Who we are
Doorstep ("we", "us") is a grocery and take-away delivery service in Maseru, Lesotho, trading as Doorstep Deliveries and operated by Softserve Digital Solutions. We are responsible for the personal information described here. You can reach us about anything in this policy at support@softserve.co.ls.
What we collect and why
| Information | Why we need it |
|---|---|
| Your name and email address, and the account identifier Google or Apple gives us when you sign in with them | To create your account, sign you in, and send you order emails. We never see your Google or Apple password. Apple may give us a private relay address in place of your real one. |
| A password, if you sign in with email | To sign you in. We store only a salted one-way hash of it, never the password itself. |
| Your phone number | So the courier and our operations team can call you about a delivery, and for WhatsApp updates if you ask for them. |
| Delivery address, landmark and delivery notes | So the courier can find you. |
| Precise location, only when you tap Use my location on an order | To pin your delivery point for the courier and work out the delivery fee from the distance to the shop. The app does not read your location at any other time and never in the background. |
| Your orders: the shop, the items and notes, the amounts, the courier assigned and the history of each order | To buy and deliver what you asked for, show you your orders, and keep the records a business must keep. |
| Payment details: the method you chose, the amount and whether it was paid. For M-Pesa or EcoCash, the mobile number you paid from and the payment reference | To collect payment and match it to your order. Doorstep does not take card payments and never sees your mobile money PIN. |
| Whether you agreed to WhatsApp updates, and when | So we only send WhatsApp messages to people who asked for them. |
| Crash reports and performance data: device model, operating system, app version and your Doorstep account number | To find and fix faults in the app. These reports never contain your address, phone number or order contents. |
Who sees your information
Doorstep's shoppers and operations team see your orders and contact details so they can buy your items, price the basket and arrange delivery. Staff sign in with organisation accounts and only those given an operations role can open orders.
Your courier receives your first name, phone number, delivery address, landmark, notes and location pin for the delivery they are carrying. Couriers are drivers on Leeto, the ride and delivery network also run by Softserve Digital Solutions.
The shop sees only the items being bought, at its till, in the same way as for any other shopper.
Service providers that run parts of the service for us, and may use your information only to do so:
- Microsoft Azure, which hosts the Doorstep app's servers and database in its South Africa North region.
- Softserve Comms, which sends our order emails and password codes, and WhatsApp messages through Meta for customers who asked for them.
- Softserve Payments, which handles M-Pesa and EcoCash payments with Vodacom Lesotho and Econet Telecom Lesotho once those payments are switched on.
- Sentry, which receives the crash reports described above.
- Google and Apple, when you choose to sign in with them.
We may also disclose information where the law requires it, or where it is needed to protect someone's safety. We do not sell personal information, and the app carries no advertising or advertising trackers.
How long we keep it
We keep your account and saved details for as long as you have an account. Order records are kept for as long as we are required to keep business and tax records. When you delete your account, the orders stay in our books without your name, phone number, email address, delivery address or location.
Deleting your account
In the app, open Account and tap Delete account. Your account, your sign-in details and your saved information are deleted straight away, and an order that has not been started is cancelled. If an order is being shopped or delivered, the app asks you to wait until it has arrived. You can also ask us by email; the account deletion page explains both ways and what is kept.
Your rights
You can ask to see the personal information we hold about you, to correct it, to have it deleted, or to object to how we use it, under Lesotho's Data Protection Act, 2011. Write to support@softserve.co.ls from the email address on your account and we will answer within 30 days. You can correct your name and phone number yourself in the app at any time.
Security
Everything between the app and our servers travels over HTTPS. The database is encrypted at rest. Passwords and sign-in tokens are stored only as one-way hashes, and a sign-out ends your session on every device. Access to customer information is limited to the people who need it to run deliveries.
Children
Doorstep is for adults. You must be 18 or older to create an account.
Changes to this policy
If we change this policy we will update the date at the top of this page, and tell you in the app or by email if the change affects how we use information you have already given us.
Contact
Doorstep Deliveries, operated by Softserve Digital Solutions, Maseru, Lesotho. Email support@softserve.co.ls.