At Modularpath Systems, trading as KayyaX ("KayyaX," "we," "us," or "our"), we are deeply committed to protecting your privacy and ensuring the security of your personal information. This comprehensive Privacy Policy explains in detail how we collect, use, process, store, share, and protect your information when you access or use our mobile applications, websites, APIs, and all related services (collectively, the "Platform"). This policy applies to all users of our Platform, including customers, riders, vendors, and visitors.

By accessing or using the KayyaX Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with any part of this policy, please do not use our Platform.

1. Information We Collect

We collect various types of information to provide and improve our services. The information we collect falls into the following categories:

1.1 Information You Provide Directly

Account Registration Information

When you create an account on KayyaX, we collect:

Identity Information: Full legal name, date of birth, gender, and profile photograph
Contact Information: Email address, phone number(s), and residential or business address
Authentication Credentials: Password or PIN, and security questions/answers
Government-Issued Identification: For riders and vendors, we collect copies of national ID cards, driver's licenses, voter ID cards, or passports for identity verification

Rider-Specific Information

If you register as a rider on KayyaX, we additionally collect:

Vehicle Information: Motorcycle make, model, year, color, registration number, and photographs
Licensing Information: Driver's license number, class, issue date, and expiration date
Insurance Information: Insurance policy number, provider, coverage details, and validity period
Roadworthiness Certificate: Certificate number and validity
Association Membership: Kayya Riders Association of Ghana membership details (if applicable)
Verification Records: Identity, license, vehicle, and compliance documents, plus review notes related to rider activation
Banking Information: Bank account details or mobile money wallet information for receiving payments

Vendor-Specific Information

If you register as a vendor on KayyaX, we additionally collect:

Business Information: Business name, registration number, Tax Identification Number (TIN), business category, and operating hours
Business Location: Physical address, GPS coordinates, and delivery coverage areas
Product/Service Information: Menu items, products, prices, descriptions, and images
AI Feature Inputs: If you use the AI features in KayyaX Business and KayyaX Pro, such as the inventory assistant or product photo analysis, the questions you ask, the relevant inventory data, and the images you submit
Business Licenses: Food safety certificates, health permits, and other relevant business licenses
Banking Information: Bank account details or mobile money wallet information for receiving payments

Payment Information

To process transactions, we collect:

Mobile Money Details: MTN MoMo, Vodafone Cash, or AirtelTigo Money account numbers and associated names
Card Information: Debit/credit card numbers, expiration dates, CVV codes, and cardholder names (processed securely through PCI-DSS compliant payment processors)
Billing Address: Address associated with your payment method
Transaction History: Records of all payments, refunds, and wallet top-ups

Communications

We collect information from your communications with us, including:

Customer support inquiries and correspondence
In-app chat messages between users (customers, riders, vendors)
Feedback, reviews, and ratings you provide
Survey responses and promotional participation

1.2 Information Collected Automatically

Location Information

With your permission, we collect precise geolocation data:

For Customers: Pickup and destination details, plus location data needed to create and manage active trips or deliveries
For Riders: Current location while online or completing jobs, historical location data, routes taken, and trip patterns. While a rider is Online in the KayyaX Rider app, we collect the rider's precise location in the background, including when the app is closed or not in use, so that we can match the rider with nearby jobs and show customers live tracking of their trip or delivery. Background location collection stops when the rider goes Offline.
For Vendors: Business location for order fulfillment and delivery logistics

Location data is collected using GPS, Wi-Fi, cellular network triangulation, and IP address geolocation technologies.

Device and Technical Information

We automatically collect information about the devices you use to access our Platform:

Device Identifiers: Unique device IDs, advertising IDs, hardware serial numbers
Device Attributes: Device model, manufacturer, operating system type and version, screen resolution, and battery status
Network Information: IP address, mobile carrier, connection type (Wi-Fi, cellular), signal strength, and network speed
Browser Information: Browser type, version, language settings, and time zone
App Information: App version, installation date, update history, and crash reports

Usage Information

We collect detailed information about how you interact with our Platform:

Activity Logs: Login times, session duration, features accessed, buttons clicked, and pages viewed
Trip Data: Trip requests (completed, cancelled, or unfulfilled), trip duration, distance, route, and fare details
Order Data: Items ordered, order frequency, order values, and delivery preferences
Search History: Location searches, vendor searches, and product searches
Preferences: Favorite locations, preferred riders, preferred payment methods, and notification settings
Performance Data: App load times, errors, and technical performance metrics

Cookies and Similar Technologies

We use cookies, pixel tags, local storage, and similar technologies to collect information. Please see our Cookie Policy for detailed information about our use of these technologies.

