The protection of your personal information is a top priority for EVODOO SARL, the company behind the Drayk platform. This Driver Privacy & Cookie Policy (the "Policy") explains, in clear and complete terms, what personal data we collect from delivery drivers and couriers who use the Drayk Driver application, why we collect it, how we protect it, and what rights you have over it.
Please read this Policy carefully. By applying to become a driver, creating a Drayk Driver account, or using the Drayk Driver application — on Android, iOS, or any similar device — you acknowledge that you have read and understood this Policy. This Policy forms an integral part of the Drayk Driver Terms & Conditions.
1. Commitment to Privacy
We apply the same high data-protection standards to drivers as we do to customers, guided by the following principles:
- Data Minimization: We collect only the personal information strictly necessary to onboard you, operate deliveries, pay your earnings, and keep the platform safe.
- Purpose Limitation: Your data is processed exclusively for specific, legitimate purposes and never used incompatibly with them.
- Transparency: We tell you plainly what we collect, why, how long we keep it, and with whom we share it — including continuous location tracking, which is essential to delivery work.
- Data Security: We implement robust administrative, technical, and physical safeguards, including encryption in transit, hashed credentials, signed short-lived tokens, and need-to-know access controls.
- Your Rights: We respect and facilitate your rights of access, rectification, opposition, and erasure at any time.
- Legal Compliance: All processing complies with Moroccan Law No. 09-08 on the protection of individuals with regard to personal data processing, under the oversight of the National Commission for the Control of Personal Data Protection (CNDP), and follows Apple App Store and Google Play data-handling requirements.
2. Scope & Data Controller
This Policy applies exclusively to natural persons who apply to, register on, or work through the Drayk Driver mobile application as independent delivery drivers or couriers (each a "Driver") in Morocco. It does not apply to customers of the Drayk user app (governed by our customer Privacy & Cookie Policy), to partner restaurants, or to visitors of our website — except where expressly stated.
The data controller for all personal data processed through the Drayk Driver app is EVODOO SARL, a limited liability company organized under the laws of the Kingdom of Morocco, registered at DOUAR FASK, Guelmim, Morocco, 81003, under Registre du Commerce No. 5719 and I.C.E. No. 003904593000051. Contact: [email protected], +212 605-698143.
Driver onboarding is invitation-only: accounts are created by EVODOO following an application, identity verification, and approval. Unknown phone numbers cannot self-register in the app.
3. Information We Collect
To verify your identity, qualify you for delivery work, dispatch orders to you, calculate and pay your earnings, and meet our legal obligations, we collect the following categories of information:
3.1 Account & Identity Information
- Phone Number: Your primary identifier, used for invitation, OTP login via WhatsApp, and operational contact. Displayed in masked form (+212 **** ** 123) wherever full display is unnecessary.
- Full Name & Avatar: Used to identify you to customers, restaurants, and support. Your avatar photo is public within delivery flows; your name may appear to customers in abbreviated form.
- City, Locale & Timezone: Your operating city, preferred language (Arabic, French, or English), and device timezone, used for dispatch eligibility, support, and payouts.
3.2 KYC & Compliance Documents (Identity Verification)
Because you handle food, parcels, and cash on behalf of customers, we are legally required to verify who you are before you can go online. Depending on your vehicle type, we collect and review:
- National ID card (CIN) or passport — mandatory for every driver;
- Portrait photograph — mandatory, used to confirm you match your identity document;
- Proof of independent professional status (e.g., auto-entrepreneur registration or equivalent evidence) — mandatory;
- Driver's license — mandatory for motorcycle drivers;
- Vehicle registration (carte grise) — mandatory for motorcycle drivers;
- Vehicle insurance certificate — required where applicable; an expired certificate blocks or suspends online access;
- Bank details (RIB) — your bank name and account identifier, stored in masked form (only the last digits visible), used solely to pay your earnings and settlements.
Documents are uploaded through the secure application channel indicated by EVODOO, stored with private visibility (never public), and reviewed by authorized personnel only. Each document carries a verification status and, where relevant, issue and expiry dates. You will be asked to renew any expired document; failure to do so suspends your eligibility to receive offers.
Important notice under Law No. 09-08: the national identity card number (CIN) is treated as sensitive identification data under Moroccan law. Its processing, together with continuous geolocation and transfers to non-adequate countries described below, is subject to prior declaration and, where required, prior authorization from the CNDP. EVODOO completes these formalities before operating the corresponding processing.
