BodaSwift · Last updated: 17 July 2026
This policy explains how BodaSwift ("Bodaswift", "we") collects, uses, shares, and protects personal data through the Bodaswift Courier Android application and related services. Bodaswift is a courier and delivery logistics service operating in Kenya. This policy is written to comply with the Kenya Data Protection Act, 2019 and Google Play's User Data policy.
| Category | Data | Why we collect it |
|---|---|---|
| Identity | Name, courier ID, national ID number | Account management, courier verification (KYC), delivery assignment |
| Contact | Email address | Login (one-time code sent by email), account communications |
| KYC documents | National ID, rider licence, certificate of good conduct, bike photo (images or PDFs) | Verifying couriers before they can carry deliveries, as required for a delivery workforce |
| Work details | County, operating area, bike registration and model | Delivery assignment and operations |
| Delivery activity | Delivery history, earnings, proof-of-delivery photos and recipient codes | Service operation, payouts, dispute resolution, fraud prevention |
The app requests no device permissions: it does not collect device location, contacts, or identifiers, and it contains no advertising, analytics, or crash-reporting SDKs. If a future version adds location-based dispatch, we will update this policy and the in-app disclosures before it launches.
We use personal data to operate the courier service: verifying courier identity at signup and login, assigning deliveries, recording proof of delivery, calculating earnings and processing payouts through M-Pesa, communicating about deliveries, preventing fraud, and improving reliability of the service. We do not sell personal data, and we do not use it for third-party advertising.
We share data only with service providers needed to run the service: Safaricom M-Pesa (courier payout processing), our email delivery provider (one-time login codes), and cloud hosting providers that process data on our behalf. Delivery customers see the assigned courier's first name and delivery code during their delivery only. We may disclose data where required by Kenyan law or a valid legal request.
All data is encrypted in transit using TLS. Access to personal data within Bodaswift is restricted to staff who need it to operate the service.
Account data is retained while an account is active. Delivery and transaction records are retained for up to seven (7) years to meet tax and legal obligations, after which they are deleted or anonymised. KYC documents are deleted when an account is deleted.
You can request deletion of your account and associated personal data at any time:
· In the app: tap your name on the dashboard → Delete account
· Or via our web form: bodaswift.com/delete-account
· Or by emailing privacy@bodaswift.com
Upon a verified request we delete personal data within 30 days, except records we are legally required to keep (e.g. financial transaction records), which are retained only for the mandated period.
Under the Kenya Data Protection Act you have the right to access, correct, delete, or object to the processing of your personal data, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). Contact us at the address below to exercise these rights.
The Bodaswift Courier app is intended for adults aged 18 and over. We do not knowingly collect data from children.
We will post any changes to this policy on this page and update the date above. Material changes will be notified in the app.
BodaSwift, Nairobi, Kenya
Email: privacy@bodaswift.com