1.3 Information from Third Parties

We may receive information about you from third-party sources, including:

Identity Verification Services: Identity verification, document checks, and fraud prevention services
Payment Processors: Transaction confirmations, payment status, and fraud alerts from mobile money operators and card networks
Marketing Partners: Information about how you interacted with our advertisements on third-party platforms
Social Media Platforms: If you link your social media account, we may receive profile information based on your privacy settings
Government Databases: Vehicle registration verification, license validation, and regulatory compliance checks
Other Users: Ratings, reviews, feedback, and reports submitted by other users

2. How We Use Your Information

We process your personal information for the following purposes:

2.1 Providing and Improving Our Services

Creating and managing your account
Connecting customers with riders and vendors
Processing trip requests, deliveries, and orders
Calculating fares, fees, and processing payments
Providing real-time navigation and ETA estimates
Enabling in-app communication between users
Sending trip receipts, order confirmations, and transaction notifications
Analyzing usage patterns to improve features and user experience
Developing new products and services
Conducting research and analytics to understand user behavior

2.2 Safety and Security

Verifying user identities and preventing fraud
Reviewing rider and vendor verification documents
Maintaining trip and delivery records for safety, dispute, and service follow-up
Investigating accidents, incidents, and complaints
Enforcing our Terms of Service and community guidelines
Detecting and preventing unauthorized access and cyber threats
Maintaining the integrity and security of our Platform
Supporting incident intake and follow-up workflows

2.3 Communications

Sending service-related notifications (trip updates, order status, account alerts)
Responding to your inquiries and support requests
Sending promotional offers and marketing communications (with your consent)
Conducting surveys and collecting feedback
Informing you of policy changes and updates

2.4 Legal and Regulatory Compliance

Complying with applicable laws, regulations, and legal processes
Responding to law enforcement requests and legal orders
Fulfilling tax reporting and record-keeping obligations
Meeting transportation and business licensing requirements
Protecting our legal rights and defending against claims

2.5 Personalization

Customizing the app experience based on your preferences
Providing personalized recommendations and suggestions
Displaying relevant content and offers
Remembering your settings and preferences

3. Legal Basis for Processing (GDPR and Ghana Data Protection Act Compliance)

We process your personal information based on the following legal grounds:

3.1 Contractual Necessity

Processing necessary to perform our contract with you, including providing rides, deliveries, and payment processing.

3.2 Legitimate Interests

Processing necessary for our legitimate business interests, such as fraud prevention, security, analytics, and service improvement, where these interests are not overridden by your rights.

3.3 Legal Obligation

Processing necessary to comply with legal requirements, including tax obligations, transportation regulations, and law enforcement requests.

3.4 Consent

Processing based on your explicit consent, such as for marketing communications, precise location tracking, and optional data sharing. You may withdraw consent at any time.

3.5 Vital Interests

Processing necessary to protect your vital interests or those of another person, such as in emergency situations.

4. Information Sharing and Disclosure

We may share your information in the following circumstances:

4.1 With Other Users

Customers and Riders: During a trip, customers and riders may see each other's first name, profile photo, vehicle details (for riders), service status, and other information needed to complete the trip or delivery. After the trip, both parties can rate and review each other.
Customers and Vendors: When ordering, vendors receive your delivery name, address, phone number, and order details. You can see vendor name, location, ratings, and product information.
Riders and Vendors: For deliveries, riders see vendor pickup location and customer delivery address.

4.2 With Service Providers

We share information with trusted third-party service providers who assist us in operating our Platform:

Payment Processors: Mobile money operators (MTN, Vodafone, AirtelTigo), card payment processors, and banking partners
Cloud Services: Data storage, hosting, and computing infrastructure providers
Communication Services: SMS gateways, email service providers, and push notification services
Analytics Providers: Companies that help us understand Platform usage and performance
Identity Verification: ID verification and document review providers
Customer Support: Help desk and customer service platform providers
Marketing Services: Advertising platforms and marketing automation tools
Map Services: Mapping and navigation data providers
AI Services: When a vendor uses the AI features in KayyaX Business and KayyaX Pro, such as the inventory assistant or product photo analysis, we send the relevant inventory data and images to our AI provider, Anthropic, to generate the answer or analysis. Anthropic processes this data on our behalf and does not use it to train its models.

All service providers are contractually obligated to protect your information and use it only for the specific purposes we authorize.

4.3 With Business Partners

Insurance Companies: For claims processing and coverage verification
Corporate Clients: If you use KayyaX through an employer or business account
Affiliated Companies: Our subsidiaries and corporate affiliates for operational purposes

4.4 For Legal Reasons

We may disclose your information when required or permitted by law:

In response to valid legal process (subpoenas, court orders, search warrants)
To law enforcement agencies investigating crimes or emergencies
To regulatory authorities for compliance purposes
To protect the safety, rights, or property of KayyaX, our users, or the public
In connection with investigations of fraud, intellectual property infringement, or other illegal activity

4.5 Business Transfers

If KayyaX is involved in a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership or control of your personal information.

4.6 With Your Consent

We may share your information in other circumstances with your explicit consent.

4.7 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify you for research, analytics, business intelligence, and marketing purposes.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations:

5.1 Active Accounts

We retain your account information for as long as your account remains active and for a reasonable period thereafter to provide continued service and comply with legal obligations.

5.2 Trip and Transaction Records

Trip history, transaction records, and payment information are retained for a minimum of 7 years to comply with tax and financial regulations in Ghana.