3.3 Vehicle & Work Information
- Vehicle type (bicycle or motorcycle) and license plate;
- Account lifecycle status (invited, approved, suspended, deactivated) and contract version acceptance;
- Availability sessions: online, offline, and stop-after-job states with timestamps;
- Cash custody position: cash collected, cash paid to restaurants, deposits submitted, exposure limits, and deposit due dates.
3.4 Photos & Camera Content
- Deposit receipt photos: when you settle cash (bank deposit or office handover), you photograph the receipt. The photo is uploaded as a private-media record linked exclusively to that deposit for verification and audit.
- Avatar photo: optional profile image, stored as public media.
Camera and photo-library access is requested only when you choose one of these actions. The Drayk Driver app does not currently require photographic proof of delivery; handover is proven by geofenced check-ins, fulfillment events, and the customer PIN described in our Terms.
3.5 Financial & Earnings Information
- Per-job earnings (delivery earnings, waiting-time earnings, destination-change earnings, reimbursements) with distances and durations;
- Wallet ledger entries, daily/weekly/lifetime summaries, and statements;
- Cash exposures per order (amounts you paid to restaurants and collected from customers);
- Cash deposits (amount, method, bank account or office agent, handover note, deposit date, receipt reference such as DEPO-########);
- Settlement periods and bank payouts, including bank references and any failure reason.
All monetary values are processed in minor currency units (centimes) in Moroccan Dirhams (MAD). You never process customer card payments: card orders are paid upstream, and your only financial flows are cash handling, earnings accrual, and bank payouts.
3.6 Job & Order Information Shown to You
While you hold an active assignment, the app necessarily shows you the information needed to complete it: pickup and destination addresses with access instructions, store name, customer or contact names (abbreviated where possible), phone numbers for the current pickup and delivery contacts, package description, order notes, item lists, route geometry, guaranteed earnings, cash amounts due, and whether a customer handover PIN is required. Outside an active assignment, historical job views never include customer phone numbers. See Section 9 for your confidentiality duties regarding this data.
3.7 Device & Technical Information
- Device identifiers: installation ID, device ID bound to your login session, and Firebase installation ID;
- Platform (Android or iOS), app version and build number (minimum supported builds are enforced for safety);
- Push registration data: notification token, locale, and timezone;
- Network data: IP address (hashed for rate-limiting and fraud prevention), network type, preferred language;
- Diagnostics: crash reports, error logs, and performance data collected via Firebase Crashlytics — the app's only remote crash reporter, enabled in production builds only — containing device type, OS version, app version, and error state, used solely to fix technical issues;
- Authentication security data: hashed OTP codes (HMAC-SHA256, never plaintext), hashed refresh tokens, session families, and device revocation records.
3.8 Support, Safety & Incident Information
When you contact support or report an issue (accident, vehicle breakdown, safety concern, app problem), we collect the incident category, your written description, the related order where applicable, and your location at the time of the report — used to assist you, investigate, and meet our safety and legal obligations.
4. Location Tracking — Please Read Carefully
Precise location tracking is the core of delivery work and is mandatory while you are online or handling a job. This section constitutes our prominent location disclosure for Apple App Store and Google Play review:
- What we collect: precise GPS coordinates (latitude, longitude), heading, speed, accuracy radius, and capture time.
- When we collect it: only while you are online (available for offers), holding an offer, or executing an active delivery. When you go offline, periodic location uploads stop (cadence set to zero). We do not track your location when you are offline.
- How often: approximately every 7 seconds while you hold an offer, carry an active job, or transfer custody — and approximately every 30 seconds while online and idle. These cadences are set by our servers and may be tuned for safety and battery efficiency.
- Background location: on both Android and iOS, the app may continue to receive location updates for a short time when minimized or with the screen off while you are online or on an active delivery, so that dispatch, customer tracking, proof of presence, and safety continue to work. In short: Drayk Driver collects location data to enable dispatch of nearby offers, pickup and delivery verification, live customer order tracking, waiting-pay computation, and delivery safety — even when the app is closed or not in use — while you are online or on an active delivery. If you deny background / "Allow all the time" location access, you can still use the app in the foreground, but offers and active-job tracking may pause when the app is not visible. Going offline stops this collection.
- Why we need it: to verify you are inside your operating city and its delivery zones; to rank and offer you nearby jobs; to navigate you; to verify pickup, arrival, and handover through geofences; to share live progress with the customer whose order you carry; to compute waiting-time pay; to investigate disputes, fraud, and safety incidents; and to comply with our obligations as a transport intermediary.
- Customer-visible tracking: after you pick up an order, your live position on that order is shared with the ordering customer until handover, so they can follow their delivery.
