1. Introduction

This Privacy Policy describes how Hive Logistics Pte Ltd (UEN 202613598M), operating as DeliverLah ("Company", "we", "us", "our"), collects, uses, discloses, and protects your personal data in accordance with the Personal Data Protection Act 2012 ("PDPA") of Singapore. By using the DeliverLah platform, you consent to the practices described in this policy.

2. Data Protection Officer

Our Data Protection Officer ("DPO") is responsible for ensuring compliance with the PDPA. If you have any questions, concerns, or requests regarding your personal data, please contact:

3. Personal Data We Collect

We collect the following categories of personal data when you register for and use our platform:

• Identity data: Name, email address, phone number (Singapore +65)
• Authentication data: Hashed password (we never store your password in plain text)
• Location data: GPS coordinates (pickup, dropoff, and live Dropper location during active deliveries), default operating location, operating radius
• Delivery data: Job history, parcel sizes, delivery statuses, timestamps, notes to Droppers
• Financial data: Transaction history (payment authorizations, delivery confirmations, payouts, refunds) processed through our licensed third-party payment provider. We do not store or manage user funds directly.
• Review & rating data: Ratings (1–5 stars), review comments, average rating, rating count
• Report & safety data: Reports filed or received, report reasons, warning count, ban status and reasons
• Device & technical data: IP address, browser type and version, device type, operating system, referring URLs, pages visited, and access timestamps
• Terms acceptance data: Date and version of Terms of Service and Privacy Policy acceptance

4. Purposes for Collecting and Using Data

We collect, use, and process your personal data for the following purposes:

• Platform operations: Creating and managing your account, matching Senders with Droppers, processing deliveries, calculating fees, and managing wallet transactions
• Trust & safety: Verifying user identity, processing reviews and ratings, investigating reports, enforcing community standards, issuing warnings or bans, and preventing fraud or abuse
• Communication: Sending account-related emails (welcome email, delivery updates, account actions), responding to enquiries, and providing customer support
• Analytics & improvement: Understanding usage patterns, improving platform features and user experience, and monitoring platform health and performance. We use Vercel Analytics, Vercel Speed Insights, and Google Analytics (GA4) to collect anonymised usage data including page views, session duration, traffic sources, and device information
• Public live map display: Showing an anonymous dot on our public live map at an approximate neighbourhood level derived from your signup IP address. The dot does not display your name, precise location, home address, or any delivery details. The IP is resolved only to a bucketed Singapore planning area (e.g. Tampines, Bishan) and the dot is placed randomly within that area. You may opt out at any time from your profile settings, and opting out removes your dot from the map immediately.
• Legal & compliance: Complying with applicable laws and regulations, responding to lawful requests from authorities, enforcing our Terms of Service, and protecting the rights and safety of our users and the Company

5. Consent for Location & Phone Sharing

By using DeliverLah, you consent to the sharing of your phone number and real-time GPS location with the other party during an active delivery (i.e., from the time a Dropper accepts a job until the delivery is marked as completed or cancelled). This sharing is necessary for the completion of the delivery service. Your live location is only tracked and shared while you have an active delivery in progress — it is not tracked at any other time. You may withdraw this consent at any time by ceasing to use the platform, though doing so may prevent you from completing or receiving deliveries.

Community Communication: DeliverLah encourages users to connect and build community relationships through external channels. However, if you choose to arrange delivery transactions outside of the platform, Hive Logistics Pte Ltd holds zero liability for any non-payment, lost goods, or disputes arising from such off-platform transactions. Our dispute resolution and payment protection features are only available for deliveries booked and paid through the platform.

6. Disclosure of Personal Data

We may disclose your personal data to the following parties:

• Other users: Your name, phone number, and location are shared with the counterparty during an active delivery. Your average rating and review count are visible to other users.
• Payment processor: Transaction and payment data for processing top-ups, PayNow payments, and withdrawals
• Hosting & infrastructure (Vercel, Neon): Your data is stored on servers operated by our infrastructure providers. These providers act as data intermediaries and are contractually bound to protect your data.
• Law enforcement & government agencies: We may disclose personal data when required by law, court order, or government regulation, or when we believe in good faith that disclosure is necessary to protect the safety of any person or to prevent illegal activity
• Professional advisors: Lawyers, auditors, and accountants as necessary for business operations and legal compliance

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Active accounts:Data is retained for the duration of your account's existence
• Deleted accounts: Core account data is deleted within 30 days of account deletion request. Transaction records and delivery history may be retained for up to 7 years for legal and accounting purposes.
• Reports & safety data: Reports and ban records may be retained indefinitely to protect platform safety and prevent re-registration by banned users
• Location data: Live delivery location data is retained only for the duration of the active delivery and is cleared upon completion or cancellation
• Technical logs: Server logs and analytics data are retained for up to 90 days

8. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or alteration. These measures include: password hashing using bcrypt with a cost factor of 12; encrypted data transmission via HTTPS/TLS; secure database hosting with SSL connections; role-based access controls for administrative functions; JWT-based authentication with secure token handling; and regular security reviews. While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Cookies & Tracking Technologies

We use essential cookies and local storage for authentication and session management (e.g., NextAuth.js session tokens). These are strictly necessary for the functioning of the platform and cannot be disabled. We do not use advertising cookies or third-party tracking cookies. We may use basic analytics to understand usage patterns and improve the platform experience.

10. Your Rights Under the PDPA

Under the Personal Data Protection Act 2012, you have the following rights:

• Right of access: You may request a copy of the personal data we hold about you
• Right of correction: You may request that we correct any inaccurate or incomplete personal data. You may also update your profile information directly through the platform.
• Right of withdrawal: You may withdraw your consent for the collection, use, or disclosure of your personal data at any time by contacting our DPO. Please note that withdrawal of consent may affect our ability to provide the platform services to you.
• Right of portability: You may request a copy of your personal data in a commonly used, machine-readable format
• Right of deletion: You may request deletion of your personal data, subject to our legal obligations to retain certain records

To exercise any of these rights, please contact our DPO at dpo@deliverlah.com. We will respond to your request within 30 days.

11. Children's Data

DeliverLah is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children or minors. If we become aware that we have collected personal data from a person under 18, we will take immediate steps to delete such data. If you believe a minor has provided us with personal data, please contact our DPO immediately.

12. Do Not Call (DNC) Registry

We respect Singapore's Do Not Call ("DNC") Registry provisions under the PDPA. We will not send marketing messages (via voice call, text message, or fax) to Singapore telephone numbers registered on the DNC Registry unless we have obtained your clear and unambiguous consent. Transactional and service-related communications (such as delivery notifications and account updates) are not considered marketing messages and are exempt from the DNC provisions.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or platform notification at least 14 days before taking effect. The "Version" number and "Effective" date at the top of this page will be updated accordingly. Continued use of the platform after changes take effect constitutes acceptance of the revised Privacy Policy.

14. Complaints

If you believe your personal data has been handled in a manner that is inconsistent with the PDPA, you may first contact our DPO at dpo@deliverlah.com to resolve the matter. If you are not satisfied with our response, you may lodge a complaint with the Personal Data Protection Commission ("PDPC") of Singapore at www.pdpc.gov.sg.