DYRECT PRIVACY POLICY

Effective Date: August 2026
Last Updated: August 2026

1. Introduction

Welcome to Dyrect.

Dyrect (“Dyrect”, “we”, “our”, or “us”) respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, disclose, store, protect, and otherwise process personal information when you access or use the Dyrect mobile application, website, APIs, customer support services, payment features, and related products or services collectively referred to as the “Platform.”

Dyrect is a community-powered delivery platform that connects people who need to send packages (“Senders”) with people who are already travelling in compatible directions and are willing to carry those packages (“Drop Stars”).

By accessing or using the Platform, you acknowledge that you have read and understood this Privacy Policy.

Where your consent is required by applicable law for a particular type of processing, Dyrect will request that consent before carrying out that processing.

2. Scope of this Privacy Policy

This Privacy Policy applies to personal information relating to:

Visitors to the Dyrect website;
Registered users;
Senders;
Drop Stars;
Package recipients;
Business users;
Users applying for identity or Drop Star verification;
Individuals contacting Dyrect customer support;
Individuals otherwise communicating or interacting with Dyrect.

This Privacy Policy does not apply to third-party websites, applications, platforms, or services that are not owned or controlled by Dyrect.

Third-party services are governed by their own privacy policies and terms.

3. Information We Collect

The information we collect depends on how you use the Platform.

3.1 Account and Personal Information

You may provide information including:

Full name;
Username or display name;
Phone number;
Email address;
Profile photograph;
Date of birth;
Residential or general address;
Delivery addresses;
Emergency contact details where applicable;
Business registration information;
Other account or profile information.

You are responsible for ensuring that information you provide is accurate and reasonably up to date.

3.2 Identity and Verification Information

Where identity verification or Know Your Customer (KYC) checks are required, Dyrect may collect:

Government-issued identification;
Passport;
National identification card;
Driver’s licence;
Identification numbers;
Selfie or facial verification images;
Proof of address;
Business registration documents;
Tax information where required;
Verification results or status.

Verification may be carried out directly by Dyrect or through authorised identity verification providers.

3.3 Delivery and Package Information

When you create, accept, carry, track, or complete a delivery, we may collect:

Pickup location;
Delivery destination;
Recipient details;
Sender details;
Package description;
Package category;
Package photographs;
Package size or weight where applicable;
Pickup and delivery instructions;
Delivery status;
Pickup and delivery timestamps;
Proof of pickup;
Proof of delivery;
Delivery history;
Cancellation information;
Reports, complaints, or incidents connected to a delivery.

Senders are responsible for ensuring that they have appropriate authority to provide recipient information to Dyrect.

3.4 Travel and Route Information

When using Dyrect as a Drop Star, we may collect information relating to your planned journey, including:

Starting location;
Destination;
Intended route;
Travel date;
Estimated departure time;
Estimated arrival time;
Availability;
Preferred pickup or delivery areas;
Transport method where relevant;
Package-carrying preferences or capacity.

We use this information to identify package opportunities that may reasonably fit your existing journey.

3.5 Payment and Transaction Information

Where payments or payouts are processed through Dyrect, we may collect or process:

Payment method;
Mobile money information;
Bank or payout details;
Transaction amount;
Transaction reference;
Payment status;
Delivery fees;
Refunds;
Drop Star earnings;
Payout information;
Transaction history.

Payments may be processed by authorised banks, mobile money operators, payment processors, or other financial service providers.

Dyrect generally does not store complete payment card credentials where those credentials are processed securely by third-party payment providers.

3.6 Communications and User Content

We may collect or retain:

In-app chat messages;
Delivery notes;
Customer support communications;
Complaints;
Dispute communications;
Ratings;
Reviews;
Feedback;
Reports submitted through the Platform.

We do not routinely monitor private communications, but authorised personnel may review relevant communications where reasonably necessary for fraud prevention, dispute resolution, safety, legal compliance, customer support, or enforcement of Platform rules.

4. Information Collected Automatically

When you use the Platform, we may automatically collect technical and usage information including:

Device model;
Device identifiers;
Operating system;
App version;
IP address;
Mobile network information;
Browser type;
Language settings;
Device time zone;
Login timestamps;
Session information;
Crash reports;
Performance diagnostics;
Referral information;
Feature usage;
Navigation patterns.

