1. Information We Collect

We only collect data necessary to provide seamless marketplace and delivery services:

• Account & Identification: Full name, verified email address, phone number, and hashed authentication credentials. Signups are validated using our self-generated 6-digit cryptographic OTP system.
• Delivery & Address Data: Street address, flat number, postcode, and delivery instructions shared strictly with the assigned courier during an active delivery run.
• Real-Time GPS & Telemetry: Courier vehicle coordinates and live estimated times of arrival during active order transit.
• Web Push Subscriptions: Standard VAPID browser push endpoints used to transmit order updates, courier approach alerts, and smart substitute notices. Users may revoke push permissions at any time via browser settings or in-app toggle.
• Media & Photos: Vendor dish photos, logos, and KYB certificates uploaded securely to Cloudinary.

2. How Your Data Is Secured

We implement industry-grade technical and organizational security measures:

• All database tables are guarded with PostgreSQL Row-Level Security (RLS), ensuring users can only read and write their own authenticated records.
• Payment card transactions are tokenized and processed through Stripe Connect (PCI-DSS Level 1 compliant). Oririka never stores raw payment card numbers or CVVs.
• All data transmissions are encrypted in transit via TLS 1.3.

3. Third-Party Disclosures

We do not sell, rent, or trade your personal data. Personal information is only shared with:

• Assigned Kitchens & Vendors: Necessary customer first name and dietary notes to fulfill your cooked or grocery order.
• Delivery Partners: Address and contact phone number to courier fleets (or 3rd-party dispatch partners like Deliveroo / Uber Direct).
• Payment & Infrastructure Providers: Supabase (Database/Realtime), Stripe (Payments), Cloudinary (Images), and Resend (Transactional OTPs & Receipts).

4. Your Rights Under UK GDPR & Self-Service Account Erasure

Under the UK Data Protection Act 2018 and UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request rectification of incorrect or outdated details.
• Instant Self-Service Account Erasure (“Right to be Forgotten”): You can permanently delete your buyer or vendor account and all personal data directly in the app at any time via Member Profile > Delete Account & Personal Data (or Vendor Dashboard > Danger Zone).
• Upon deletion, your authentication record, phone number, saved delivery coordinates, and personal identifiers are immediately and permanently erased from our Supabase database, while historical orders are anonymized for tax compliance.
• Withdraw consent for marketing communications or web push notifications at any time.

To submit formal data requests or exercise additional statutory rights, contact our Data Protection Officer at privacy@oririka.co.uk.