Privacy policy

1. Who is responsible for your data?

Data controller: YADONY SAS, a simplified joint-stock company whose registration is in progress.

Data Protection Officer (DPO): dpo@yadony.com. General contact: contact@yadony.com.

If you have a question about your data or wish to exercise your rights, contact us directly. We undertake to reply within a reasonable time.

2. Our core principle: as little data as possible

Yadony stores internally only the information needed for your user profile. All sensitive data — identity, authentication, official documents, images — is processed and stored directly by specialised partners. Yadony never sees your identity documents, your face, or your bank details.

What Yadony keeps directly

The only data stored in our own systems is your public profile information:

• First and last name — displaying your identity on your profile and in transactions
• E-mail address — identifying you and sending you transaction summaries
• Date of birth — verifying that you are an adult (18 minimum)
• City of residence — making it easier to match you with travellers near you

That is all. Yadony stores no other personal data internally. The rest is handled by our specialised partners, described below.

3. Our partners and the data they handle for us

We chose to entrust each type of sensitive data to the world specialist in that field. Here is exactly who handles what.

3.1 Google Firebase — Authentication and account security

The entire authentication layer is handled by Google Firebase, one of the most secure infrastructures in the world. Firebase handles:

• Your mobile phone number
• Your SMS sign-in (one-time code)
• Your fingerprint and Face ID sign-in
• Your session security (suspicious sign-in detection, lockout after failed attempts)
• Your backup PIN code

Yadony never sees your full phone number or your biometric data. Firebase manages this information directly, in line with its own privacy policy and Google's security certifications (ISO 27001, SOC 2, GDPR). Google Firebase privacy policy: https://firebase.google.com/support/privacy

3.2 Stripe Identity — Identity verification (KYC)

Identity verification — required to use Yadony — is fully handled by Stripe Identity, the document-verification service of the world leader in online payments. Stripe Identity handles:

• The photo of your identity document (national ID card or passport)
• The selfie with liveness detection
• The comparison between your face and your official document
• The approval or rejection of the verification

Yadony never sees your identity documents or your face. Stripe Identity sends us only the result of the verification: Verified, Pending or Rejected. Documents and biometric data stay with Stripe and are subject to its retention policy. Stripe Identity privacy policy: https://stripe.com/fr/privacy

3.3 Stripe — Payments and escrow

All payments, the escrow mechanism (money held until delivery) and payouts to travellers are handled exclusively by Stripe. Stripe handles:

• Your bank card details (Visa, Mastercard)
• Apple Pay and Google Pay payments
• Holding funds in escrow until delivery is confirmed
• Payouts to travellers after delivery
• Refunds in the event of cancellation or dispute

Yadony never stores your card number or any payment data. Stripe is PCI DSS Level 1 certified, the highest security certification for online payments. Stripe privacy policy: https://stripe.com/fr/privacy

3.4 Wave and Orange Money — Mobile Money

For Mobile Money payments and payouts (mainly for users and travellers based in Africa), we rely on Wave and Orange Money. These providers manage your Mobile Money account details directly. Yadony does not store this information.

3.5 Cloudflare — Image storage

All parcel-related images — photos taken by the sender, handover and delivery photos taken by the traveller — are stored on Cloudflare infrastructure. Cloudflare handles:

• Secure storage of parcel photos
• Timestamped, geolocated handover and delivery photos
• Generation of temporary, secure access links — images are never permanently publicly accessible

Yadony does not host these images on its own servers. Cloudflare is one of the world leaders in web security and performance, certified ISO 27001 and SOC 2. Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

4. Data generated by your use of the service

Beyond profile data and the data handled by our partners, Yadony generates and keeps the following data, essential to running the service:

• History of listings and trips — managing traveller activity and producing tax exports (Yadony PRO) — 5 years
• Transaction history (amounts, dates, statuses) — financial traceability and statutory accounting obligations — 5 years (legal obligation)
• Parcel scans (timestamp and geolocation) — parcel traceability at every step and evidence in disputes — 5 years
• Ratings and reviews received — building user reputation and guaranteeing quality — lifetime of the account
• Messages exchanged in the internal messaging system — enabling communication between senders and travellers — 2 years after the transaction
• Connection data (date, device — anonymised) — account security and fraud detection — 13 months

Browsing and app-usage data is collected in anonymised form only, and only with your explicit consent gathered at your first sign-in.