- Location evidence: key moments (going online, pickup, handover, arrival, customer-unavailable periods, custody transfers, incidents, cash payments) are recorded with their coordinates as tamper-evident operational evidence and retained per Section 12.
- Your control: location is controlled by going online or offline in the app and by your OS location permission. Disabling location prevents dispatch and order execution — you cannot receive offers without it. Withdrawing consent for location means staying offline.
Unusually large position jumps (for example, speeds above 70 m/s) are flagged automatically as anomalies for fraud review. Drivers who are online but stop sending fresh positions for more than 2 minutes are automatically switched offline for safety and fairness.
5. Legal Basis for Processing
In accordance with Moroccan Law No. 09-08, we process your personal data on the following legal grounds:
- Performance of a Contract: processing necessary to execute the Driver Terms — onboarding, dispatch, order fulfillment, earnings calculation, cash settlement, and payouts.
- Legal Obligation: identity verification, document retention, tax and accounting records, and responses to lawful requests from Moroccan judicial or administrative authorities.
- Legitimate Interests: platform safety, fraud prevention (including anomaly detection and rate limiting), service quality monitoring, and aggregated analytics — balanced against your fundamental rights.
- Consent: where specifically requested — location permission prompts, optional avatar, promotional communications, and any processing beyond what the contract strictly requires. You may withdraw consent at any time (withdrawal of location consent means remaining offline, as described above).
6. How We Use Your Information
- Onboarding & Verification: reviewing your application, verifying identity and vehicle documents, confirming independent professional status, and deciding on approval.
- Authentication & Security: OTP login, session management, device binding, fraud and abuse detection.
- Dispatch & Delivery: checking online eligibility, ranking and offering nearby jobs, guiding fulfillment, verifying geofenced steps, and recording operational evidence.
- Earnings & Settlement: computing pay, tracking cash custody, verifying deposits, closing settlement periods, and executing bank payouts.
- Customer Tracking: sharing your live position on an active order with the ordering customer until handover.
- Safety & Support: responding to incidents, assisting in emergencies via published support numbers, and investigating disputes.
- Quality & Improvement: aggregated analytics, crash fixing, and service development.
- Legal Compliance: tax records, CNDP formalities, and lawful authority requests.
- Communications (with consent where required): operational push notifications, offer alerts, payout notices, and — only if you agree — platform news and incentives.
7. Third-Party Services & SDKs
The Drayk Driver app integrates the following third-party services, each processing certain data under its own privacy policy. We vet providers contractually and limit their access to what is strictly necessary:
- Google Maps Platform & Routes API (Google LLC): embedded maps, address search, route geometry, distances, durations, and external navigation links. Google may process device location and usage data per Google's Privacy Policy.
- Firebase Cloud Messaging, App Installations & Crashlytics (Google LLC): push delivery for offers and order updates, installation identifiers, and crash diagnostics per Firebase Privacy & Security and Google's policy above.
- Meta WhatsApp Business API (Meta Platforms, Inc.): delivery of OTP login codes to your phone number; your number and the message transit Meta servers per WhatsApp's Privacy Policy.
- Media hosting provider: private storage of KYC documents and deposit receipts (private visibility) and avatar images (public visibility), under encryption and access controls.
- Banking partners: your masked RIB destination is used by our finance operations to execute payouts; banks process transfers under their own regulatory frameworks.
- External navigation apps: if you choose Apple Maps, Google Maps, or Waze for turn-by-turn guidance, your navigation request is handled by that app under its own policy.
8. Sharing of Information
We do not sell your personal data. We share it only in the following limited circumstances:
- Customers (active assignment only): your first name, abbreviated identity, avatar, vehicle type, and live delivery position until handover — so the customer can recognize you and follow their order. Your phone number is exposed only where direct coordination is required during the active job.
- Partner Restaurants & Pickup Contacts: your name and arrival status for the pickup you are executing.
- Technology & Infrastructure Providers: hosting, database, push, mapping, and diagnostics vendors under strict confidentiality and purpose-limitation contracts.
- Banking & Finance Operations: payout instructions and deposit verification records.
- EVODOO Group Companies: under uniform data-protection guidelines for integrated service delivery.
- Legal Authorities: where required by Moroccan law, court order, or lawful government request, or to protect rights and safety.
- Business Transfers: in a merger, acquisition, or asset sale, data may transfer to the successor under equivalent protections, with notice to you.
