Privacy Policy
What data Peercel collects, why, who it is shared with, how long it is kept, and how to exercise your rights.
Last updated : 17 October 2026
This policy describes how personal data is processed for users of the Peercel mobile application and the www.peercel.com website. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and the equivalent laws of the African countries where the service is offered, including the APDP in Côte d'Ivoire, the CDP in Senegal and the NDPR in Nigeria.
It is published at a stable URL and versioned in our code repository: every change goes through review and leaves a dated record.
Data controller and contact
The data controller is NIDEN IT SAS, a French simplified joint-stock company with its registered office at 51 rue du Pré Brochet, 95110 Sannois, France.
- Postal address: NIDEN IT SAS, 51 rue du Pré Brochet, 95110 Sannois, France.
- Contact for any question about personal data, including requests to exercise your rights: privacy@send.peercel.com.
- General contact: contact@send.peercel.com.
Peercel has not appointed a data protection officer: the service meets none of the mandatory designation criteria of Article 37 GDPR. Privacy requests are handled by the team reachable at the address above, which replies within one month.
You may lodge a complaint with the French data protection authority (CNIL, 3 place de Fontenoy, 75007 Paris) or with the data protection authority of your country of residence.
Website analytics
The www.peercel.com website measures its traffic with Umami, a cookieless tool we host ourselves: no data is entrusted to a processor for this purpose. Nothing typed into the forms is recorded, the Do Not Track signal is honoured and the data is kept for 13 months. Details are in the cookie policy.
Data collected by the mobile application
The table below is the reference description of our processing activities. It is what must match, point by point, the Data safety declarations on our Google Play listing and the Privacy Nutrition Labels on our App Store listing.
| Data | Purpose | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Identity and contact details: first name, last name, gender, date of birth, profile photo, email address, phone number, postal address, account identifier | Create and manage the account, enable matching, contact the user about a delivery | Performance of the contract (Art. 6.1.b) | Peercel; database host; transactional email provider; other users, for the first name and profile photo | Lifetime of the account, then 30 days before permanent anonymisation; the profile photo is erased at anonymisation |
| Identity document: one file (identity card, passport, residence permit or driving licence) | Verify identity before sensitive operations, prevent fraud and impersonation | Legitimate interest in preventing fraud (Art. 6.1.f) | Peercel (manual review by an administrator, with no automated verification); file storage host | The file: lifetime of the account, then erased 30 days after the account is deleted. The verification result (document accepted or rejected, document type, review date): kept after anonymisation, detached from your identity, to establish that a verification took place in the event of a dispute |
| Location: declared departure and arrival cities; device position, if you allow it, when searching; position you choose to share in messaging | Suggest geographically compatible travellers and parcels, rank results by proximity, make it easier to arrange the handover meeting | Performance of the contract (Art. 6.1.b) | Peercel; database host; Mapbox (converting addresses into coordinates, displaying maps); the other party to the conversation, for a shared position | Search position: used for ranking, without being saved to your account; cities: lifetime of the listing; shared position: kept with the message containing it |
| Photos: parcel photos attached to the listing, photos taken at pickup, boarding and handover, evidence submitted in a dispute or attached to a support request | Describe the parcel, evidence its condition and its handover, investigate a dispute | Performance of the contract (Art. 6.1.b) | Peercel; the other party to the delivery; file storage host | Lifetime of the listing; 5 years for evidence filed in a closed dispute |
| Data you provide about other people: phone number of the parcel recipient (required); photo of the handover to the recipient, taken by the traveller | Send the recipient the parcel handover code by SMS; allow the traveller to reach them for delivery; prove the handover | Performance of the contract with the sender (Art. 6.1.b); legitimate interest in securing the handover, for the recipient (Art. 6.1.f) | Peercel; the traveller, to whom the number is revealed only once their arrival is confirmed; Africa's Talking and Twilio (SMS delivery) | Lifetime of the parcel listing, then erased when the sender's account is anonymised; 5 years for a photo filed in a closed dispute. The sender undertakes to inform the recipient of this processing |
| The sender's identity document, photographed by the traveller at parcel pickup and, where applicable, when the parcel is returned | Establish the identity of the person who handed over the parcel; serve as evidence in a dispute | Legitimate interest in preventing fraud and establishing liability (Art. 6.1.f) | Peercel (private storage, consulted by our team in a dispute); file storage host. This photo is not shown to other users | Until the delivery is closed; 5 years if filed in a closed dispute |