We use this information to operate, maintain, secure, analyse, and improve the Platform.

5. Location Data and Background Tracking

Because Dyrect relies on route compatibility and delivery tracking, location information is an important part of the Platform.

Depending on your permissions and how you use Dyrect, we may collect:

Precise GPS location;
Approximate location;
Pickup location;
Delivery destination;
Route information;
Travel information associated with an active delivery;
Location updates during active deliveries.

5.1 How Location Information Is Used

Location information may be used to:

Match Senders with suitable Drop Stars;
Identify package opportunities near a Drop Star’s route;
Calculate route compatibility;
Calculate pickup and destination distances;
Estimate detour distance or time;
Provide navigation and route recommendations;
Display live delivery tracking;
Estimate arrival times;
Verify pickup or delivery activity;
Detect unusual route activity;
Prevent fraud;
Resolve disputes;
Improve Platform safety.

5.2 Background Location

Where you grant the required device permissions and where necessary for Platform functionality, Dyrect may collect background location information during an active delivery or while using features that require continuous location updates.

Background location may be used to:

Provide live package tracking;
Update estimated arrival times;
Monitor delivery progress;
Detect significant route deviations;
Support safety investigations;
Investigate suspected fraud or delivery disputes.

You may disable background location through your device settings, although doing so may limit or prevent certain delivery or Drop Star features from functioning properly.

5.3 Location Accuracy

Location information depends on factors including your device, GPS signals, network availability, and third-party mapping services.

Dyrect does not guarantee that routes, location information, or estimated arrival times will always be accurate or uninterrupted.

6. How We Use Your Information

Dyrect processes personal information where it has a lawful basis and where processing is reasonably necessary to operate, secure, support, and improve the Platform.

We may use personal information to:

Create and manage accounts;
Authenticate users;
Verify phone numbers and email addresses;
Enable login and account recovery;
Verify identity;
Provide Sender and Drop Star functionality;
Match Senders with suitable Drop Stars;
Calculate route compatibility;
Display package opportunities;
Facilitate pickups and deliveries;
Provide live delivery tracking;
Process payments, refunds, earnings, and payouts;
Deliver customer support;
Resolve disputes;
Maintain ratings and reputation features;
Improve Platform functionality;
Analyse usage trends;
Improve matching systems;
Improve route recommendations;
Diagnose technical problems;
Prevent fraud;
Detect suspicious activity;
Protect user accounts;
Detect fake accounts;
Investigate abuse;
Maintain Platform security;
Comply with applicable laws;
Respond to lawful regulatory or law-enforcement requests;
Meet tax, accounting, and regulatory obligations;
Enforce our agreements and policies;
Send service, security, payment, and delivery communications;
Send marketing communications where permitted.

Dyrect may use aggregated or de-identified information for analytics, research, reporting, product development, and Platform improvement where that information no longer reasonably identifies an individual.

7. Legal Bases for Processing

Where required by applicable law, Dyrect processes personal information on one or more of the following legal bases:

Your consent;
Performance of a contract with you;
Compliance with legal obligations;
Protection of vital interests;
Dyrect’s legitimate business interests where those interests are not overridden by your rights and freedoms;
Any other lawful basis recognised under applicable law.

Where processing depends on consent, you may withdraw that consent at any time, subject to applicable legal or contractual limitations.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

8. How We Share Information

Dyrect does not sell personal information.

We may share personal information where reasonably necessary to operate the Platform, provide deliveries, comply with legal obligations, protect users, or as otherwise described in this Privacy Policy.

8.1 Between Senders and Drop Stars

When users are matched or connected through Dyrect, limited information may be shared as necessary to evaluate, coordinate, track, and complete a delivery.

Senders may receive information such as:

Drop Star first name or display name;
Profile photograph where applicable;
Verification status;
Rating or reputation information;
Relevant travel or availability information;
Delivery status;
Estimated arrival information;
Live location during an active delivery where applicable;
Contact information where reasonably necessary.

Drop Stars may receive information such as:

Sender name;
Pickup location;
Delivery destination;
Package details;
Delivery instructions;
Contact information reasonably necessary to complete the delivery;
Recipient information where required.

Dyrect aims to limit information sharing to what is reasonably necessary for the transaction.

8.2 With Recipients

Recipients may receive information necessary to coordinate or complete a delivery, including:

Delivery status;
Estimated arrival information;
Limited Drop Star information;
Verification requests such as delivery OTPs.

8.3 Service Providers

Dyrect may share information with trusted service providers that assist us in operating the Platform, including:

Cloud hosting providers;
Payment processors;
Mobile money providers;
Banking partners;
SMS providers;
Email providers;
Push notification providers;
Identity verification providers;
Mapping and navigation providers;
Customer support platforms;
Analytics providers;
Fraud detection providers;
Security providers.

These providers may process information only as necessary to provide their services or as otherwise permitted by applicable law.

8.4 Business Transfers

If Dyrect becomes involved in a merger, acquisition, financing, investment, restructuring, insolvency proceeding, sale of assets, or similar transaction, personal information may be transferred to an acquiring or successor entity where permitted by law.

Where required, users will be notified of material changes affecting the handling of their personal information.

9. Payments and Transactions

Payments relating to deliveries may be processed by third-party payment providers.

These providers may process information including:

Payment method;
Transaction amount;
Transaction reference;
Mobile money details;
Bank information;
Payout information;
Payment status.

Third-party payment providers process information according to their own privacy practices and applicable laws.

Dyrect may retain transaction records where reasonably necessary for:

Payment processing;
Reconciliation;
Refunds;
Payouts;
Accounting;
Tax compliance;
Fraud prevention;
Dispute resolution;
Regulatory compliance.

10. Identity Verification and KYC

Dyrect may require identity verification to promote trust, prevent fraud, and maintain Platform safety.

Verification information may include:

Government-issued identification;
Passport;
National identification card;
Driver’s licence;
Selfie verification;
Proof of address;
Business registration records;
Other information reasonably necessary to verify identity.

Verification may be performed by authorised third-party providers.

Dyrect retains verification records only for as long as reasonably necessary for legal, regulatory, security, fraud-prevention, and dispute-resolution purposes.

11. Communications

Dyrect may send communications relating to:

OTP verification;
Account activity;
Security alerts;
Package opportunities;
Route matches;
Pickup updates;
Delivery updates;
Payment confirmations;
Earnings and payouts;
Customer support;
Policy changes;
Platform updates;
Service announcements.

Essential operational, transactional, legal, security, and safety communications may still be sent even where a user has opted out of marketing.

12. Marketing Preferences

Where permitted by applicable law, Dyrect may send information relating to:

Promotions;
Referral programmes;
New features;
Product updates;
Surveys;
Educational content;
Marketing campaigns.

Where required, marketing communications will only be sent with an appropriate lawful basis, including consent where applicable.

You may opt out of eligible promotional communications through:

Account preferences;
Unsubscribe options included in communications;
Dyrect Support.

Opting out of marketing does not prevent Dyrect from sending important service-related communications.

13. Data Retention

Dyrect retains personal information only for as long as reasonably necessary for the purposes for which it was collected.

We may retain information where necessary to:

Provide the Platform;
Complete deliveries;
Process payments;
Verify identities;
Prevent fraud;
Resolve disputes;
Comply with legal and regulatory obligations;
Meet tax and accounting requirements;
Enforce agreements;
Protect Dyrect and its users.

Information retained may include:

Account information;
Identity verification records;
Profile information;
Delivery history;
Route information;
Payment and transaction records;
Customer support communications;
Chat messages;
Ratings and reviews;
Device and security logs;
Fraud-prevention records.

Retention periods may vary depending on the type of information and applicable legal requirements.

When information is no longer reasonably required, Dyrect may securely delete, anonymise, or otherwise dispose of it.

Closing an account does not necessarily result in immediate deletion of every record associated with that account where continued retention is legally permitted or required.

14. Security and Fraud Prevention

Dyrect takes reasonable administrative, technical, and organisational measures designed to protect personal information from unauthorised access, disclosure, loss, misuse, alteration, or destruction.

Security measures may include:

Encrypted communications;
Secure authentication;
OTP verification;
Access controls;
Role-based access controls;
Identity verification;
Audit logging;
Fraud detection systems;
Security monitoring;
Secure cloud infrastructure;
Backups;
Security testing and updates.

Dyrect may monitor account activity and transactions for indicators of fraud, abuse, security threats, or unlawful activity.

This may include reviewing:

Login activity;
Device information;
Location consistency;
Payment activity;
Identity verification records;
Delivery history;
User reports;
Security logs.

Where Dyrect reasonably suspects fraudulent, abusive, or unlawful activity, we may:

Suspend or restrict Platform access;
Delay or refuse transactions where permitted;
Request additional verification;
Investigate the activity;
Restrict certain Platform functionality;
Cooperate with competent authorities where legally required.

No method of electronic transmission or storage is completely secure.

Users are responsible for protecting their devices, passwords, OTPs, and account credentials.

15. International Data Transfers

Dyrect and its service providers may store or process information outside the country in which you reside.

Where personal information is transferred internationally, Dyrect will take reasonable steps to ensure appropriate safeguards are implemented where required by applicable law.

Some destination countries may have data protection laws that differ from those in your country of residence.

16. Children’s Privacy

The Platform is intended for individuals who are at least eighteen (18) years of age or otherwise legally permitted to use the Platform under applicable law.

Dyrect does not knowingly permit individuals who are legally ineligible to independently operate as Drop Stars.

If Dyrect becomes aware that personal information has been collected from an ineligible child without appropriate legal authority, we will take reasonable steps to delete or otherwise handle that information in accordance with applicable law.

Parents or legal guardians who believe a child has provided personal information to Dyrect without appropriate authority may contact us.

17. Your Privacy Rights

Subject to applicable law, you may have the right to:

Request access to personal information held about you;
Request correction of inaccurate or incomplete information;
Request deletion of information in certain circumstances;
Request restriction of certain processing;
Object to certain processing;
Withdraw consent where processing is based on consent;
Request a copy of certain personal information in a portable format where applicable;
Lodge a complaint with an appropriate data protection authority.

These rights are not absolute and may be limited where Dyrect has legal obligations or another lawful basis to continue processing information.

18. Access, Correction and Account Deletion

You may request access to, correction of, or deletion of your personal information through the Platform or Dyrect Support.

Dyrect may require reasonable identity verification before acting on such requests.

Where permitted by applicable law, Dyrect may refuse or limit requests that are:

Manifestly unfounded;
Excessive;
Repetitive;
Contrary to legal obligations;
Likely to adversely affect the rights of others;
Likely to compromise fraud prevention or security;
In conflict with an ongoing investigation.

Many account details may be updated directly through the Platform.

Deleting your account may result in loss of access to:

Delivery history;
Saved addresses;
Ratings;
Preferences;
Drop Star functionality;
Earnings information;
Other account-related features.

Certain information may continue to be retained where required or permitted for legal compliance, fraud prevention, accounting, tax, security, investigation, or dispute-resolution purposes.

19. Cookies, Analytics and Similar Technologies

Where Dyrect’s website or Platform uses cookies, analytics tools, or similar technologies, they may be used to:

Maintain user sessions;
Remember preferences;
Improve functionality;
Measure performance;
Detect fraud;
Enhance security;
Understand Platform usage;
Diagnose crashes and technical issues.

Analytics information may include:

Device information;
Feature usage;
Session duration;
Navigation patterns;
Crash reports;
Performance metrics.

Where reasonably practicable, analytics information may be aggregated or de-identified.

Users may manage certain cookie settings through their browser.

Disabling cookies may affect some Platform functionality.

20. Automated Systems and Artificial Intelligence

Dyrect may use automated systems, algorithms, machine learning, or artificial intelligence to support certain Platform functions.

These may include:

Matching Senders with compatible Drop Stars;
Ranking package opportunities;
Calculating route compatibility;
Estimating detour distance and time;
Estimating delivery times;
Optimising routes;
Detecting fraudulent or suspicious activity;
Identifying unusual account behaviour;
Supporting customer service;
Improving Platform security.

Matching may consider factors such as:

Pickup location;
Delivery destination;
Drop Star route;
Distance from the planned route;
Estimated detour;
Travel date;
Availability;
Package characteristics;
Delivery fee;
Relevant Platform eligibility or safety factors.