9. Your Duty Towards Customer Data
During every active assignment you necessarily receive third-party personal data — customer and recipient names, phone numbers, addresses, access codes, and order contents. When handling this data you act as a data processor on behalf of EVODOO and must:
- Use customer data exclusively to execute the assigned pickup and delivery, and for nothing else;
- Never copy, photograph, record, memorize for later use, or disclose customer data to any third party;
- Never contact customers outside the assigned job or after handover, for any reason including marketing, personal purposes, or disputes;
- Delete or forget any customer contact details remaining on your device (call logs, WhatsApp threads) once the job is complete, to the extent technically possible;
- Immediately report to [email protected] any suspected leak, loss, or misuse of customer data.
Any misuse of customer data — including harassment, unauthorized contact, or disclosure — is a serious breach of the Driver Terms, leads to immediate suspension and deactivation, and may be referred to the competent Moroccan authorities. This duty survives the termination of your driver account.
10. International Data Transfers
Your data is primarily stored and processed in Morocco. However, some providers operate servers outside Morocco — notably Meta (WhatsApp, United States) for OTP delivery, Google (Firebase Crashlytics, Cloud Messaging) on global infrastructure, and Google (Maps) on global infrastructure.
Where data leaves Morocco, we apply safeguards including data-processing agreements imposing protections equivalent to Law No. 09-08, adequacy-based routing where available, and strict minimization (for example, only the phone number and OTP message transit WhatsApp; only diagnostics transit crash reporters). Transfers outside Morocco are included in our CNDP filings, and prior CNDP authorization is sought wherever the law requires it — in particular for transfers to countries not recognized as providing adequate protection. For transfer questions, contact [email protected].
11. Information Security
- Encryption in Transit: all app-to-server traffic uses TLS — never plain HTTP.
- Credential Security: OTP codes and refresh tokens are stored only as HMAC-SHA256 hashes; plaintext secrets are never persisted.
- Token Architecture: 15-minute signed JWT access tokens; 256-bit opaque refresh tokens rotated on every use, with reuse treated as a breach signal; device-bound sessions with remote revocation.
- Rate Limiting: strict OTP, login, refresh, and location-ingestion limits against brute force, SMS flooding, and abuse.
- Access Controls: need-to-know access only — KYC reviewers see documents, finance sees payouts, support sees only the job at hand; customer phones are hidden outside active assignments.
- Media Segregation: KYC documents and deposit receipts are stored with private visibility; only avatars are public.
- Infrastructure: firewalls, intrusion detection, monitored error logging without user-data exposure, and secrets management.
No digital system is 100% secure. Protect your phone with a lock screen, never share OTP codes or your account, and notify us immediately of suspected unauthorized access.
12. Data Retention Periods
We keep your data only as long as necessary for the purposes in this Policy:
- Active Account Data: retained while your driver account is active and during the 15-day cancellable deletion grace period.
- KYC Documents: retained for the duration of the driver relationship plus 5 years thereafter for legal, tax, and dispute purposes, in access-restricted storage; expired documents are marked but kept as audit trail unless erasure is legally required.
- Job & Fulfillment Records (including location evidence): minimum 5 years after completion, per Moroccan commercial and tax obligations.
- Financial Records (wallet, deposits, settlements, payouts): minimum 5 years; deposit receipt photos retained with the deposit record.
- Live Location Stream: ephemeral (approximately 2–10 minute server retention); only evidentiary checkpoints are kept long-term.
- OTP Records: expire after 5 minutes, permanently deleted after 24 hours.
- Sessions & Refresh Tokens: expire after 7 days; deleted on logout, rotation, or revocation.
- Crash Reports: retained by Firebase Crashlytics for a rolling 90-day period for debugging.
- Support & Incident Records: up to 2 years after resolution.
- Anonymized Analytics: may be kept indefinitely in de-identified, aggregated form.
After the applicable period, data is securely deleted or permanently anonymized.
13. Account & Data Deletion
You have the right to delete your Drayk Driver account and associated personal data at any time — in the app and on the web, as required by Apple and Google Play:
- In-App: Profile → Settings → Delete account, then follow the on-screen confirmation steps.
- By Email / Web: send a request to [email protected] from your registered phone number or email with the subject "Driver Account Deletion Request". This same address serves as our public web deletion contact for store compliance.
Upon your verified request, you are signed out, a 15-day grace period begins during which you may sign back in to cancel, and afterwards your profile, documents access, and session data are permanently deleted or anonymized. Data the law requires us to keep (job, financial, and tax records) is retained in de-identified, access-restricted form for the statutory periods above, and active legal disputes pause deletion of related records until resolved. Once processing completes, deletion is irreversible.
Deactivation by EVODOO (for breach, fraud, or safety) is governed by the Driver Terms and is distinct from your voluntary deletion right.
