Privacy Policy

Mboago is operated by Hooyia Co. Ltd, the company responsible for the personal data described below — the data controller in the sense of applicable data-protection law.

We are reachable at any time through the support conversation inside the app, or from the contact details published on our website.

We only collect what an order or an account genuinely needs:

• Account details: name, email address, phone number, country of residence, preferred language, optional profile photo, and the password or social login you chose.
• Order and delivery details: the products or packs ordered, the delivery address and locality, the recipient's name and phone number, and any neighbourhood, landmark or GPS point you add.
• Payment information: the method used (mobile money, bank card or PayPal), the amount, the currency and a transaction reference. We never receive your full card number or your mobile-money PIN.
• Delivery evidence: the photos, videos and notes a driver records when the order is collected and handed over.
• Messages: the conversations you exchange with the driver, with support, and any review or story you choose to publish.
• Technical data: device type, application version, push notification token, approximate location when you use tracking, and the security logs used to detect fraud.

Each processing activity rests on a precise purpose and a lawful basis:

• Deliver your order — performing our contract with you: preparing the order, assigning a driver, transmitting the recipient's name, address and phone number to that driver, and proving the hand-over.
• Take payment — performing our contract: processing the charge, issuing a refund and keeping the accounting records the law requires.
• Secure the platform — our legitimate interest: verifying your identity by one-time code, preventing fraudulent orders and payment abuse, and keeping audit trails.
• Keep you informed — your consent or our legitimate interest: notifications about the progress of an order, and service announcements about the platform itself.
• Improve the service — our legitimate interest: understanding which features are used, based on aggregated statistics rather than individual profiles.
• Meet our obligations — legal obligation: responding to a competent authority and complying with Cameroonian law, including Law No. 2010/012 of 21 December 2010 on cybersecurity and cybercrime.

We do not sell your personal data, and we do not use it for advertising published by third parties.

Payments are captured by specialised providers: Stripe for bank cards, Flutterwave for mobile money (MTN, Orange and their partners) and PayPal for PayPal accounts.

Those providers receive the payment details you enter and act as independent controllers for the data they must keep for their own regulatory duties. We receive only what we need to recognise your order: the outcome of the transaction, an identifier, the last digits of a card or the masked mobile-money number, the amount and the currency.

We never store a full card number, a CVV or a mobile-money PIN, on any system of ours.

Your data is shared only with the people and services that make a delivery possible:

• The assigned driver — the recipient's name, delivery address, locality, phone number and the order contents. Drivers see nothing about your payment method or your other orders.
• Payment providers — as described above.
• Our technical suppliers — hosting, email delivery, push notifications and error monitoring, all bound by confidentiality and used strictly on our instructions.
• Competent authorities — only on a lawful request, and limited to what is legally required.

Trade partners and other clients never see your data.

Data is hosted on servers located in the European Union and, where the features require it, processed in Cameroon by our teams and drivers. Where data leaves the country, we keep the transfers limited to what a delivery or a payment demands.

Retention periods are the shortest that make sense:

• Account: while the account is active, then deleted or anonymised after a deletion request.
• Orders and delivery evidence: kept long enough to handle a dispute, a warranty claim or an accounting control.
• Payment records: kept as long as tax and accounting law requires.
• One-time codes and security logs: a few minutes for the codes, and a limited period for the logs.
• Support conversations: kept for a reasonable period after the conversation closes, then archived or deleted.

Over the data that identifies you, you may at any time:

• ask for a copy of what we hold and get it in a readable format;
• have inaccurate information corrected, straight from your profile;
• have your account and its data erased — the deletion feature inside the app submits the request and confirms it by a code sent to your email;
• oppose or ask us to restrict a processing activity based on our legitimate interest;
• withdraw a consent you gave, for instance for service announcements, without it affecting the past;
• lodge a complaint with the competent authority if you consider our answer insufficient.

Write to us through the support conversation and we will answer within the legal deadline. Some data can be kept after a deletion request where the law obliges us to (accounting records, an ongoing dispute).

Traffic between your device and Mboago is encrypted, passwords are stored as irreversible hashes, one-time codes are hashed too, and access to production data is limited to the staff who need it, behind authenticated accounts.

Accounts that are no longer used are deactivated rather than left exposed, and a deleted account is anonymised so the historical order records no longer identify anyone. If a breach ever puts you at risk, we will inform you and the competent authority as the law requires.

Push notifications are sent only if you allow them on your device, and you can turn them off at any time in your phone settings. The website uses a small number of cookies: the ones that keep you signed in, protect forms against forgery, remember your language, and measure anonymous traffic.

The full list, their purpose and how to refuse them are in our cookie policy, available in the footer of every page.

When this policy changes in a way that affects you, the new version is published on this page with its date, and we notify you in the app when the change is significant.

For any question about your personal data, or to exercise a right described above, contact us from the support conversation or using the contact details published on our website.