Privacy policy

Last updated: 31 October 2026.

Who we are

Track Order MW is software that buy-for-me, parcel forwarding, freight and car import businesses use to run their work: orders, customers, payments, shipments, documents and customer updates. This policy explains what personal data we handle, why, who receives it, and the choices you have. It is written with Malawi's Data Protection Act, 2024 in mind.

Who is responsible for what

• For your account and the use of our website, we decide how data is used.
• For business data, such as a business's customers, orders, payments and email, the business decides and we act on its instructions. Customers of a business should contact that business first.

What we collect

• Account details: name, email address, phone number, the business you work for, your time zone, and your password, stored only as a secure hash.
• Security information: sign-in times, devices, IP addresses, two-step verification settings and an audit log of important actions.
• Business data: what a business enters, including customers' names, contact details, delivery details, orders, payments, documents, photos and messages.
• Billing details: the plan a business chooses and the record of its payments. Card and mobile money details go directly to our payment provider, and we do not see or store them.
• Business email: if a business turns on its Email inbox, the messages, attachments, addresses and settings of its mailboxes.
• Connected accounts: if a business connects Google Drive or OneDrive, the details in the Google Drive and OneDrive section below.
• Website use: if you accept analytics, the information in the Cookies and website analytics section below.

Why we use it

• To provide the service, including sending the messages and backups a business asks for.
• To keep accounts secure, prevent fraud and fix problems.
• To send important messages about your account and billing, such as password resets.
• To understand, if you accept analytics, how people use our public website.
• To meet legal obligations.

We do not sell personal data. We do not use business data, or anything from a connected Google or Microsoft account, for advertising or for our own marketing.

Google Drive and OneDrive

Connecting Google Drive or OneDrive is optional. A business's owner or admin switches it on under Settings, Backups, to keep copies of that business's backups in its own account.

When you connect Google Drive:

• What we ask for: the Google permission called drive.file, and nothing else. It lets Track Order MW work only with files and folders it created itself. It does not let us see, read or change anything else in your Google Drive.
• What we access: the email address of the Google account, so the screen can show which account is connected, and the folder named "Track Order MW backups" with the backup files we put there.
• What we do with it: we create that folder, upload the business's backup every night or every week as you choose, and delete older backup files we made, keeping the newest 7. We do nothing else in your Drive.
• What we store: the Google account's email address, the folder's ID, and an access token that lets the backups keep running. The token is encrypted.
• Who sees it: the owners and admins of that business. Our staff do not read files in your Drive, and we use the token only to run these backups. We do not share Google user data with anyone else, unless the law requires it.
• How to stop: choose Disconnect under Settings, Backups, and we delete the stored token and details. You can also remove our access at any time from your Google account, under Third-party connections. Backup files already in your Drive stay there, and are yours to keep or delete.

Track Order MW's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

OneDrive works the same way. We ask for a folder of the app's own, plus the account's email address to show which account is connected, and we cannot read anything else in the account.

A backup holds that business's records and files, including personal data of its customers. Once it is in your Drive or OneDrive, the business is responsible for keeping that account secure.

Business email

A business's Email inbox uses that business's own domain and its own account with our email provider, Resend. Mail sent and received there is stored in Track Order MW so the business's team can read and answer it. It is the business's data: we use it only to provide this service, and only the team members given an address can read that address. Platform staff do not read it, unless the business asks for help or the law or the security of the service requires it.

Backups

We keep encrypted backups of the whole system so it can be recovered after a failure. Each is normally kept for 14 days, and a weekly one for 90 days. Deleted data can remain in these backups until they expire. A business can also make its own backup, which it can download for 7 days.

Sharing

We share data only with the service providers that help us run the platform, and only what they need:

• Hosting, storage and backups: Railway and Cloudflare R2.
• Email: Resend.
• SMS and WhatsApp messages: SMS providers such as Africa's Talking, and Meta for WhatsApp.
• Payments for plans: PayChangu.
• Notifications on the staff app: Google Firebase and Expo.
• Website fonts and analytics: Google.

We also share data when the law requires it, or when a business asks us to, for example by connecting its own accounts. If our business is sold or merged, data may pass to the new owner under this policy.

Some of these providers store data outside Malawi. We choose providers that protect it, and we limit what they receive.

Cookies and website analytics

We use a small number of cookies and browser storage to keep you signed in and remember your choices. These are needed for the service to work.

Our public website may also use Google Analytics to count visits and see which pages are useful. It runs only if you accept it in the notice on the website, and only on those public pages: never inside the app, on a business's website or on a customer's tracking page. You can change your choice at any time from the link at the bottom of the website.

Keeping data safe

Data is encrypted in transit. Passwords are hashed, and access tokens and other sensitive secrets are encrypted at rest. Each business's data is kept apart, access is limited by role, two-step sign-in is available, and important changes are logged.

How long we keep it

While your account is active, and afterwards only as long as needed for legal, tax or security reasons. When an account is closed we delete its data, and it leaves our backups as they expire.

Your rights

You can ask to see, correct or delete your personal data, ask for a copy, or object to how we use it, by writing to [email protected]. You can also complain to the Malawi Communications Regulatory Authority. Customers of a business should contact that business first.

The service is for businesses and is not meant for anyone under 18.

Changes

We will post updates here and tell you about important changes.

Contact

Questions about this policy: [email protected].