5.3 Location Data

Precise location data is retained for up to 12 months for active accounts. Aggregated location data may be retained longer for analytics purposes.

5.4 Communications

Customer support communications and in-app messages are retained for up to 3 years.

5.5 Verification Documents

Identity documents and verification records for riders and vendors are retained for the duration of their account plus 5 years.

5.6 After Account Deletion

After you delete your account, we may retain certain information as required by law, for legitimate business purposes, or to protect our legal interests. This retained data will be securely stored and not used for marketing purposes.

6. Data Security

We implement comprehensive technical, administrative, and physical security measures to protect your personal information:

6.1 Technical Safeguards

Encryption: All data transmitted between your device and our servers is encrypted using TLS 1.3. Sensitive data at rest is encrypted using AES-256 encryption.
Secure Authentication: Multi-factor authentication, secure password hashing, and session management
Network Security: Firewalls, intrusion detection systems, and DDoS protection
Vulnerability Management: Regular security assessments, penetration testing, and prompt patching
Access Controls: Role-based access control and least-privilege principles

6.2 Administrative Safeguards

Confidentiality agreements, role-based approvals, and personnel access controls
Regular security training and awareness programs
Data handling policies and procedures
Incident response plans and breach notification procedures
Regular audits and compliance reviews

6.3 Physical Safeguards

Secure data center facilities with access controls
Video surveillance and security personnel
Environmental controls (fire suppression, climate control)
Secure disposal of hardware and media

Important: While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your information.

7. Your Rights and Choices

Subject to applicable law, you have the following rights regarding your personal information:

7.1 Access

You have the right to request a copy of the personal information we hold about you. You can access much of your information directly through your account settings in the app.

7.2 Correction

You have the right to request correction of inaccurate or incomplete personal information. You can update most of your information directly in the app.

7.3 Deletion

You have the right to request deletion of your personal information, subject to certain exceptions (legal obligations, ongoing disputes, fraud prevention). To delete your account in the KayyaX, KayyaX Rider, or KayyaX Business app, go to Account > Login & Security > Delete account. Business owners can also delete their account from the KayyaX Business web console. If you no longer have the app, email privacy@kayyax.com from your account's email address or phone number with the subject "Delete my account" and we will handle it within 30 days. See kayyax.com/delete-account for what is deleted, what is kept, and anything you need to finish first.

7.4 Data Portability

You have the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another service provider.

7.5 Restriction of Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances, such as while we verify the accuracy of your data.

7.6 Objection

You have the right to object to processing of your personal information based on legitimate interests or for direct marketing purposes.

7.7 Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of processing before the withdrawal.

7.8 Location Permissions

You can control location permissions through your device settings. Note that disabling location access may limit the functionality of our services.

7.9 Marketing Communications

You can opt out of marketing communications by:

Clicking "unsubscribe" in marketing emails
Adjusting notification preferences in the app
Contacting us at privacy@kayyax.com

7.10 Do Not Track

Our Platform does not currently respond to "Do Not Track" browser signals. However, you can control tracking through your device and browser settings.

To exercise any of these rights, please contact us using the information provided in Section 13. We will respond to your request within 30 days.

8. International Data Transfers

KayyaX is headquartered in Ghana, and your information may be transferred to, stored, and processed in Ghana and other countries where we or our service providers operate. These countries may have different data protection laws than your country of residence.

When we transfer your information internationally, we implement appropriate safeguards, including:

Standard contractual clauses approved by relevant data protection authorities
Binding corporate rules for transfers within our group
Certification schemes and codes of conduct
Your explicit consent where required

9. Children's Privacy

KayyaX services are not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we discover that we have collected personal information from a child under 18, we will promptly delete that information.

10. Third-Party Links and Services

Our Platform may contain links to third-party websites, apps, or services. This Privacy Policy does not apply to those third-party services, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party services you access through our Platform.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:

We will update the "Last Updated" date at the top of this policy
We will notify you through the app, email, or other appropriate means
For significant changes affecting your rights, we may require you to acknowledge or accept the updated policy

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

12. Data Protection Officer

KayyaX has appointed a Data Protection Officer (DPO) responsible for overseeing our data protection strategy and compliance. You can contact our DPO for any questions or concerns about this Privacy Policy or our data practices:

Data Protection Officer
Modularpath Systems
Email: dpo@kayyax.com
Phone: +233 30 277 8899

13. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

Modularpath Systems, trading as KayyaX
15 Independence Avenue, Ridge
Accra, Ghana

Privacy Inquiries: privacy@kayyax.com
General Inquiries: support@kayyax.com
Phone: +233 30 277 8888
WhatsApp: +233 55 123 4567

14. Regulatory Complaints

If you are not satisfied with our response to your privacy concerns, you have the right to lodge a complaint with the relevant data protection authority:

Data Protection Commission of Ghana
No. 7 Dr. Isert Road, North Ridge
Accra, Ghana
Website: www.dataprotection.org.gh
Email: info@dataprotection.org.gh

Effective Date: March 1, 2026

Privacy Policy