Account or Settings → Account & Legal → Delete Account.

Deletion requires all active deliveries to be resolved, pending courier cash-outs to be settled, and owned business organizations to be closed. Once confirmed, profile records, credentials, and uploaded documents are permanently erased. Deletion cannot be reversed.

8. Your privacy rights under CCPA, GDPR, and Florida law

Depending on your location, you have enforceable privacy rights regarding your personal information:

• Right to Know & Access: Request a portable copy of personal information collected about you.

• Right to Correct: Rectify inaccurate or outdated account or vehicle details.

• Right to Delete: Request the permanent erasure of your personal data.

• Right to Non-Discrimination: We never deny service, adjust pricing, or degrade quality for exercising statutory privacy rights.

To submit a formal privacy request, visit our Account & Data Requests portal or email [email protected].