Location Tracking Policy

1. In short

• Customers: we use your device location only if you press the "use my location" button when entering a pickup address. It isn't stored on its own.
• Couriers: accepting a job shares nothing. Your position is shared only from the moment you press Start order (when you set off for the pickup), while the app is open, roughly every 10 seconds until the job ends. You agree to this at sign-up.
• We keep one latest position per job, not a trail of where you've been, and clear it when the job ends.
• The customer sees the courier's dot on a map, and the road route to the pickup, once the courier has pressed Start order and until the parcel is delivered. The recipient can see it only once the parcel has been collected, and only through a limited link.

2. Customers: "use my location"

The button on the pickup address box uses your browser's Geolocation feature. It runs only when you press it, and your browser asks for permission first. Your coordinates are sent to our server, which asks OpenStreetMap's Nominatim service to turn them into an address (this is called reverse geocoding). The coordinates are not stored on their own. If you then pick that address for a job, its coordinates are saved as the job's pickup point like any other address.

If you don't press the button, or refuse permission, nothing is sent. You can always type the address instead.

3. Couriers: sharing your position on a job

Consent

Couriers must agree to location sharing when signing up. We record the time you agreed. Without that agreement, our server refuses location updates. Your browser or phone also asks for permission, and you can refuse or switch it off in your device settings at any time. If you do, the customer will simply see no live dot for your job.

When it happens

• It starts when you press Start order, not when you accept a job, and stops when the job is delivered, cancelled or handed back.
• While the app is open on your device, it sends your position about every 10 seconds.
• It doesn't track you when you aren't on a job.

Keep the app open

Sharing works only while the app is open and your device is awake. If the phone locks or you close the browser, updates stop and the customer's map won't move. Please keep the app open during a job.

What we store

One position per job (latitude, longitude and the time). Each update overwrites the last one, so there is no history of your route. It is cleared when the job is delivered, cancelled or handed back.

4. Who can see what

Couriers never see the customer's tracking link.

5. The recipient tracking link

A customer can copy a link for each job and share it with the person receiving the parcel. It looks like https://vendaru.com/track.html#… followed by a 24-character secret.

What anyone with the link can see

• The job's status and when each step happened.
• The drop-off area (the town or postcode district) and a map pin rounded to about 100 metres.
• Only once the parcel has been collected: the courier's first name, their rounded live position on the map, and the distance remaining.

What it never shows

The pickup address, prices, photos, chat, anyone's name beyond the courier's first name, or contact details.

How the link is protected

• The secret sits after the # in the address. Browsers don't send that part to servers, so it isn't in our logs and isn't passed on to other sites in a Referer header.
• The page is hidden from search engines, isn't cached and requests to it are rate-limited.
• The link stops working 24 hours after the job is delivered or cancelled.
• Anyone you give the link to can use it, so share it only with the person receiving the parcel.

6. Limits you should know about

• Positions come from the courier's device and can be inaccurate or delayed. The tracking map is a guide, not a guarantee of arrival time.
• If updates stop, the tracking page says the signal has been lost and shows when the courier was last seen.
• Map pictures come from OpenStreetMap, whose servers see your IP address and the area you are viewing. See the Privacy Policy.

7. Why, and your rights

We use courier location so customers can follow their delivery and so we can deal with problems. Our lawful basis for a courier's location is consent, and for a customer pressing "use my location" it is also consent. [SOLICITOR TO CONFIRM: lawful basis for courier location, and whether consent is the right basis given the working relationship] You can withdraw consent, but then a courier can't work jobs that need live tracking. Your other rights, and how to use them, are in the Privacy Policy.

Courier location is treated with extra care. We plan to carry out a data protection impact assessment. [OWNER TO CONFIRM: DPIA completed and date]