| Phone number and message content (one-time code) for sign-up, password reset and parcel handover | Verify the number, send the parcel pickup and handover codes | Performance of the contract (Art. 6.1.b) | Twilio and Meta (WhatsApp Business) for codes sent by WhatsApp; Africa's Talking and Twilio for codes sent by SMS. The sign-up or reset code is sent by WhatsApp first; you can ask to receive it by SMS instead. Meta receives your number and the message content, which contains only the code. The handover code is sent to the recipient by SMS | Lifetime of the account; the codes themselves expire within minutes |
| Agreement to receive notifications by WhatsApp, and the date of that agreement | Record your agreement to receive service notifications by WhatsApp. No notification is sent by WhatsApp at this time: if this service opens, only people who have agreed will receive them | Consent (Art. 6.1.a), withdrawable at any time from the notification preferences | Peercel; database host | Until consent is withdrawn or the account is deleted |
| Payment data: mobile money number entered to pay or withdraw; bank card; IBAN of the withdrawal account | Collect the sender's payment, pay out funds to the traveller | Performance of the contract (Art. 6.1.b) | Stripe (card, IBAN), Flutterwave and CinetPay (mobile money). The card number is entered in the Stripe payment module built into the app and sent directly to Stripe: Peercel neither receives nor stores it. The IBAN is entered on the form hosted by Stripe: Peercel keeps only its last four digits and the bank name. The mobile money number is sent to the provider; Peercel keeps it with the payment transaction, and only in masked form for a withdrawal | With the provider, under its own policy; at Peercel, with the financial records, 10 years under accounting obligations; the last four IBAN digits and the bank name: lifetime of the account |
| In-app messaging: content of conversations between sender and traveller (text, shared positions, proposed meeting places) | Allow the meeting to be arranged without exchanging personal contact details; serve as evidence in a dispute | Performance of the contract (Art. 6.1.b) | Peercel; database host. Message text is encrypted at rest | Lifetime of the account; content is replaced by a neutral placeholder at anonymisation |
| Questions asked in the app's Help section, language, suggested answer, "helpful" feedback, any support request opened | Find the answer in the FAQ, pre-fill a support request, improve the FAQ from unanswered questions. The search is run by our servers against the FAQ: no question is sent to an artificial intelligence service or to any third party | Legitimate interest in assisting users and improving the service (Art. 6.1.f) | Peercel; database host | Lifetime of the account; at anonymisation, the questions are detached from your account |
| Device push notification token | Send app notifications (offer received, payment confirmed, parcel delivered) | Performance of the contract (Art. 6.1.b) | Expo and the Apple (APNs) and Google (FCM) notification services | The last registered token is kept with the account and erased at anonymisation; it stops working as soon as the app is uninstalled |
| Crash reports and diagnostics: error trace, device model and operating system, app version, installation identifier generated by the Sentry module | Identify and fix defects in the application | Legitimate interest in maintaining a reliable service (Art. 6.1.f) | Sentry, hosted in the European Union. No name, email or phone number is attached to the reports | 90 days at Sentry; Peercel keeps no copy |
| Parcel and trip listings, delivery history, ratings and comments left, support requests | Publish listings, compute the trust level, display reputation, handle requests, arbitrate disputes | Performance of the contract (Art. 6.1.b) | Peercel; other users, for listings and the public part of the profile | 5 years; at anonymisation, your comments and the text of your support requests are erased, and ratings received by the people you dealt with remain, detached from your identity |
| Testimonials: first name, last initial, cities of departure and arrival, content of the review | Publish testimonials on the public website | Consent (Art. 6.1.a), withdrawable at any time | Public | Until consent is withdrawn, effective within 7 business days |
| Choice regarding marketing communications | Send you Peercel's newsletters and offers, only if you have agreed to it. They never include partner offers | Consent (Art. 6.1.a), withdrawable at any time from the app profile | Peercel; transactional email provider | Until consent is withdrawn or the account is deleted |
| Financial records: transactions, balance and balance movements, withdrawals | Keep the accounts, produce supporting documents | Legal obligation (Art. 6.1.c) | Peercel; payment providers; competent authorities upon valid legal request | 10 years under accounting obligations, with no early deletion possible |
Peercel does not collect: your contacts, your calendar, health data, political or religious opinions, sexual orientation, or any biometric data. No data is sold, rented or transferred to third parties for advertising purposes.
Mapping to the Google Play and App Store forms
The declarations made to the stores describe exactly the processing set out in the table above. Here is the mapping, category by category, with the Google Play "Data safety" declaration.
| Form category | Google Play — Data safety | App Store — Privacy Nutrition Label | Declared use |
|---|---|---|---|
| Location | Approximate and precise location — collected, linked to the user | Coarse Location, Precise Location — linked to identity | App functionality (geographic matching, handover meeting) |
| Personal info | Name, email address, user IDs, address, phone number, other info (date of birth, gender) — collected, linked to the user | Contact Info, Identifiers (User ID), Other Data — linked to identity | App functionality, account management, fraud prevention |
| Financial info | Payment info (optional: mobile money number, card entered in the built-in Stripe module, withdrawal IBAN), purchase history, other financial info (balance, withdrawals) — collected, linked to the user | Financial Info (Payment Info, Other Financial Info), Purchases — linked to identity | App functionality, accounting obligations |
| Messages | Other in-app messages — collected, linked to the user | User Content (Emails or Text Messages) — linked to identity | App functionality |
| Photos | Photos (profile photo, photos of the parcel and its handover, identity document) — collected, linked to the user | User Content (Photos or Videos) — linked to identity | App functionality, fraud prevention |
| App activity | In-app search history (questions asked in Help); other user-generated content (listings, reviews, testimonials, support requests) — collected, linked to the user | Search History, User Content (Other User Content) — linked to identity | App functionality, FAQ improvement |
| App info and performance | Crash logs, diagnostics — collected | Diagnostics (Crash Data, Other Diagnostic Data) | Fixing app defects |
| Device identifiers | Device or other IDs (Expo/FCM push notification token, Sentry installation identifier) — collected | Identifiers (Device ID) | App functionality (notifications), fixing defects |
| Data sharing | No data shared within the meaning of Google Play: every recipient listed below, Stripe Connect included, processes data on our behalf as a processor (GDPR Art. 28) | — | Not applicable |
| Advertising tracking | None — no advertising, no advertising ID, no data used for advertising. Marketing communications, sent only with consent, cover Peercel's own services | Data Not Used to Track You | Not applicable |
All data travels encrypted (TLS). You can request the deletion of your account and your data from the Delete my account page, without installing the application.
Processors and transfers outside the European Union
Peercel relies on the following processors. Each is bound by a data processing agreement compliant with Article 28 GDPR.
| Processor | Role | Processing location | Transfer mechanism |
|---|---|---|---|
| OVH | Application server hosting | France | No transfer outside the EU |
| Supabase | Database and file storage | European Union (EU region) | No transfer outside the EU for production data |
| Sentry | Error and crash reporting | European Union (EU region) | No transfer outside the EU |
| Resend | Transactional email delivery | United States | European Commission standard contractual clauses |
| Africa's Talking, Twilio | SMS delivery (verification codes and notifications); Twilio also delivers the codes sent by WhatsApp | Africa, United States | Standard contractual clauses |
| Meta Platforms Ireland Ltd (WhatsApp Business) | Delivery of one-time codes by WhatsApp | European Union and United States | EU–US Data Privacy Framework and standard contractual clauses |
| Stripe | Card payments, balance and withdrawals to a bank account (Stripe Connect) | European Union and United States | Standard contractual clauses |
| Flutterwave, CinetPay | Mobile money payments and withdrawals | Africa | Standard contractual clauses |
| Mapbox | Mapping and converting addresses into coordinates | United States | Standard contractual clauses |
| Expo, Apple, Google | Push notification delivery | United States | Standard contractual clauses |
Judicial or administrative authorities may receive certain data upon a valid legal request. No other sharing takes place.
