Plain-English Summary
→
We collect only what we need to run your deliveries.
→
We never sell your data.
→
Card payments are handled entirely by Stripe — we never see your card number.
→
Courier GPS is only tracked during active deliveries.
→
You can request deletion of your account and data at any time.
Owleh Ltd ("Owleh", "we", "us", "our") is a parcel delivery platform registered in England and Wales. Our registered address is London, United Kingdom.
We operate the Owleh web platform and mobile application (collectively, the "Services"), which connect businesses with independent couriers for same-day parcel delivery across Greater London.
We collect information you provide directly when creating an account or placing a delivery order. This includes your name, business name, email address, phone number, and address.
When you add a payment method, your card details are processed and stored securely by Stripe, our payment processor. Owleh never stores raw card numbers.
We collect delivery data including pick-up and drop-off addresses, parcel dimensions, recipient contact details, and delivery instructions.
Our courier app collects location data from couriers during active deliveries. This data is used to provide real-time tracking to senders and proof of delivery. Location collection stops when the delivery is completed.
We automatically collect technical information such as IP address, browser type, and pages visited when you use our web platform, for security and performance purposes.
To provide and operate our Services — matching your delivery requests with available couriers, processing payments, and sending notifications about your orders.
To verify courier identity and eligibility as part of our onboarding process.
To send transactional emails such as delivery confirmations, invoices, and password reset links. We do not send marketing emails without your explicit consent.
To investigate disputes, enforce our Terms of Service, and comply with our legal obligations.
To improve our platform by analysing aggregated, anonymised usage patterns.
We process your personal data under the UK GDPR and the Data Protection Act 2018. Our legal bases are:
Contract — processing is necessary to perform the delivery contract between you and Owleh.
Legitimate interests — improving our platform, preventing fraud, and maintaining security.
Legal obligation — complying with applicable laws and regulations.
Consent — where we ask for your opt-in, such as marketing communications.
Couriers — we share your pick-up and drop-off address, delivery instructions, and your first name with the courier assigned to your delivery. We do not share your financial information with couriers.
Recipients — basic sender information may be shared with the parcel recipient where required to complete the delivery.
Service Providers — we use trusted third parties including Stripe (payments), SendGrid (email), Google Maps (routing), and Firebase (push notifications). Each operates under its own privacy policy and data processing agreement with us.
Legal requirements — we may disclose your information where required by law, court order, or to protect the rights and safety of Owleh, its users, and the public.
We do not sell your personal data to third parties.
We retain your account data for as long as your account is active. If you close your account, we delete your personal data within 90 days, except where we are required to retain it for legal or financial compliance purposes (typically up to 7 years for financial records).
Delivery records including proof-of-delivery photos are retained for 12 months from the delivery date, then permanently deleted.
Courier location data captured during a delivery is retained for 12 months to support dispute resolution.
Under UK GDPR you have the following rights regarding your personal data:
Right of access — you may request a copy of the personal data we hold about you.
Right to rectification — you may ask us to correct inaccurate or incomplete data.
Right to erasure — you may ask us to delete your data, subject to legal retention requirements.
Right to restriction — you may ask us to limit how we process your data in certain circumstances.
Right to portability — you may request your data in a structured, machine-readable format.
Right to object — you may object to processing based on legitimate interests.
To exercise any of these rights, contact us at privacy@owleh.com. We will respond within 30 days.
Our web platform uses cookies solely for authentication (storing your session token in localStorage) and for embedded third-party services such as Google Maps. We do not use advertising or cross-site tracking cookies.
You can disable cookies in your browser settings, but doing so will prevent you from logging in to the platform.
We use industry-standard security measures including HTTPS/TLS encryption in transit, bcrypt password hashing, JWT-based authentication with short expiry access tokens, and role-based access controls.
While we take security seriously, no system is completely secure. If you believe your account has been compromised, contact support@owleh.com immediately.
Our infrastructure and third-party processors (Stripe, SendGrid, Google) may process data outside the UK. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the Information Commissioner's Office (ICO).
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last updated" date below. Continued use of our Services after the effective date constitutes acceptance of the revised policy.
For privacy enquiries, data subject requests, or to report a concern:
Email: privacy@owleh.com
Postal: Owleh Ltd, London, United Kingdom
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled.