Privacy Policy

Effective October 24, 2026.

Who is responsible

GPI Marketplace is operated by Cheikhe Ahmadou Tidiane Tall in Georgia, United States. For privacy questions or requests, email bloatedticks@gmail.com. GPI is intended for adults aged 18 and over.

Information we process

Account and profile information includes your email, account identifier, name, country, roles, contact details you provide, profile photo, biography, languages, and terms acceptance. Marketplace records include trips, destinations, item descriptions and declared values, offers, deliveries, certification relationships, reviews, and payment/refund/payout references. User content includes messages, attachments, condition and handover photos, and support, dispute, and safety reports.

Stripe processes payment details, connected-account onboarding information, and identity-verification information when you use those services. GPI keeps payment references, amounts and statuses, connected-account details needed to operate payments, and verification results and references. Identity checks may involve government documents and facial images processed by Stripe; review the disclosures in the verification flow. Do not send identity documents or full card details in chat or support email.

If you enable notifications, we process a push token, installation identifier, language and delivery status. If you request an optional journey-country check, your device sends coordinates, accuracy and capture time to our server to check the country. Journey records store the country, check outcome, accuracy, time, and place or note you enter; exact coordinates are not shown to clients. This is not continuous background tracking. Our infrastructure and service providers may also process IP addresses, request metadata and operational/security logs.

Why we use information

We use information to create and secure accounts, display profiles and trips, connect participants, deliver messages and notifications, coordinate deliveries, process payments and verification, handle disputes and support, prevent abuse, comply with legal duties, and maintain the service. Where applicable, the legal bases are performing our agreements, legal obligations, legitimate interests in operating and protecting the marketplace, and consent when required for optional permissions or provider checks. Device permissions can be changed in device settings.

Who can receive it

Relevant profile, trip, delivery and communication information is shared with marketplace participants as needed for the service. Public profile photos and information made available for discovery may be viewed by other users; do not upload sensitive documents as your avatar. Authorized administrators can review conversations and evidence for disputes, support and safety investigations. GPI does not promise end-to-end encrypted messaging.

Providers include Supabase for authentication, database and profile-photo storage; Google Cloud Storage for private files; Stripe for payments, connected accounts and identity verification; Expo and Apple/Google notification services for push delivery; and Cloudflare for the website. Providers process information under their applicable terms and may have independent legal duties. We may disclose necessary information to authorities, advisers or other recipients when lawfully required, to protect rights and safety, or in a lawful business transfer. GPI does not sell personal information or use it for third-party targeted advertising.

Retention and account deletion

You can initiate deletion in GPI under Menu > Account > Delete account, or request it without the app through our account-deletion page. Ownership must be verified. Open deliveries may need resolution first; contact support if the in-app process is blocked. Account deletion removes or anonymizes account/profile information and revokes sign-in. It is not a promise that every historical record disappears immediately.

Our approved retention policy is to delete ordinary personal data, including non-held messages and uploaded files, within 30 days of a verified deletion request. Necessary financial, transaction, consent and audit records are retained for five years from transaction completion or the relevant record date, subject to legal review and applicable obligations. Relevant evidence is retained while an unresolved delivery, refund, dispute, safety/fraud investigation or legal hold requires it; non-required evidence is scheduled for deletion within 30 days after the matter is resolved. We request Stripe Identity redaction and follow up on pending or failed requests. Providers may independently retain records where required by law.

Retention cleanup is being introduced with the store-readiness release. Until that rollout is verified, deletion of historical messages and stored files requires support follow-up. Contact us for the status of your request; we do not claim that the existing in-app button alone erases all associated data.

Your choices and rights

Depending on your location, you may have rights to access, correct, delete or obtain a copy of your information, restrict or object to certain processing, withdraw consent where applicable, and complain to your local data-protection authority. Contact us from your registered email where possible. We verify requests proportionately and respond within applicable legal deadlines. Withdrawing permission or deleting an account does not remove legal recordkeeping duties or existing delivery obligations.

Security and international processing

We use access controls and encrypted network connections, but no service is completely secure. Information may be processed in the United States or other countries where our providers operate. Where applicable, international processing must use legally required safeguards. Do not send passwords, verification codes or full payment details to support.

Changes and contact

We update this policy when practices change and provide notice where required. Contact bloatedticks@gmail.com for privacy requests or assistance in English or French.