Privacy Policy

This policy covers the Veltmo platform: the customer storefront, the restaurant dashboard, the point-of-sale terminal, and the three mobile apps listed below. The data controller is Almacq Holdings, contactable at privacy@almacq.com.

Restaurants using the platform are separate controllers of their own customer and staff records. Where a restaurant decides how your data is used, this policy describes what we do on their behalf.

These are the permissions a store listing asks us to justify, so we are specific about them.

• Precise location is requested only by the rider app, and only while a delivery is active. It is used to show the restaurant and the customer where their order is, and it stops when the delivery ends or the rider goes off duty.
• The camera and photo library are requested only by the rider app, to capture proof of delivery at the drop-off.
• Push notifications are used for order status, job offers, and kitchen alerts. You can turn them off in your device settings and keep using the app.

The customer app can suggest your usual ride or meal when it is about time for it, and remind you once before. It works these out from your own rides and orders on Veltmo, and from what you do in the app while suggestions are on. It is on unless you turn it off, and the app explains it the first time before showing any suggestion.

• What is recorded: the names of things you do in the app (opening a restaurant, searching, adding to your basket, booking) with the restaurant or item involved and a short search term. Not your location, contacts, messages or anything outside the app.
• What it is used for: your own suggestions and reminders only. It is not sold, not shared with restaurants, and not used for advertising by anyone else.
• Reminders: at most one a day, never between 9pm and 7am, and none if you have turned off marketing messages. Order and trip updates are separate and unaffected.
• Turning it off, in Settings under Suggestions, stops the recording and deletes what was recorded and learned straight away.
• Ask Veltmo, the help assistant in the app, answers using your question and your last few orders and trips. To do that, the conversation and those details are sent to the provider of the AI model, under terms that do not allow it to use them to train its models. Conversations are not stored by Veltmo.

• Full card numbers. Card payments are processed by Paystack; we store only the result of the transaction and, if you choose to save a card, the masked reference our processor returns.
• Your contacts, your calendar, or your browsing outside our apps.
• Location from the customer or POS apps.

We do not sell personal data. We share only what a given task requires, with:

• The restaurant you ordered from, so it can prepare and deliver your order.
• The rider assigned to your delivery, who sees the delivery address and your first name and phone number for that delivery only.
• Paystack, our payment processor, to take payment and issue refunds.
• Our messaging providers, to send the SMS and email you asked for, such as a verification code or a receipt.
• The AI provider behind Ask Veltmo, the help assistant, to answer the questions you ask it (see above).
• Our cloud hosting providers, which run the platform for us.
• A regulator or law enforcement, where we are legally required to.

Onboarding a restaurant means giving us more than an account. To verify a business and to pay it out, we collect and store:

• Business registration and tax identification documents, and identification for the owner or director.
• Bank account details used for payouts, verified through our payment processor.
• The staff accounts you create, including each person’s name, contact details, role, and the hashed PIN they use at the till.

These documents are held privately. They are never served from a public URL, cannot be reached by guessing a filename, and are readable only through a short-lived signed link issued to someone authorised to see them.

The platform is hosted by our cloud providers in data centres outside Ghana. If you are in Ghana, this means your personal data is processed outside the country.

We rely on our contracts with those providers to keep the data protected to the standard this policy describes, and we do not permit them to use it for their own purposes. If you would rather not have your data processed abroad, the platform is not able to offer that today, and you should not use it.

• Everything travels over HTTPS, and stored files and database contents are encrypted at rest.
• Passwords and staff PINs are stored only as one-way hashes. Nobody at Veltmo can read them, including us.
• Each restaurant’s data is scoped to that restaurant. Staff of one restaurant cannot read another restaurant’s orders, customers, or takings.
• Verification documents and delivery proofs are private, and are separated from the menu images that are meant to be public.
• Access to production systems is limited and logged, and the platform records an audit trail of significant actions taken in the dashboard.

No system is perfectly secure. If we discover a breach that puts you at risk, we will tell you and the Data Protection Commission as the law requires.

We do not use cookies, and we do not run advertising or third-party analytics trackers.

When you sign in, the browser keeps your session token in its own local storage so you stay signed in between visits. Clearing your browser data signs you out. The mobile apps keep the equivalent token in the device’s secure storage.

Account details are kept while your account is open. Order, payment, and payout records are kept for as long as tax and accounting rules require, even after an account closes, because we are obliged to be able to produce them. Rider location history is kept only as long as it is useful for resolving a delivery dispute, and then removed. In-app activity recorded for personalised suggestions is deleted after 180 days, or at once when you turn suggestions off or delete your account.

Under the Ghanaian Data Protection Act, 2012 (Act 843), you have the right to be told what we hold about you, to have it corrected if it is wrong, to object to how we are using it, and to ask us to delete it.

• Ask for a copy of your data, and we will send it in a form you can read and take elsewhere.
• Ask us to correct anything inaccurate — most of it you can also edit yourself in the app.
• Ask us to delete your account: see the deletion page below, which sets out exactly what goes and what has to stay.
• Withdraw a permission you previously gave, such as location or notifications, from your device settings at any time.

Deletion has its own page with the process and the retained-records exceptions: Delete your account and data. For anything else, write to privacy@almacq.com. We answer within 30 days.

Come to us first — most things are quicker to fix directly. If we cannot resolve it, you can complain to the Data Protection Commission of Ghana, the authority that supervises how personal data is handled under Act 843. You do not need our permission to do that, and you can do it at any point.

The platform is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has given us information, write to privacy@almacq.com and we will remove it.

If this policy changes materially we will say so in the apps before the change takes effect. The date at the top always reflects the current version.