Automated systems are designed to support Platform operations and may be supplemented by human review where appropriate.

Where applicable law provides rights concerning certain automated decisions, Dyrect will comply with those requirements.

21. Camera, Photos, Contacts and Device Permissions

Subject to device permissions, Dyrect may request access to certain device capabilities.

Camera and Photos

Camera or photo access may be used for:

Profile photographs;
Identity verification;
Selfie verification;
Pickup confirmation;
Delivery confirmation;
Proof-of-delivery photographs;
Damage reports;
Customer support requests.

Contacts

Where you choose to grant access, Dyrect may use contact information to:

Send referral invitations;
Help select recipients;
Improve certain Platform workflows.

Dyrect does not intend to upload or retain your entire contact list unless required for a feature you actively choose to use and appropriately disclosed.

Notifications

Push notifications may be used for:

Delivery updates;
Package opportunities;
OTP verification;
Security alerts;
Payment activity;
Customer support;
Promotions;
Platform updates.

Other Device Permissions

Depending on Platform functionality, Dyrect may request access to:

Location;
Camera;
Photos;
Notifications;
Microphone where applicable;
Phone functionality where required.

You may revoke permissions through your device settings.

Revoking certain permissions may prevent some Platform features from working correctly.

22. Third-Party Services and Integrations

Dyrect may integrate with third-party services including:

Payment providers;
Mobile money services;
Mapping services;
Identity verification providers;
Cloud infrastructure providers;
Analytics providers;
SMS and email providers;
Customer support tools;
Apple App Store;
Google Play;
Firebase or similar technology services.

These third parties may independently process information under their own privacy policies and terms.

Dyrect is not responsible for personal information processed independently by third parties outside the Dyrect Platform.

23. Legal, Regulatory and Emergency Disclosures

Dyrect may disclose personal information where we reasonably believe disclosure is necessary to:

Comply with applicable law;
Respond to valid court orders;
Respond to lawful requests from government authorities;
Protect life, health, or safety;
Prevent serious harm;
Investigate fraud;
Prevent criminal activity;
Protect Dyrect, its users, or third parties;
Establish, exercise, or defend legal claims.

Where legally permitted, Dyrect may require appropriate legal process before disclosing personal information and may challenge requests that appear excessively broad or invalid.

24. Security Incidents

If a security incident affects personal information, Dyrect may take reasonable steps to:

Investigate the incident;
Contain the incident;
Restore Platform security;
Mitigate potential harm;
Comply with applicable legal notification requirements.

Where required by law, affected users and relevant authorities may be notified within applicable legal timeframes.

Nothing in this section constitutes an admission of liability.

25. User Responsibilities and Privacy of Others

Users may receive limited personal information about other users for the purpose of completing legitimate Dyrect transactions.

Users must not:

Use another person’s information for unrelated purposes;
Publish another user’s personal information;
Share personal information with unauthorised third parties;
Collect personal information without lawful authority;
Contact another user for unrelated purposes;
Misuse delivery or recipient information;
Impersonate another person;
Submit deliberately false information;
Use personal information to harass, threaten, discriminate against, or harm another person.

Misuse of personal information may result in account restriction, suspension, termination, or referral to appropriate authorities.

26. Changes to this Privacy Policy

Dyrect may update this Privacy Policy from time to time to reflect:

Changes to Platform functionality;
New features;
Changes in technology;
Changes in business operations;
Legal or regulatory requirements;
Changes in privacy or security practices.

Where required by law, we will provide reasonable notice before material changes become effective.

The updated Privacy Policy will become effective on the date stated at the beginning of the document.

27. Complaints and Contact Information

If you have questions, concerns, complaints, account deletion requests, or other privacy-related requests, you may contact Dyrect through our official support channels.

In-App Support
Support may be available through the Dyrect mobile application.

Website
https://dyrect.xyz

Support Email
suppourt@dyrect.xyz

Privacy Email
help@dyrect.xyz

Where required by applicable law, you may also lodge a complaint with the relevant data protection authority.

Dyrect will make reasonable efforts to respond to privacy enquiries and requests within applicable legal timeframes.