Privacy Policy

Website visitors and people who contact Drop for sales, support, or onboarding.

Merchants, store operators, partners, and developers using Drop portals and APIs.

Senders and recipients involved in deliveries fulfilled through Drop.

Drivers and fleet operators using the Drop Driver Android app or driver onboarding flows.

Internal operational users of Drop ops/admin tools (subject to additional workplace policies).

App name: Drop Driver (also shown as DropDriver on some devices).

Package / application ID: za.co.dropsa.drop_driver_app.

Purpose: authenticated drivers go online, receive delivery assignments, navigate to pickup and drop-off, confirm geofenced trip states, upload proof-of-delivery media, manage verification documents, and view earnings-related information.

Core sensitive capabilities used only for that purpose: approximate and precise location (including background location while a driver is online or on an active trip), camera/photos for verification and delivery proof, notifications for assignment alerts, phone-number authentication, and network access to Drop’s production API (https://api.dropsa.co.za).

This app is for professional delivery drivers. It is not directed at children and is not part of Google Play Families.

Account and contact information: names, email addresses, phone numbers, company or store details, login credentials, and role/access information.

Driver profile and onboarding information: identity and contact details, vehicle type and registration, fleet affiliation where applicable, operating area, verification status, and notes needed for onboarding and compliance review.

Government identity and licensing documents submitted for driver verification (for example ID or licence images). These are used only for identity/eligibility review, fraud prevention, and operational compliance. They are never published publicly.

Banking / payout details drivers provide so Drop can process legitimate driver payouts. Financial details are not disclosed publicly.

Order and delivery operational data: addresses, contact phones for pickup/drop-off coordination, package descriptions/declared value as provided by senders or merchants, timestamps, trip state, exceptions, and support notes.

Location data from the Drop Driver app: latitude, longitude, accuracy, heading, and speed used for dispatch matching, live map updates for operations, geofenced arrival/pickup/delivery confirmation, safety and fraud review, and trip completion audits. When a driver is online or on an active delivery, location may be collected in the background (while the app is closed or not in the foreground) so dispatch and trip heartbeats continue.

Photos and files: profile photo, verification document images, and proof-of-delivery or exception photos captured or selected in the app.

Device, app, and diagnostics data: device/app version information, push notification tokens, IP addresses, API request logs, crash/error diagnostics, and security signals needed to run and secure the service.

Authentication data: phone OTP verification (including Firebase Authentication for phone sign-in on production driver login, except limited review/test paths), session tokens, and refresh tokens stored securely on device.

Communications: messages you send via contact forms, email, WhatsApp, in-app support paths, or other channels when you interact with Drop.

Website usage: essential cookies or similar technologies for site operation, session continuity, security, and limited analytics/performance where enabled.

INTERNET / NETWORK_STATE — communicate with Drop’s API, maps, and authentication services over encrypted HTTPS in production.

ACCESS_COARSE_LOCATION and ACCESS_FINE_LOCATION — show the driver on the map, match nearby jobs, support navigation handoff, and validate geofenced trip actions while the app is in use.

ACCESS_BACKGROUND_LOCATION — continue dispatch heartbeats and active-trip location updates when the driver is online or completing a delivery and the app is in the background. Drop shows an in-app explanation before the system permission dialog. Location is not used for advertising.

FOREGROUND_SERVICE and FOREGROUND_SERVICE_LOCATION — run a user-visible ongoing notification (“Drop Driver live location”) while background location tracking is active so the driver can see and control the service.

CAMERA — capture verification documents, profile photos, and proof-of-delivery / exception photos. Camera access is requested in context when the driver chooses to take a photo.

POST_NOTIFICATIONS — alert drivers to new assignments, trip updates, and operational notices. Drivers can control notification permission in system settings.

WAKE_LOCK — keep location/dispatch updates reliable during active online or trip sessions when combined with the foreground location service.

We do not request SMS inbox, call log, contacts book bulk access, microphone recording, all-files storage, VPN, accessibility service, or package-inventory scanning permissions for Drop Driver.

Provide, operate, secure, and improve Drop’s delivery platform and related services.

Onboard and verify merchants, drivers, partners, fleets, and operational users.

Authenticate users, issue and rotate session tokens, enforce account security, and prevent fraud or abuse.

Create, price (where applicable), route, track, reconcile, and support deliveries.

Dispatch work to available drivers using operational location and status signals.

Process driver earnings visibility and payout requests.

Send transactional communications: OTPs, assignment alerts, security notices, onboarding steps, and support responses.

Comply with legal, regulatory, audit, dispute, tax, and enforcement requirements.

Diagnose outages, improve reliability, and investigate security incidents.

Drop Driver collects and transmits device location to enable live dispatch, assignment matching, map awareness for operations, navigation support, geofenced pickup/delivery confirmation, safety review, and fraud prevention.

While you are online for work or completing an active delivery, Drop Driver may collect location even when the app is closed or not in use, so job offers and trip heartbeats continue. A persistent notification is shown when background location tracking is running.

You can go offline in the app to stop work-mode location heartbeats. You can also revoke location permission in Android settings at any time; core dispatch features that require location will not work without it.

Location is shared with Drop’s backend systems and authorised operational staff as needed to run the network. Relevant location/trip state may be visible to merchants, senders, or recipients only to the extent reasonably necessary for a live delivery (for example tracking progress), not for unrelated marketing.

Before Drop requests “Allow all the time” (background) location on Android, the app presents an in-app disclosure explaining this use. Declining background location may limit online dispatch reliability; while-in-use location may still support map and in-trip features depending on device settings.

