1. Operator and status of this notice
Superup is operated by Luma Chrisparr Ngale Jomia, Bonduma Gate, Buea, South West Region, Cameroon. Privacy questions can be sent to lumajomia7@gmail.com · +237 673 014 202 or through Contact support in My account.
This is a review draft dated 9 October 2026. It describes the current app implementation and identifies decisions to confirm before a final privacy notice takes effect. It is not a claim that all legal or operational requirements have already been met.
2. Information you provide
- Account: name, email, account identifiers, language preferences and authentication information. Password-based sign-in is handled through Supabase authentication.
- Delivery: recipient name, phone number, address, city, region and optional map coordinates.
- Orders and payments: purchased items, order status, wallet balances and transactions, payment references and Mobile Money numbers supplied for top-ups.
- Seller and courier details: shop information, pickup locations, listings, product images, vehicle details, payout destination references and earnings.
- Support and delivery evidence: information in support requests and photos uploaded as delivery proof.
Do not send your Mobile Money PIN or unnecessary identity documents through support or uploads.
3. Location and device permissions
Choosing “Use my current location” asks for location permission to help select a map pin. You can enter or select a location manually. Saving a buyer address pin does not continuously follow the buyer.
Courier map features can share location during an active delivery to support tracking. The current app uses foreground location; this notice does not claim continuous background tracking. Photo-library access is used when you choose an image to upload. You can manage permissions in device settings.
4. Why information is used
The app uses information to authenticate accounts, maintain profiles, manage seller and courier access, fulfil orders, coordinate deliveries, verify and reconcile payments, maintain wallet records, provide support and protect the service from misuse.
The final notice must identify the applicable legal ground for each purpose, including consent where required, performance of the service, legal obligations and any other grounds permitted by law. Optional permissions must remain separate from agreement to the terms.
5. Sharing with other people and providers
- Sellers and couriers: relevant order, pickup and recipient details are made available to fulfil or deliver orders, according to the participant’s role.
- Fapshi and Mobile Money operators: the top-up amount, payer phone number and payment identifiers are used to request and verify payment.
- Supabase: authentication, database, file storage, server functions and real-time services support the app.
- Google Cloud Translation, when configured: seller product text may be sent for translation. Sellers should avoid placing personal information in that text.
- Map services: maps use OpenFreeMap/OpenStreetMap-related resources and MapLibre assets delivered through a CDN. These providers may receive network request information, and map requests may reveal the displayed area.
- Website hosting: the website host may process request and security logs when you visit this site.
Access by authorised staff may be needed for support, dispatch, fraud prevention and accounting. Disclosures to authorities must have a valid legal basis. The final notice must confirm the complete provider list and contractual arrangements.
6. Storage, international processing and security
The current Supabase project is hosted in the European region (eu-west-1). Other provider processing may occur outside Cameroon. The operator must confirm locations and any requirements for cross-border transfers before launch.
The implementation includes authenticated access controls, role-based database permissions and server-side payment credentials. These measures do not make a system risk-free. Final operational controls, staff access, incident handling and notification procedures still require confirmation.
7. Retention and deletion
Order, payment and accounting records may need to be retained for legal duties, dispute resolution or reconciliation even after an account is closed. Addresses already linked to orders cannot simply be removed from historical order records. Delivery proof images and courier location records also need defined retention limits.
A final retention schedule must specify periods or clear criteria for each category and implement deletion accordingly. No specific deletion deadline or automatic account-erasure feature is promised in this draft.
8. Your requests and choices
You can edit supported profile fields and delivery addresses in the app, and change device permissions. Contact lumajomia7@gmail.com · +237 673 014 202 to request access, correction, account closure, deletion or raise a privacy concern. The final process must support the rights available under applicable law and explain any lawful limits, identity checks and response deadlines.
Account deletion is not currently a self-service app feature. The operator must establish and verify a support-led process before advertising a deletion service. A complaint route to the competent authority should be added to the final notice.
9. Website cookies and local app storage
This information website contains no analytics script, advertising tracker, newsletter signup or customer data submission form. It uses local images and styles. Hosting infrastructure may still use security-related mechanisms or logs; confirm the host’s behavior before final publication.
The app stores authentication sessions and local preferences, favourites, cart state and payment retry information as needed for its features. This storage is different from advertising tracking. New analytics, marketing or non-essential cookies would require a reassessment and, where applicable, a separate choice.
10. Children and future changes
The intended minimum account age and safeguards for younger users must be set before launch. This draft does not claim an age-verification system exists. Updated features, providers or purposes will require an updated notice and any consent or notification required by law.