Privacy Policy for Couriers

The owner of your personal data is the business that runs the venue “Полігон” and with which you have concluded a contract to work as a courier (an employment or civil-law contract), hereinafter: the venue. Its details are given in section 9.

This policy covers only your work as a courier: your account, shifts, deliveries, location, payments and messages with guests. How the venue processes guests’ data is described in a separate document:

Privacy Policy

Depending on what you use in the app, the following data is processed:

• Account: first name (and last name, if the administrator entered it), phone number, password, app language, the venue’s locations where you may open a shift, and whether the account is active; if the venue keeps them in the system, also your pay rate, its type and your hire date. The account is created by the venue’s administrator: you cannot register in the app yourself. The server stores the password only as a hash, so nobody can read it, including the venue’s staff.
• Shifts: the location, the start and end time of the shift and the time of the app’s last signal. While a shift is open, the app tells the server once a minute that it is online; if there is no signal for 10 minutes, the server closes the shift itself.
• Work with orders: which orders you took, when you changed their status and, if you marked an order “Not delivered”, the reason and your comment. If a guest rated the delivery in a review, the rating is linked to the order you delivered.
• Location during a delivery: precise GPS coordinates, heading and speed (section 3).
• Payments: cash you received from guests, cash handed in to the venue (date, amount, orders), tips on your orders and their payouts, salary payments if the venue records them in the system.
• Messages with the guest in the order chat.
• Technical data: the phone identifier for push notifications and, if the app crashed, a crash report (section 5).

The app does not use the phone’s camera, microphone, contacts or photos.

The app starts sending your position when you tap “On the way” and stops when you have no order on the way left: you marked the last one “Delivered” or “Not delivered”, a manager passed it to another courier, or the order was cancelled. While you are moving, it sends precise GPS coordinates, heading and speed to the server every few seconds. An open shift on its own does not send your position.

The app learns from the server right away that an order was taken off you or cancelled, and if there is no connection, as soon as it is back; until then it may send a few more points. The server shows your position to a guest only for an order that is on the way now and assigned to you, so such points do not reach the guest’s map: they are saved as your last known position and in the route log without a link to the order (section 6).

So that your position is also sent while the screen is locked or a navigation app is open, the app asks for background location access. On Android it first explains this on a separate screen, and background access is turned on only with the “Turn on” button; while your position is sent in the background, a notification from the app about the delivery is visible in the notification shade. On iPhone the system asks for the permission, and while your position is sent in the background, the iPhone shows its location indicator.

If you do not allow background access, the app keeps working and sends your position only while it is open on the screen. Without location permission you can still complete the delivery, but the guest will not see you on the map. You can change the permission at any time in the phone settings.

While an order is on the way, the app sends your current position and the delivery point to the venue’s server every 45 seconds to show the distance and time to the guest on the order card. The “Route” and “Navigate” buttons open Google Maps with the guest’s address; the app does not pass your position there, and Google then runs the navigation under its own rules.

• Performance of the contract with you (Art. 11(1)(3) of the Law of Ukraine No. 2297-VI; Art. 6(1)(b) GDPR): account and sign-in, shifts, deliveries, location during a delivery (so that the guest can see you on the map and the venue can follow the delivery), the chat with the guest, cash payments, tips and payouts.
• Compliance with the venue’s legal obligations (Art. 11(1)(5) of the Law of Ukraine No. 2297-VI; Art. 6(1)(c) GDPR): records of cash, payouts and tips, accounting and tax records.
• The venue’s legitimate interest (Art. 11(1)(6) of the Law of Ukraine No. 2297-VI; Art. 6(1)(f) GDPR): protecting accounts against sign-in by others, investigating app crashes, the couriers map with the last known position, the route history for handling complaints and disputes about deliveries, couriers’ performance figures.

Your data is seen and received by:

• The guest of the order you are delivering: your first name and phone number while the order is being prepared and on the way, so that they can contact you; while the order is on the way, also your position on the map and the arrival time. After “Delivered”, a cancellation or “Not delivered”, the guest no longer sees your name, phone number or position on the order page. Messages in the order chat are seen by this guest.
• The venue’s staff, each within their role: the owner and managers see your account, shifts, orders, your movement during deliveries, the route history, the last known position on the couriers map, performance figures, payments and the messages in order chats; waiters of the location a delivery leaves from see your movement during the delivery and the messages in the chats of its orders; the accountant sees shifts and payments, without location.
• The processor Complete solution s. r. o. (Slovakia, IČO 56 693 371), which processes the data under a contract with the data owner: it hosts and maintains the courier app, the website, the admin panel and the till.
• Hosting and infrastructure providers whose servers store the data or carry it: Railway Corp. (USA), for the back end and the PostgreSQL database, scheduled jobs, the nightly backup and the weekly check that it can be restored; Vercel Inc. (USA), for the admin panel where the staff see your data, and the website; Cloudflare, Inc. (USA), for the proxy and DNS through which the connection to the server passes, and Cloudflare R2 storage for encrypted database backups. Transfers outside Ukraine are made to states with adequate protection (Art. 29(3) of Law No. 2297-VI) and otherwise under contractual safeguards provided by the data owner (Art. 29(4)(5)).
• The Expo service (USA): delivering push notifications about new and removed orders and about guest messages (the phone identifier for notifications and the notification text), and downloading app updates (the update server receives the technical data of the request, including the IP address).
• The error monitoring service Sentry, if connected: technical data about crashes of the app and the server and about some requests to the server (phone model and system, app version, error text and stack, request address), and the internal identifier of your account, without your name or phone number. Passwords, tokens, phone numbers, coordinates and request bodies are stripped before sending.
• Telegram: if the guest uses the venue’s Telegram bot, your messages in the order chat reach them through Telegram; a “Not delivered” mark with the reason, your comment and the internal identifier of your account may be sent to the platform’s technical support chat in Telegram.
• Anthropic PBC (USA), provider of the Claude language model, if the venue has connected the AI assistant in the admin panel: when the owner asks about the couriers’ work, the model receives your first name (without your last name or phone number) and figures for the period: number of deliveries, their total, average delivery time and tips. Transfers outside Ukraine are made to states with adequate protection (Art. 29(3) of Law No. 2297-VI) and otherwise under contractual safeguards provided by the data owner (Art. 29(4)(5)).
• A map routing service, if the venue has connected one: your position and the delivery point, to calculate the arrival time.
• Services the venue has itself connected to its system through the open API (till, accounting, CRM), if the venue has given them access to orders: your first name in the data of the order you are delivering.
• Google, only when you open the route with the “Route” or “Navigate” button: Google Maps receives the guest’s address and then processes data under its own rules.
• Public authorities, only on the basis of lawful requests.

The venue does not sell your personal data.

Retention periods:

• The route log (a point every 30 seconds while the app sends your position): 30 days, after which the points are deleted by the daily database clean-up job.
• The last known position (coordinates and time): kept in your courier profile with no time limit. It is replaced by the position of your next delivery; neither ending a shift, nor signing out of the app, nor deactivating the account deletes it at present.
• The account and profile (name, phone, language, locations, pay terms): with no time limit, until the venue deletes the account. Deactivating the account does not delete the data. The account can be deleted completely only if it has no shifts, cash hand-ins, payouts or tips; otherwise it stays deactivated, because the venue keeps these records for its accounts.
• Shifts, cash hand-ins, tips and payouts: with no time limit, as the venue’s accounting records.
• Messages in the order chat: 12 months, or less if the guest of that order asks to delete their data.
• The action log (for example, a “Not delivered” mark with your comment): after 3 years, the data on who acted and the details are removed from the entry; the entry itself remains.
• Service statistics (when orders were taken away from you and why an order was not delivered) with your account identifier: with no time limit.
• The push notification identifier: until you sign out of the account on the phone; deactivating the account does not delete it.
• On the phone, your sign-in data and profile are kept in the system’s secure storage and are deleted when you sign out; the chosen language remains.

Encrypted database backups keep the data for up to 30 more days (daily backups) and up to 12 more months (monthly backups), until the backup is deleted; backups are needed only to restore the database after a failure.

The app connects to the server only over an encrypted connection (HTTPS and a secure WebSocket). The server stores the password only as a hash, and your sign-in data on the phone is kept in the system’s secure storage. The staff see your data only within their role and the venue’s locations. Signing out deletes your sign-in data from the phone and, if the phone is online, ends the session on the server. To end all sessions, including one you signed out of without a connection, ask the administrator to change your password.

In accordance with Art. 8 of the Law of Ukraine “On Personal Data Protection”, you have the right to know which of your data is processed, where it comes from, where it is kept and to whom it is transferred; to access it; to demand that inaccurate data be corrected and that data processed unlawfully or no longer needed be deleted; to object to the processing; and to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

The venue’s administrator can correct your name or phone number, change your password or deactivate your account. You change the language yourself in the app, and location access in the phone settings.

Send any request about your data to the venue at hello@poligon.vitrina.cafe or through the other contacts in section 9. Records the venue is required by law to keep (records of cash, payouts and tips) are not deleted on request.

For questions about the processing of your personal data, contact:

The venue publishes each new version of the policy on this page; the date of the last update is shown at the top.