14. Push Notifications
Push notifications are operationally essential for drivers and include:
- Offer & Job Alerts: incoming delivery offers with countdowns, assignment updates, customer-unavailable timers, custody and payout notices. These are required to work — going online requires an active push registration.
- Account & Compliance Notices: document approvals, rejections, renewals, deposit deadlines, and security alerts.
- Platform Updates (with consent): new zones, incentive programs, and app news. You may opt out of non-essential messages anytime in device settings or by contacting us.
To deliver notifications we store your device push token, Firebase installation ID, locale, and timezone. You can revoke push registration on logout; revocation disables online eligibility until re-enabled.
15. Cookies & Local Storage
Website Cookies
When you visit drayk.ma (for example, the driver application page), we may use essential cookies (session, language), functional cookies (preferences), and anonymized analytics cookies. Manage them in your browser settings; disabling some may affect the site.
Mobile App Secure Storage
The Drayk Driver app stores data on your device via the OS secure keystore (Keychain on iOS, Keystore on Android) and app-private storage:
- Encrypted authentication tokens and session identifiers;
- Preferences: language, theme, map-app choice, sound settings, onboarding flags;
- Installation identifier and cached operational data for offline resilience.
Logging out wipes session keys; uninstalling the app or clearing app data removes remaining local data. Server-side data is governed by Sections 12–13 above.
16. Apple App Store & Google Play Disclosures
For full transparency towards store review and towards you, we summarize here how this Policy maps to store requirements:
- Apple Privacy Nutrition Labels (Drayk Driver): Contact Info (phone number, name); Sensitive Info (government ID, portrait); Financial Info (bank details for payouts, earnings); Precise Location (while online / on active delivery, including limited background operation); Usage & Diagnostics (crash data); Photos (receipt and avatar images you choose to provide). Data is used for app functionality, fraud prevention, and legal compliance; it is not sold, not used for third-party advertising, and not used for cross-app tracking.
- Google Play Data Safety (Drayk Driver): personal info, financial info, photos, precise location, and app activity collected as described; data encrypted in transit; account deletion available in-app and via [email protected].
- Background Location (Google Play prominent disclosure): Drayk Driver collects location data to enable dispatch of nearby offers, pickup and delivery verification, live customer order tracking, waiting-pay computation, and delivery safety — even when the app is closed or not in use — while you are online or executing a delivery. Going offline stops periodic collection. Continued use while online constitutes acknowledgment of this disclosure alongside the runtime permission prompt. (This same disclosure is shown in-app before the system location permission is requested.)
- No Tracking (Apple ATT): the app does not track you across other companies' apps or websites and does not use the IDFA for advertising.
- Required Links: this Policy URL is the app's store privacy-policy link; Section 13 provides the account-deletion path and contact required by both stores.
17. Children's Privacy
Drayk Driver is exclusively for persons aged 18 or older who hold full legal capacity, valid identity documents, and — for motorcycle drivers — a valid license and insured vehicle. We do not knowingly collect data from minors. Accounts found to belong to under-18 persons are immediately suspended and deleted. If you believe a minor has submitted data, contact [email protected] for prompt removal.
18. Your Privacy Rights
Under Moroccan Law No. 09-08 and international best practice, you hold the following rights:
- Access: obtain a copy of the personal data we hold about you and how it is processed and shared.
- Rectification: correct inaccurate, incomplete, or outdated data (many profile fields are editable in-app; documents are renewed by resubmission).
- Erasure: request permanent deletion where data is no longer necessary, subject to statutory retention (Section 12).
- Objection: object to legitimate-interest processing, especially direct marketing — marketing stops immediately upon objection.
- Restriction: request a temporary processing pause (e.g., while an accuracy dispute is resolved).
- Portability: receive your data in a structured, machine-readable format and transmit it elsewhere where technically feasible.
- Breach Information: be notified without undue delay of any breach likely to create high risk to your rights.
- Complaint to the CNDP: lodge a complaint with the National Commission for the Control of Personal Data Protection at www.cndp.ma if you believe your rights have been violated.
Exercise any right at [email protected]. We respond to verified requests within 30 days and may require identity proof to prevent unauthorized access.
19. Policy Changes & Contact
We may update this Policy to reflect new features, legal requirements, or CNDP guidance. Material changes are notified via in-app notice and/or email, and the "Last Updated" date is revised. Continued use after notification constitutes acceptance. If you disagree, stop using the Driver app and exercise your deletion right.
For questions, rights requests, or complaints, contact EVODOO SARL: