Privacy Policy

This Privacy Policy explains what information Mzera Xpress collects when you use our website and web app, how we use it, and who we share it with. It applies to the Mzera Xpress client web app only.

Account data. Name, email address, phone number, and password when you register.

Phone verification data. One-time passcodes (OTPs) sent to verify your phone number, and your verification status.

Location & delivery data. Pickup and drop-off addresses and coordinates you enter or select (via Google Maps), and, during an active delivery, live courier location for order tracking.

Order & transaction data. Items ordered, restaurant/merchant, order amounts, order status, and any courier ratings or comments you submit.

Usage & analytics data. We use PostHog, a third-party analytics provider, to understand how the Service is used. When you consent to analytics cookies (see Section 5), we collect:

• Pages you visit ($pageview events)
• Your name, email, phone number, and account role, once you are identified (i.e. logged in)
• Cart activity: items added, removed, or cleared
• Checkout activity: when checkout starts, and order totals/item counts
• Completed orders, including order amounts, item counts, and delivery address
• Failed orders and the reason for failure
• Courier ratings you submit, and whether a comment was included
• Standard technical/device data collected automatically by PostHog (e.g. browser, device type, approximate location derived from IP address)

Google sign-in data. If you sign in or register with Google, we receive the basic profile information Google shares with us (e.g. name, email).

• To create and manage your account, and verify your phone number
• To process, fulfil, and track your orders and deliveries
• To communicate with you about your orders and account
• To provide customer support
• To understand usage patterns and improve the Service, where you have consented to analytics
• To detect and prevent fraud or misuse of the Service

We share limited data with the following third-party service providers, solely to operate the Service:

• PostHog (product analytics) — processes usage data described in Section 2, hosted on PostHog's US infrastructure.
• Africa's Talking (SMS delivery) — sends the OTP codes used for phone verification.
• Google Maps Platform — powers address autocomplete, map display, and live delivery tracking.
• Google OAuth — used only if you choose to sign in with Google.
• Payment processing — [PLACEHOLDER: no payment processor integration was found in the current codebase; confirm whether one is in use (e.g. mobile money, card processor) and disclose it here before publishing.]

We do not sell your personal information.

We use PostHog to understand how the Service is used. On your first visit, a cookie banner lets you accept or reject non-essential analytics tracking. If you reject, no analytics events are sent. If you accept, the events listed in Section 2 are collected. You can change your choice at any time by clearing your browser's local storage for this site and revisiting.

Essential cookies/local storage used to keep you signed in and remember your cart are not covered by this banner, as they are required for the Service to function.

We retain account and order data for as long as your account is active and as needed to comply with legal obligations, resolve disputes, and enforce our agreements. [PLACEHOLDER: confirm specific retention periods.]

Depending on applicable law [PLACEHOLDER: confirm applicable rights under Zambia's Data Protection Act, 2021], you may have the right to access, correct, or request deletion of your personal information. To exercise these rights, contact us using the details in Section 11.

We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is not directed at children under [PLACEHOLDER: confirm minimum age, e.g. 18] and we do not knowingly collect personal information from children.

Some of our service providers (including PostHog and Google) process data outside Zambia, including in the United States. By using the Service, you acknowledge that your information may be transferred to and processed in other countries.

We may update this Privacy Policy from time to time; material changes will be reflected by an updated "Last updated" date. Questions about this policy can be directed to:
[PLACEHOLDER: registered company name]
[PLACEHOLDER: physical/registered address]
[PLACEHOLDER: support email]
[PLACEHOLDER: support phone number]