BodaSwift · Last updated: 12 November 2026
This policy explains how BodaSwift ("we"), operated by Bridgetree Technologies Limited, collects, uses, shares and protects personal data. BodaSwift is a delivery and errands service operating in Kenya. It is written to comply with the Kenya Data Protection Act, 2019 and Google Play's User Data policy. It has two parts: Part 1 for customers using bodaswift.com, and Part 2 for couriers using the BodaSwift Courier app. Our Terms of Service cover the customer service.
The chat assistant. The chat bubble on our pages is an AI assistant run by Bridgetree Technologies Limited, the company behind BodaSwift, using Anthropic's Claude model. We keep what you type in it, and any name, phone number or email you give it, so our team can follow up and to improve its answers. Your browser stores a random chat id so the conversation continues across pages; it contains no personal data. Ask in the chat, or email privacy@bodaswift.com, to have a chat deleted.
We use no advertising cookies. We run a first-party visit counter on our own site that records visits and contains no personal data.
To carry out and confirm your request, contact you about it, check your payment, prevent abuse of the request form, keep tax and accounting records, and understand which of our advertising works. We send you a confirmation email with your reference. We do not sell your data.
When a driver or rider is assigned to your request, they are shown your name, phone number, the pickup and drop-off locations and the details of the job, so they can do the work and reach you. You are sent their first name and phone number. Riders who are only being asked whether they are available see the type of job and its area, not your name, phone number, email address or full address. We also use service providers that process data on our behalf, such as email delivery and cloud hosting. We may disclose data where required by Kenyan law or a valid legal request.
Request records are kept for up to seven (7) years for tax and accounting purposes, after which they are deleted or anonymised.
Under the Kenya Data Protection Act you have the right to access, correct, delete, or object to the processing of your personal data, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). To use these rights, email privacy@bodaswift.com. You can ask for your request records to be deleted; we may need to keep records we are legally required to keep, such as financial records, for the required period.
Data is encrypted in transit using TLS, and access to personal data is restricted to staff who need it to run the service.
When you sign up to run errands at bodaswift.com/runners we collect your name, phone number, email address, your national ID number and a photo of the front of your ID, how you travel, the areas and days you can work, anything you tell us about your experience, and which website or campaign brought you to us. We use this to contact and verify you, to decide whether to approve you, and, once you are approved, to email you alerts about errands in your areas. Errand alerts describe the job and its area; they do not include the customer's name, phone number or email address. When you are assigned a job, the customer is sent your first name and phone number so they can reach you. You can pause alerts from any alert email, and you can ask us to delete your details at any time by emailing privacy@bodaswift.com. Your ID number and ID photo are used only to verify who you are. They are stored privately on our server, are seen only by the person verifying you, are never shared with customers or sent by email, and are deleted if your application is not approved or is still unverified after ninety (90) days. We keep the other details of riders we have not worked with for up to twelve (12) months.
| Category | Data | Why we collect it |
|---|---|---|
| Identity | Name, courier ID, national ID number | Account management, courier verification (KYC), delivery assignment |
| Contact | Email address | Login (one-time code sent by email), account communications |
| KYC documents | National ID, rider licence, certificate of good conduct, bike photo (images or PDFs) | Verifying couriers before they can carry deliveries, as required for a delivery workforce |
| Work details | County, operating area, bike registration and model | Delivery assignment and operations |
| Delivery activity | Delivery history, earnings, proof-of-delivery photos and recipient codes | Service operation, payouts, dispute resolution, fraud prevention |
The app requests no device permissions: it does not collect device location, contacts, or identifiers, and it contains no advertising, analytics, or crash-reporting SDKs. If a future version adds location-based dispatch, we will update this policy and the in-app disclosures before it launches.
We use personal data to operate the courier service: verifying courier identity at signup and login, assigning deliveries, recording proof of delivery, calculating earnings and processing payouts through M-Pesa, communicating about deliveries, preventing fraud, and improving reliability of the service. We do not sell personal data, and we do not use it for third-party advertising.
We share data only with service providers needed to run the service: Safaricom M-Pesa (courier payout processing), our email delivery provider (one-time login codes), and cloud hosting providers that process data on our behalf. Delivery customers see the assigned courier's first name and delivery code during their delivery only. We may disclose data where required by Kenyan law or a valid legal request.
All data is encrypted in transit using TLS. Access to personal data within BodaSwift is restricted to staff who need it to operate the service.
Account data is retained while an account is active. Delivery and transaction records are retained for up to seven (7) years to meet tax and legal obligations, after which they are deleted or anonymised. KYC documents are deleted when an account is deleted.
You can request deletion of your courier account and associated personal data at any time:
· In the app: tap your name on the dashboard → Delete account
· Or via our web form: bodaswift.com/delete-account
· Or by emailing privacy@bodaswift.com
Upon a verified request we delete personal data within 30 days, except records we are legally required to keep (e.g. financial transaction records), which are retained only for the mandated period.
Under the Kenya Data Protection Act you have the right to access, correct, delete, or object to the processing of your personal data, and to lodge a complaint with the Office of the Data Protection Commissioner (ODPC). Contact us at the address below to exercise these rights.
The BodaSwift Courier app is intended for adults aged 18 and over. We do not knowingly collect data from children.
We will post any changes to this policy on this page and update the date above. Material changes will be notified in the app.
BodaSwift, Nairobi, Kenya
Email: privacy@bodaswift.com