Privacy Policy

Information you give us

• Account details: your full name, phone number, an optional email address, and a password. Your password is stored only as a one-way hash; we cannot read it.
• Verification codes: the one-time codes we send you by SMS (and by email, if you gave one) to verify your account and reset your password.
• Orders: the items you order, the Business, the order type (dine-in, pickup or delivery), table numbers, notes, and the time and status of each order.
• Delivery addresses: the addresses you save, the map pin you drop, and the directions you type for the rider (for example a gate or landmark).
• Payment details: the payment method you choose (Mobile Money, card or cash), the mobile money number you pay from, and the payment status and reference. Card payments are completed on our payment partner's page; we do not store your full card number.
• Tax identification number (TIN): only if you give one so that a Business can issue a receipt in your name or your company's name.
• Credit account information: if a Business opens a credit account for you, the account, credit limit, invoices, payments and balance held for that Business.

Information collected automatically

• Device and notification data: a push notification token for your device, your notification settings, and the notifications we send you about your orders.
• Location: your location is used only when you choose to place a pin on the map or search for an address for delivery. We do not track your location in the background.
• Technical and security data: server logs such as your IP address, device type, app version, request times and errors, used to keep the service secure and working.

Information from other sources

• Businesses: a Business may record you as a customer (for example a name or phone number a waiter enters, or a credit account an accountant opens for you).
• Payment partners: confirmation that a payment succeeded or failed, with its reference.

We use your information to:

• create and secure your account, verify your phone number, and let you sign in and reset your password;
• send your order to the Business, show its progress, and tell you when it is ready or on its way;
• calculate and show delivery fees from the road distance between you and the Business;
• process and confirm your payments, and keep a record of each payment;
• issue receipts and invoices, including receipts that are signed with the Rwanda Revenue Authority (RRA);
• send service messages by SMS, email and push notification, such as verification codes, order updates and payment confirmations;
• detect fraud and abuse, protect the platform, and fix problems;
• meet our legal, tax and accounting obligations; and
• improve the app and how it performs.

We do not use your information for advertising and we do not sell it. We send you service messages only, not marketing, unless we ask for your permission first.

Rex Plus is responsible for your account and for the platform that runs the app (your login, saved addresses, notifications and security).

Each Business is responsible for its own records of you, such as the orders you placed with it, the receipts and invoices it issued you, and any credit account it gave you. These records belong to the Business, which uses Rex Plus to keep them. A Business decides how long to keep them, within the law, and must treat them in line with Rwandan data protection law.

We share personal information only as described here.

• The Business you order from. It receives your name, phone number, order, delivery address and directions, payment status, and any TIN you gave. Its staff (for example waiters, kitchen staff, managers and accountants) see only what they need for their role.
• RRA. Receipts are signed with the Rwanda Revenue Authority's electronic billing system (EBM). The data sent includes the Business, items, amounts and taxes, and the customer's TIN if one was given.
• Payment partner. We use XentriPay to process Mobile Money and card payments. It receives the amount, your payment number and the order reference.
• SMS and email providers. Your phone number and message are passed to our SMS provider (Pindo) and, if you gave an email, to our email provider, so we can deliver codes and updates.
• Map provider. We use Geoapify to display maps, search addresses and measure road distance for delivery fees. The address or coordinates you search for are sent to it.
• Push notifications. Notifications are delivered through Expo's notification service, together with Apple and Google's services.
• Hosting and infrastructure providers that store and process data for us under our instructions.
• Authorities and advisers, when the law requires it or to protect our rights, our users or the public, and professional advisers bound by confidentiality.
• A successor, if Rex Plus is merged, sold or reorganised. We will tell you if this changes who holds your data.

Our service providers may only use your information to provide their service to us. We do not sell or rent your personal information.

Under Rwanda's law on the protection of personal data and privacy (Law No. 058/2021), we rely on:

• Your agreement, which you give when you create an account and accept these terms;
• Performing our contract with you, to run your account and carry out your orders and payments;
• Legal obligations, such as tax, accounting and fiscal receipt rules; and
• Our legitimate interests, such as keeping the platform secure and preventing fraud, where these do not override your rights.

We protect your information with measures that include encrypted connections, hashed passwords, expiring sign-in sessions, access limited by role, and separation between Businesses so that one Business cannot see another's records. We also limit how often sign-in and code requests can be made, to resist guessing.

No system is perfectly secure. Keep your password and verification codes private, and never share a code with anyone: Rex Plus will never ask you for it. If you believe your account has been accessed without your permission, contact us at once. If a data breach affects your rights, we will notify you and the authorities as the law requires.

• Account data (login, saved addresses, notifications, device tokens) is kept while your account is open and is removed when you delete your account.
• Verification codes expire within minutes and are removed after use or expiry.
• Order, receipt, invoice, payment and credit records are business and tax records. Businesses keep them for the period the law requires. They are not erased when you delete your account.
• Fiscal data sent to RRA is kept as long as tax law requires.
• Security logs are kept for a limited time and then deleted.

You have the right to:

• Access the personal information we hold about you;
• Correct information that is wrong or incomplete;
• Delete your account from the Profile screen in the app;
• Object to or restrict certain uses, and withdraw your agreement where we rely on it;
• Receive a copy of your data in a common format, where this applies; and
• Complain to the supervisory authority for data protection in Rwanda, the National Cyber Security Authority (NCSA).

Deleting your account

You can delete your account from your Profile screen. We remove your login and your app data: saved addresses, notifications, device tokens and sign-in codes. You are signed out everywhere.

Deletion is refused while you have an open order or you owe money at a Business, so please finish your orders and settle any balance first. Your credit accounts at Businesses are paused.

Businesses keep their own records of your past orders, receipts and invoices, and the name, phone number and email on those records, so that their sales, tax and accounting records stay accurate. If you sign up again with the same phone number, you start with a new, empty account; your old history is not linked back to it.

To use your other rights, email us at privacy@rexplus.rw. We may need to confirm who you are first, and we will answer within a reasonable time and as the law requires.

Notifications

You can turn push notifications off in your phone settings. You will still receive verification codes by SMS and, if you gave an email, by email, because you need them to secure your account.

Rex Plus is not intended for children under 18, and we do not knowingly collect their information. If you believe a child has created an account, contact us and we will delete it.

Our servers and some of our providers (for example messaging, maps and notification services) may be located outside Rwanda. When we transfer personal information abroad, we do so as the law allows and we require the receiving provider to protect it.

We may update this Privacy Policy. When we make an important change we will notify you in the app or by message, and we will update the "Last updated" date above. If you keep using Rex Plus after a change takes effect, you accept the updated policy. If you do not agree, you can delete your account.

For privacy questions or requests, email privacy@rexplus.rw. For help with your account or an order, email support@rexplus.rw.