Privacy Policy

Last updated: 30 October 2026

SFEX Logistics ("SFEX", "we", "us") operates a delivery service through three mobile applications: the SFEX Customer app, the SFEX Vendor app, and the Safer Driver app, available on the Apple App Store and Google Play. This policy explains what personal data each app collects, why we collect it, who we share it with, how long we keep it, and the choices you have.

By using any SFEX application you agree to the practices described here.

1. Who we are

SFEX Logistics
Address: Erbil, Kurdistan Region, Iraq
Email: info@sfexlog.com
Phone: +964 750 105 1100

For any question about this policy or your data, contact us at the email address above.

2. Data we collect

2.1 SFEX Customer app

Name — to identify the recipient of an order.
Phone number — your account identity, and the number the vendor or driver calls about your delivery.
Profile photo (optional) — shown on your account.
Date of birth and gender (optional) — part of your account profile.
Saved delivery locations — a label you choose (for example "Home" or "Work"), the address type, an optional description, the city, and the map coordinates of the place. You add, edit and delete these yourself.
A one-off share of your current location — used only when a driver calls you and you are not at one of your saved locations. It helps the driver find you at that moment. It is not added to your saved locations and is not kept as part of your profile. The app does not track your location in the background or continuously.
Typed address text — when you describe a delivery address instead of choosing a saved one.
Order information — the item categories, prices, delivery fee, order status, and the order's QR reference.
Loyalty points — your points balance and the points earned on each order.
Social media handle (optional) — the channel you used to place an order with a vendor.
Order activity records — what happened to your order, when, and who acted on it.
Push notification token and your chosen app language — so we can notify you about your delivery.
One-time verification code (OTP) — sent to your phone number to sign in and confirm you own it.

2.2 SFEX Vendor app

Name and phone number — your account identity and login.
Shop name — identifies your business to SFEX, drivers and customers.
Shop location — map coordinates, an optional location description, and the city, so the pickup driver can find your shop for collections and in-person cash handovers.
National ID photographs (front and back) — required to verify your identity before your account is approved. Seen only by authorised SFEX staff.
Password — stored only as a salted hash; we never store or can read your actual password.
One-time verification code (OTP) — sent to your phone number to confirm you own it.
Social media links (optional) — shown with your vendor profile.
Item categories you sell — used for order routing and prohibited-item checks.
Financial records — balances held in our office and in transit, payouts, and per-order amounts, so we can settle what we owe you.
Service feedback recorded about your shop.
Push notification token and app language.

2.3 Safer Driver app

Driver accounts are created by SFEX staff; drivers do not register themselves.

Name and phone number — your account identity, login, and the number vendors and customers use to reach you about a pickup or delivery.
Vehicle name and plate number — so vendors and customers can identify your vehicle.
One-time verification code (OTP) — sent to your phone number when you reset your password.
Vehicle registration photograph, national ID photographs (front and back), and driving licence photograph — to verify your identity, your vehicle, and that you are licensed to drive. Seen only by authorised SFEX staff.
Password — stored only as a salted hash.
Assigned city — so we can assign you nearby orders.
Payment type, payment amount and balance — so we can pay you per order or per month.
Cash and payment transactions — deposits, withdrawals, per-order amounts and notes, for cash reconciliation.
Order activity records — the delivery steps you performed.
Service feedback recorded about you.
Push notification token and app language.

The Safer Driver app does not collect continuous or background location data. We do not track drivers' movements.

3. Device permissions

The apps ask for the following permissions only when you use the feature that needs them. You can refuse or withdraw any permission in your device settings.

Location (only while the app is in use) — to pin a saved delivery location or your shop location on the map, or to send a one-off current location to a driver. Location is never collected in the background.
Camera — to scan order QR codes at pickup and handover, and to take a profile photo or identity document photo.
Photos / media library — to choose a profile photo or identity document photo you already have. Only the photo you select is uploaded.
Notifications — to tell you about order status, assignments and payouts.

4. Why we use your data

We use the data above only to:

create and secure your account, and verify your identity where required;
accept, route, deliver and track orders;
allow customers, vendors and drivers to contact each other about a specific delivery;
calculate delivery fees, driver payments, vendor payouts and cash reconciliation;
operate the customer loyalty points programme;
send you notifications about your orders;
resolve disputes and investigate problems with a delivery;
meet our legal, tax and accounting obligations.

We do not use your data for advertising, we do not track you across other companies' apps or websites, and we do not sell your data to anyone.

6. Payments

SFEX handles cash on delivery. We record order amounts, delivery fees, balances and payouts. We do not collect card numbers or bank account details, and no third-party payment processor is used within the apps.

7. Security

All communication between the apps and our servers uses HTTPS/TLS encryption.
Passwords are stored as salted hashes (bcrypt) and cannot be recovered or read by anyone, including our staff.
Uploaded images are held in private storage and are only accessible through temporary signed links.
Access to personal data inside SFEX is restricted by role and permission.

8. How long we keep data

Account and order records are kept while your account is active, and afterwards for as long as we need them for financial, tax, legal and dispute purposes.
Deleted accounts (customer, vendor and driver) are closed immediately and marked as deleted rather than erased, so that past orders, payments and cash records remain auditable. A deleted account can no longer sign in or be used, its phone number is released so it can register again, and its data is used only for financial, tax, legal and dispute purposes.
Saved delivery locations you delete are erased, unless they were used for a past order — then they are kept with that order's record.
One-time verification codes are deleted within 10 minutes.
A one-off current-location share is not stored after the delivery moment it was used for.

9. Your rights and choices

You can:

Access the personal data we hold about you;
Correct your name, phone number, photo and other profile details in the app;
Add, edit or delete your saved locations at any time (Customer app);
Turn off push notifications in your device settings;
Refuse location access — the Customer app will still work, but you will need to type your address instead of sharing a location;
Delete your account yourself from the app at any time (see section 10).

10. Deleting your account

You can delete your SFEX account yourself, at any time, from inside the app: open Profile → Delete account. This works in the SFEX Customer, SFEX Vendor and Safer Driver apps.

To protect you and us, deletion is only possible once everything is settled:

Customer app: no order may be on its way. You confirm with a verification code sent to your phone. All your loyalty points are lost when the account is deleted and cannot be restored.
Vendor app: your balance in our office and on the way must be zero (all payouts received), all orders must be delivered or returned to you, and the points on your delivered orders must be settled. You confirm with your password.
Safer Driver app: you must have handed in all collected cash, your balance with SFEX must be zero, and no order may still be assigned to you or in your hands. You confirm with your password.

If something is not settled, the app tells you exactly what. Once you confirm, your account is deleted immediately and this cannot be undone: you are signed out, the account can no longer be used, notifications stop, and your phone number is released so you can register again later as a new account.

We keep the deleted account's records (profile details, uploaded documents, order history, payments and cash transactions) marked as deleted, only for financial, tax, legal and dispute purposes. They are not used for anything else.

If you can no longer access the app, email info@sfexlog.com or call +964 750 105 1100 from your registered phone number and we will delete the account for you under the same conditions.

Full account deletion instructions

11. App Store and Google Play disclosures

This summary matches the data declarations we make on the Apple App Store (App Privacy) and Google Play (Data safety). All data listed is collected for app functionality and account management, and is linked to your account.

Data	Google Play category	App Store category	Apps
Name	Personal info › Name	Contact Info › Name	Customer, Vendor, Driver
Phone number	Personal info › Phone number	Contact Info › Phone Number	Customer, Vendor, Driver
Date of birth, gender (optional)	Personal info › Other info	Other Data	Customer
Saved locations, shop location, one-off location share	Location › Precise location	Location › Precise Location	Customer, Vendor
Profile photo, ID document, vehicle and licence photos	Photos and videos › Photos	User Content › Photos or Videos	Customer, Vendor, Driver
Order history and amounts	Financial info › Purchase history	Purchases › Purchase History	Customer, Vendor
Balances, payouts, cash transactions	Financial info › Other financial info	Financial Info › Other Financial Info	Vendor, Driver
Order activity records	App activity › Other actions	Usage Data › Product Interaction	Customer, Vendor, Driver
Account ID	Personal info › User IDs	Identifiers › User ID	Customer, Vendor, Driver
Push notification token	Device or other IDs	Identifiers › Device ID	Customer, Vendor, Driver

Tracking: none. SFEX does not track you across apps or websites owned by other companies and does not use an advertising identifier.
Advertising and analytics: none. The apps contain no advertising, analytics or crash-reporting SDKs.
Data sold: none.
Data shared with third parties: none for their own purposes. Google Firebase, Cloudflare and our verification code provider only process data on our behalf to deliver the service.
Encryption in transit: yes, all data is sent over HTTPS/TLS.
Deletion: you can delete your account at any time from inside the app (section 10). Deleted accounts are closed immediately; records are kept only for financial, tax, legal and dispute purposes.

12. Children

The SFEX applications are not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy. When we do, we will change the "Last updated" date at the top of this page, and where the change is significant we will notify you in the app.

14. Contact

Questions, complaints or data requests:

SFEX Logistics
Email: info@sfexlog.com
Phone: +964 750 105 1100
Address: Erbil, Kurdistan Region, Iraq