Your rights and how to exercise them
You have the following rights over your personal data.
- Access and portability — obtain a copy of your data in a machine-readable format. The app offers a full export from your profile; you can also request it at privacy@send.peercel.com.
- Rectification — correct inaccurate data. Most fields can be edited directly in your profile.
- Erasure — request the deletion of your data. The procedure is described on the Delete my account page and does not require installing the app.
- Restriction and objection — request that processing be frozen, or object to processing based on our legitimate interest.
- Withdrawal of consent — where processing relies on your consent, withdraw it at any time, without affecting processing already carried out.
- Complaint — refer the matter to the CNIL or to the data protection authority of your country.
Any request sent to privacy@send.peercel.com receives a reply within one month, extendable by two months for complex requests, in which case you are informed. We may ask for proof of identity where there is reasonable doubt about who is making the request.
Some rights have limits: accounting records must be kept for ten years; they cannot be erased on request.
Retention, deletion and anonymisation
Retention periods appear in the table in section 2. They follow three rules.
- Account deletion. On a deletion request, the account is deactivated immediately: listings are withdrawn, sessions are closed, signing in is no longer possible.
- Anonymisation at day 30. Thirty days later, an automated job permanently overwrites identifying data: first name, last name, email, phone, address and date of birth are overwritten, the identity document file and the profile photo are erased, the notification token is deleted, the content of messages, comments and support requests is replaced by a neutral placeholder, the phone numbers of your parcels' recipients are erased and the questions asked in Help are detached from your account. This thirty-day window is deliberate: it allows a request made in error to be reversed, and an ongoing dispute or payment to be settled, before the data disappears.
- What remains after anonymisation. Financial records are kept for ten years under our accounting obligations, and audit logs for five years under our regulatory obligations, without directly identifying data. The identity verification result remains, without the document itself. Ratings received by the people you dealt with remain, detached from your identity, so their reputation is not distorted.
If a delivery is under way, if funds are still in escrow or if a dispute is open, the deletion is recorded but its execution is deferred until the situation is settled. You are informed of this in the support request opened by your confirmation.
Security
Passwords are stored hashed and are never readable by our team. Traffic between the app and our servers is encrypted in transit (TLS). Message text is encrypted at rest. Access by our team members to production data is individually attributed and recorded in a tamper-evident audit trail.
We will never ask you for your password, or for a one-time code, by email, by phone or in the app's messaging.
Updates to this policy
This policy is a versioned document: every change is reviewed and dated before publication, and the date of the last update appears at the top of the page.
| Version | Date | Changes |
|---|---|---|
| 1.0 | 28 August 2026 | First publication, alongside the launch of the public website and the submission of the applications to the stores. |
| 1.1 | 19 September 2026 | Registered office address. Added gender and profile photo, device position and positions shared in messaging, the Mapbox processor and consent to marketing communications. Accounting records retention extended to ten years. |
| 1.2 | 15 October 2026 | Removed the reference to anti-money-laundering rules, which do not apply to Peercel. Identity document: the file is erased 30 days after the account is deleted; only the verification result is kept. |
| 1.3 | 17 October 2026 | Aligned with the Google Play "Data safety" declaration. Payment data: exact description of what Peercel keeps (mobile money number, last four IBAN digits). Added questions asked in Help, sending of one-time codes by WhatsApp, with Meta (WhatsApp Business) as a processor, agreement to WhatsApp notifications, the parcel recipient's phone number and the sender's identity document photographed at pickup. Identity document: a single file, reviewed manually. Removed photos in messaging, which the app does not send. Clarified retention of the notification token and crash reports. |
Where a substantial change occurs — a new purpose, a new processor outside the European Union, a longer retention period — users are informed in the application before it takes effect.