5. Summary: who stores what?

Here is a complete summary to give you a clear picture of how your data is protected.

• Name, e-mail, date of birth, city — Yadony (internal database) — Yadony access: yes, profile data only
• Phone number, SMS authentication — Google Firebase — Yadony access: no, Firebase manages it directly
• Fingerprint, Face ID, PIN code — Google Firebase — Yadony access: no, biometric data stays on-device or with Firebase
• ID document photo, selfie, liveness — Stripe Identity — Yadony access: no, Yadony receives only the Verified / Rejected status
• Card number, payment data — Stripe — Yadony access: no, never sent to Yadony
• Mobile Money details — Wave / Orange Money — Yadony access: no, managed directly by those services
• Parcel and delivery photos — Cloudflare — access only through secure temporary links
• Transaction history, scans, ratings — Yadony (internal database) — access: yes, needed to run the service
• Messages between users — Yadony (encrypted) — encrypted content, access restricted to disputes

6. The legal basis for each processing operation

Each processing operation rests on a specific legal basis:

• Profile data (name, e-mail, date of birth, city) — performance of the contract (Terms of Use)
• Authentication via Google Firebase — performance of the contract
• Identity verification via Stripe Identity — legal obligation (anti-money-laundering and fraud prevention)
• Payment processing and escrow via Stripe — performance of the contract
• Image storage via Cloudflare — performance of the contract and legitimate interest (evidence in disputes)
• Transaction history — legal obligation (accounting and tax)
• Parcel scans and traceability — performance of the contract and legitimate interest
• Fraud detection and security — legitimate interest
• Ratings and reputation — legitimate interest
• Marketing communications — consent (revocable at any time)

7. Who do we share your data with?

Yadony never sells your data to third parties. The only data sharing that takes place is described in sections 3 and 4 above, with our technical partners contractually committed to protecting it.

Other sharing cases

Beyond those partners:

• Between users: your first name, profile photo, rating and badge are visible to other users as part of the normal service.
• With the authorities: where the law requires it (judicial requisition, tax obligation, anti-money-laundering), we must disclose certain data to the competent authorities.
• In a dispute: the relevant evidence (scans, link to the Cloudflare photos, messages) may be shared between the parties involved.
• Business transfer: in the event of a merger or acquisition, your data could be transferred to the acquirer. You would be informed beforehand.

8. International data transfers

Yadony operates on international corridors and relies on global partners. Here is how your data is protected in each region.

From Europe

The data Yadony keeps directly is hosted on servers located in the European Union. Our partners (Google Firebase, Stripe, Cloudflare) all have GDPR-compliant transfer mechanisms (standard contractual clauses, adequacy decisions or EU-US Data Privacy Framework certifications).

From the United States and Canada

For users based in the United States and Canada, we comply with applicable local laws, including the California Consumer Privacy Act (CCPA) for Californian users. Yadony does not sell your data. You can exercise your rights by contacting us at dpo@yadony.com.

From Africa

For users based in Côte d'Ivoire, Senegal, Mali, Cameroon and the other countries served, we comply with the applicable local personal-data protection laws. Parcel images and documents are always stored on Cloudflare (European servers), with temporary, secure access links.

9. How long do we keep your data?

Retention periods by type of data:

• Profile data (name, e-mail, date of birth, city) — for as long as you use the service plus 3 years after your last sign-in — account management
• Authentication data (Firebase) — managed by Google Firebase under its own policy
• KYC data (Stripe Identity) — managed by Stripe under its own policy
• Payment data (Stripe) — managed by Stripe under its own policy
• Parcel images (Cloudflare) — 5 years, temporary links — evidence in disputes
• Transaction history — 5 years — accounting and tax obligation
• Scans and geolocation — 5 years — evidence in disputes
• Messages in the messaging system — 2 years after the transaction — dispute resolution
• Anonymised browsing data — 13 months — CNIL compliance
• Deleted accounts — profile data anonymised immediately, except financial history kept for 5 years

10. How we protect your data

Security by design

Yadony's main security mechanism is architectural: by keeping only the minimum of data internally and entrusting sensitive data to certified global specialists, we drastically reduce the exposure surface if something goes wrong.

• Google Firebase: certified ISO 27001, SOC 1, SOC 2, SOC 3, PCI DSS. Authentication data encrypted and isolated.
• Stripe Identity: PCI DSS Level 1 certified. Identity documents encrypted, never exposed to Yadony.
• Cloudflare: certified ISO 27001, SOC 2. Images accessible only through secure temporary links.
• Yadony: profile data encrypted at rest and in transit (HTTPS/TLS). Internal access limited to the strict minimum.

Additional safeguards

Safeguards complete this architecture:

• Every sensitive action (payment release, dispute decision, account suspension) is recorded in a tamper-proof audit log.
• Biometric validation (fingerprint or Face ID via Firebase) is required to access the application and confirm any payment.
• The internal messaging system automatically filters attempts to share contact details to bypass the platform.
• In the event of a data breach, we notify the CNIL within 72 hours and the users concerned as soon as possible.

11. Your rights over your data

Your rights and how to exercise them:

• Right of access — obtain a copy of all the data Yadony holds about you — Settings → My data, or dpo@yadony.com
• Right of rectification — correct your profile data (name, e-mail, city) — directly in your profile in the application
• Right to erasure — delete your account and profile data — Settings → Delete my account
• Right to portability — receive your data in JSON or CSV format — dpo@yadony.com
• Right to object — object to processing based on legitimate interest — dpo@yadony.com
• Withdrawal of consent — turn off marketing or analytics — Settings → Privacy
• Rights over Firebase data — access, rectification, deletion of authentication data — through your Google account or dpo@yadony.com
• Rights over Stripe data — access to and deletion of payment and identity data — stripe.com/fr or dpo@yadony.com

For data handled by our partners (Firebase, Stripe, Cloudflare), we help you exercise your rights with them. Contact us at dpo@yadony.com and we will make the connection.

If you are not satisfied with the answer: CNIL (www.cnil.fr) in France, ARTCI in Côte d'Ivoire, CDP in Senegal, the National Commission for the Protection of Personal Data in Cameroon.

12. Cookies and trackers

Yadony uses only the cookies strictly necessary to run the application (session persistence, security). Audience-measurement cookies are enabled only with your explicit consent and the data collected is anonymised. You can manage your preferences from Settings → Privacy and data.

13. Notifications

Transactional notifications (mandatory): payment confirmation, delivery confirmed, dispute opened, security alerts. Sent through Firebase Cloud Messaging (in-app notifications) and by SMS through two different operators to guarantee continuity.

Marketing communications (optional): sent only with your consent. You can unsubscribe at any time from Settings → Notifications.

14. Children's data

Yadony is strictly reserved for adults (18 and over). We collect no data about minors. If you believe a minor has created an account, contact us at dpo@yadony.com. We will delete the account and all associated data as quickly as possible.

15. What happens when you delete your account

When you delete your account:

• Yadony profile data (first name, last name, e-mail, date of birth, city): anonymised immediately.
• Firebase data (phone, authentication): deleted on request through Firebase.
• Stripe Identity data (ID document, selfie): deleted under Stripe's retention policy.
• Parcel images (Cloudflare): the links become inaccessible. Files are deleted under Cloudflare's policy.
• Messages in the messaging system: deleted.
• Recipient address book: cleared.
• Transaction history: kept for 5 years — statutory accounting obligation. This data is anonymised as far as possible.
• If a dispute is in progress, the account is kept until the dispute is closed, then deleted.

16. Changes to this policy

We may change this policy at any time. Any significant change will be notified by e-mail or in-app notification at least 30 days before it takes effect. The update date is always shown at the top of the document.

17. Contacting us

For any question about this policy:

• DPO e-mail: dpo@yadony.com
• General e-mail: contact@yadony.com
• Postal address: 7 avenue Pablo Picasso, Appartement 375, 94120 Fontenay-sous-Bois, France

Legal information

• Company name: YADONY SAS (registration in progress)
• Publication director: Mr Dramane DIAKITE, President
• Certified technical partners: Google Firebase, Stripe, Stripe Identity, Wave, Orange Money, Cloudflare
• French supervisory authority: CNIL — www.cnil.fr