Privacy Policy
Last updated: October 22, 2026
Amana connects people who send parcels with travellers who carry them. This policy explains which personal data we collect, why, who receives it, how long we keep it and what your rights are. We wrote it to be read: if anything is unclear, write to us.
1. Who is responsible for your data
The data controller is [Company legal name], [Registered address, Switzerland] ("Amana", "we").
For any question about your data or to exercise your rights, write to [privacy@your-domain].
Representative in the European Union (art. 27 GDPR): [EU representative — name and address].
We apply the Swiss Federal Act on Data Protection (FADP) and, because we serve people in the European Union, the General Data Protection Regulation (GDPR). Members living in Morocco, Algeria or Tunisia also benefit from the protections of their national data-protection laws.
2. What data we collect
- Account: phone number, first and last name (other members only see your first name), date of birth (to check you are 18 or older; not shown to other members), a password (stored only in encrypted form), and optionally your email, a photo and a short bio. We do not ask for your home address.
- Identity verification: type of document, photos of your ID card (front and back) or passport, a short selfie video in which you say a code we give you, the date of your consent and the result of the review.
- Trips you publish: cities, pickup address and map pin, dates, transport mode, capacity and price.
- Parcels you send: pickup and delivery addresses, description, weight, declared value and photos.
- Bookings and delivery: status, tracking steps, delivery photo, delivery code, disputes, ratings and reviews.
- Payments: amounts, fees, status and the references of our payment provider. We never see or store your card number.
- Messages you exchange in the booking chat, and the notifications we send you.
- Recipient who pays: if a sender asks someone else to pay, we receive that person's phone number from the sender.
- Technical data: IP address (used for security and abuse limits, not stored in your profile) and the cookies described in the Cookie Policy.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating your account and signing you in with an SMS/WhatsApp code | Performance of our contract with you |
| Publishing trips and parcels, bookings, chat, tracking, holding the payment until delivery and paying the traveller | Performance of the contract |
| Verifying the identity of members (ID + selfie video) | Our legitimate interest and that of members in the safety of people and parcels and in preventing fraud; your consent for the selfie video |
| Handling disputes, preventing fraud, securing the platform, keeping evidence for legal claims and cooperating with the authorities | Legitimate interest; legal obligation where the law requires it |
| Inviting a recipient to pay for a parcel | Legitimate interest of the sender and of Amana in carrying out the delivery requested |
| Service messages (SMS, WhatsApp, in-app notifications) | Performance of the contract |
| Accounting and tax records | Legal obligation |
We do not sell your data, we do not use it for advertising and we do not take decisions about you based solely on automated processing.
4. Who can see your data
- Other members see your first name (not your last name), photo, bio, rating, reviews, "verified" badge and the trips you publish. Once a booking exists, the sender and the traveller see what they need to carry out the delivery (addresses, parcel details, chat). Your phone number is never shown to other members.
- Amana staff (administrators and moderators) see identity documents to review them and booking details to resolve disputes. Access to identity files is restricted and recorded.
- Service providers who process data on our behalf, under a data-processing agreement: Railway (application hosting), Neon (database), Cloudinary (storage of photos, documents and videos), Twilio (sign-in codes, SMS and WhatsApp messages), OpenStreetMap / Nominatim (address search and maps: the addresses you type are sent to it) and, when card payments are enabled, Stripe.
- Public authorities, when the law requires it or to report an offence (for example a parcel that is not delivered or a dangerous item).
5. Transfers outside Switzerland and the EU
Some of our providers are located in, or may access data from, the United States. These transfers are covered by the EU–US and Swiss–US Data Privacy Framework or by the standard contractual clauses approved by the European Commission and recognised in Switzerland.
Amana carries parcels to and from Morocco, Algeria and Tunisia. When you book a delivery with a member in one of these countries, the data needed for that delivery is shared with that member because it is necessary to perform the contract you asked for.
6. How long we keep your data
| Data | How long |
|---|---|
| Account and profile | While your account is open. When you close it, your profile is anonymised immediately. |
| ID photos (card or passport) | While your account is open. After closure: 5 years after your last delivery, to handle disputes and legal claims. If you never made a delivery: deleted when you close the account. |
| Selfie video | 30 days after the review of your verification |
| Documents of a rejected verification | 30 days after the decision |
| Chat, delivery photos and parcel addresses | 5 years after the booking ends |
| Payment and accounting records | As long as accounting and tax laws require (up to 10 years) |
| Notifications and record of invitations sent | 12 months |
| Log of staff actions | 5 years |
Exceptions: while a dispute is open, while an account is blocked for breaking our rules, or when an incident has been reported to the authorities (legal hold), we keep the related data until the matter is closed.
When the period ends, the data is deleted or irreversibly anonymised. Reviews you wrote stay visible under "Deleted user".
7. Your rights
You can at any time ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format and withdraw your consent (withdrawal does not affect what was done before).
- Download your data: Profile → Privacy & your data → Download my data.
- Close your account: Profile → Privacy & your data → Close my account.
- For anything else, write to [privacy@your-domain]. We answer within one month and may ask you to prove your identity.
You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC); in the EU the authority of your country (for example CNIL in France, AEPD in Spain, APD/GBA in Belgium); in Morocco the CNDP.
8. Security
Connections are encrypted. Identity documents, selfie videos and parcel and delivery photos are stored privately and are only shown through temporary signed links. Staff access depends on their role, and every access to an identity file is recorded. If a data breach puts your rights at risk, we will inform the competent authority and, where required, you.
9. Minimum age
Amana is reserved for people aged 18 or over. We do not knowingly collect data about minors; if you think a minor has an account, tell us and we will delete it.
11. Changes
If we change this policy in a way that matters to you, we will tell you in the app before the change applies. The date of the latest version is shown at the top of this page.