Service providers and infrastructure vendors who host, store, monitor, message, map, authenticate, or support the platform (for example cloud hosting, object storage for documents/photos, email/SMS/push providers, maps, and phone authentication). These providers process data on our instructions and under contractual/security safeguards appropriate to the service.

Firebase (Google) for phone authentication and push messaging used by Drop Driver.

Google Maps / Google location and mapping services used to display maps and support routing-related features.

Between Drop products and operational teams as needed to fulfil deliveries, support users, investigate incidents, or manage accounts.

With merchants, drivers, partners, or recipients only as reasonably necessary to fulfil a delivery or support a platform workflow (for example driver first name and vehicle for a live order, or tracking status for a recipient).

With regulators, courts, law enforcement, or professional advisers where disclosure is required or reasonably necessary under law.

In connection with a restructuring, acquisition, financing, or sale of all or part of our business, subject to lawful handling of personal information.

We do not sell personal and sensitive user data, and we do not share it with third parties for their own advertising.

Firebase Authentication — phone number sign-in and related auth security.

Firebase Cloud Messaging — push notifications for assignments and operational alerts.

Google Maps SDK for Android — map display and related location presentation.

Geolocator / Android location APIs — device location for dispatch and trip workflows.

Image/file pickers — user-selected photos and documents for verification and proof of delivery.

Secure local storage and preferences — session tokens and app settings on device.

Drop remains responsible for ensuring third-party code used in the app is configured consistently with this policy and Google Play requirements. SDKs are limited to the purposes described above.

The public website may use cookies or similar technologies for essential site operation, session continuity, security, and limited performance/analytics purposes.

Where non-essential technologies are introduced later, Drop will implement appropriate notice and consent handling before relying on them where required by law.

Production API traffic uses HTTPS/TLS.

Access tokens and refresh tokens for drivers are stored using platform secure storage mechanisms on device where available.

Verification documents and proof media are stored in controlled object storage with access controls and time-limited download patterns for operational review.

Role-based access controls, logging, and operational security practices are used to limit internal access to personal information.

No method of transmission or storage is completely secure. Please protect your device, SIM, and OTP codes.

We retain personal information only for as long as reasonably necessary for platform operation, support, audit, dispute management, legal compliance, fraud prevention, payout reconciliation, and legitimate business record-keeping.

Delivery, verification, and financial records may be retained longer than active account access where required for legal, tax, safety, or fraud-prevention reasons. When retained, use is limited to those purposes.

Session tokens, temporary OTPs, and push tokens are retained only for operational lifetime or until replaced/revoked.

Drivers, merchants, and senders can request deletion of their Drop account and associated personal data.

External web resource (required for Google Play): https://dropsa.co.za/account-deletion — use this page to start a deletion request without needing the app.

Drop Driver also links to privacy and account-deletion information inside the app (Account tab and sign-in screen).

Portal users (merchant/sender) may also initiate account deletion from signed-in portal settings where that control is available.

When we action an account deletion request, we delete or irreversibly de-identify personal data associated with the account, except data we must retain for legitimate reasons such as security, fraud prevention, legal claims, tax, or regulatory compliance. Freezing an account is not treated as deletion.

You may also withdraw optional consents (for example notifications or background location) via device settings, go offline in the driver app, or contact hello@dropsa.co.za.

Subject to applicable law, you may request access to personal information we hold about you, request correction of inaccurate information, object to certain processing, or request deletion where retention is no longer justified.

Where we rely on consent for a specific processing activity, you may withdraw that consent prospectively, subject to legal and operational limitations (for example, we may still process data needed to complete an in-flight delivery or meet a legal obligation).

Identity verification may be required before we act on a request.

Drop primarily serves users in South Africa. Infrastructure or service providers (for example cloud, maps, authentication, messaging) may process data in other countries. Where that occurs, we take steps designed to provide appropriate protection consistent with this policy and applicable law.

Drop’s services, including Drop Driver, are intended for adults and business operators. We do not knowingly collect personal information from children for the Drop Driver app. If you believe a child has provided personal information, contact hello@dropsa.co.za so we can take appropriate action.

Data collected by Drop Driver may include: personal info (name, email, phone), financial info (payout banking details), location (approximate and precise, including background while online/on trip), photos and videos (camera/gallery for verification and proof of delivery), app activity and diagnostics, device and app identifiers used for sessions and push delivery, and other in-app messages/support content.

Data is used for app functionality, account management, fraud prevention, security, analytics/diagnostics for service reliability, and developer communications about the service — not for personalised advertising.

Data is encrypted in transit. Certain data is shared with service providers as described in this policy (service providers, not sold).

Users can request account deletion as described above. Keep the Play Console Data safety form consistent with this policy whenever app behaviour changes.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes affecting the Drop Driver app will be reflected on this page and, where required, through in-app or store-listing notices.

If you have a privacy concern, contact Drop first at hello@dropsa.co.za so we can investigate.

You may also lodge a complaint with the Information Regulator (South Africa), the independent body established under POPIA. Contact details and complaint channels are published on the Information Regulator’s official website.

Developer / operator named for Drop Driver on Google Play and in this policy: Drop South Africa (Drop).

Privacy questions, general support and commercial contact: hello@dropsa.co.za

Privacy policy URL: https://dropsa.co.za/privacy

Account deletion URL: https://dropsa.co.za/account-deletion

Website: https://dropsa.co.za