1. Who we are
Kora is a mobile-first freight marketplace for Ethiopia. Cargo owners post loads, verified carriers and drivers bid on them, and both sides manage the shipment from bid acceptance to proof of delivery inside the app.
The Kora platform is operated by Olyad Kassim Fite, a sole proprietorship registered in Ethiopia and trading as Kora ("Kora", "we", "us"). Kora is the data controller for the personal data described in this policy. Our offices and operations are in Addis Ababa, Ethiopia. Contact details are in section 18.
This policy applies to the Kora Android application, the Kora backend services, and any communication we send you in connection with your account.
2. Data we collect
We collect only what is needed to run a freight marketplace safely and to meet our legal obligations in Ethiopia.
- Account and contact data: name, phone number, email address, password (stored only as a salted hash), preferred language, and account role (cargo owner, driver, or fleet owner).
- Identity and verification data: photos of your national ID, driving licence, trade licence, business licence, or commercial registration certificate, plus the numbers printed on them. Drivers are also asked for vehicle details such as plate number, truck type, and capacity.
- Location data: the GPS position of your device, collected while the app is in use, to show nearby loads and to share a driver's live position with the matched cargo owner during an active shipment. See section 5.
- Shipment and transaction data: loads you post, bids you place or accept, agreed prices, pickup and delivery addresses, proof-of-delivery codes and photos, ratings, cancellation and detention records, dispute reports and the evidence you attach to them.
- Kora Credit and fee data: records of Kora Credit you buy through our licensed payment providers (Telebirr and Chapa), the Kora fees charged on your loads, receipt details, and your TIN where you provide it for receipts. Freight is paid by the cargo owner directly to the carrier; Kora never collects, holds, or pays out freight money. Kora does not store your card numbers or mobile-money PINs.
- Communications: in-app messages exchanged between matched cargo owners and drivers, and messages you send to our support team.
- Device and technical data: push-notification (Firebase Cloud Messaging) token, device model, operating system version, app version, IP address, and crash reports.
- Usage data: screens visited, loads viewed, bids placed, and similar in-app events, used in aggregate to improve the product.
We do not collect contacts, calendar entries, SMS content, call logs, microphone audio, or biometric data.
3. How we use your data
- To create and manage your account and to authenticate you, including one-time passcodes sent by SMS.
- To verify your identity and vehicle before you can post loads or bid on them, and to prevent fraud and misuse of the platform.
- To match cargo owners with drivers, show relevant loads and return-load suggestions, and form and record shipment agreements.
- To show a driver's live position to the matched cargo owner during an active shipment.
- To sell you Kora Credit through our licensed payment providers, charge Kora's own fees from it, and keep the corresponding records and receipts.
- To send transactional notifications about your loads, bids, payments, and account (for example "bid accepted" or "delivery approved").
- To handle disputes, cancellations, detention claims, and support requests.
- To retain electronic records required by Ethiopian law (see section 9).
- To diagnose crashes and improve the reliability and performance of the app, using aggregated or anonymised data wherever possible.
We do not use your personal data for third-party advertising and we do not sell it.
4. Legal basis
Under the Personal Data Protection Proclamation No. 1321/2024 we process your data on the following bases:
- Contract: processing necessary to provide the marketplace service you signed up for.
- Legal obligation: identity verification, tax invoicing, and record retention required by Ethiopian law.
- Legitimate interest: fraud prevention, platform integrity, and security, balanced against your rights and interests.
- Consent: optional features such as location sharing and push notifications. You can withdraw consent at any time through your device settings or the app, without affecting the lawfulness of processing before withdrawal.
5. Location data
Kora requests your device's location ("while using the app" only) for three purposes: to show loads and return loads near you, to let a driver share a live position with the matched cargo owner during an active shipment, and to let a fleet owner see the position of trucks on their own roster while those trucks are on an active shipment.
A driver's position is shared only while the driver has location sharing switched on in the app and only for the duration of an active load. Kora does not request background location permission and does not track you when you are not using the app.
Location history is retained for no more than 90 days and is then deleted. Location data is never sold and never shared with advertisers.
6. App permissions
| Permission | Why we ask for it |
|---|---|
| Location (precise and approximate, while in use) | Nearby loads, return-load suggestions, live shipment tracking, fleet map. |
| Camera and photos | Upload identity and vehicle documents, profile photos, and proof-of-delivery photos. Accessed only when you choose to take or pick a picture. |
| Notifications | Transactional alerts about bids, loads, payments, and your account. |
| Internet and network state | Communicate with Kora servers and detect weak or offline connections so the app can queue actions. |
You can revoke any permission in your device settings at any time. Some features will stop working until the permission is granted again.
7. Sharing your data
Kora does not sell personal data. We share it only in the following cases:
- Between matched users. Once a bid is accepted, the cargo owner and the driver can see each other's name, phone number, and the load details needed to complete the shipment. Fleet owners can see the position and shipment status of drivers on their own roster.
- With licensed payment providers. Telebirr (Ethio telecom) and Chapa, both licensed by the National Bank of Ethiopia, receive the data needed to process your Kora Credit purchases. Kora Credit is non-refundable prepaid credit for Kora's own service; freight payments never pass through Kora.
- With service providers who process data on our behalf under contract (see section 8).
- With authorities when required by Ethiopian law, a court order, or a lawful request from a competent regulator.
- In a business transfer. If Kora is reorganised or acquired, your data may be transferred to the successor, who will remain bound by this policy.
8. Service providers and cross-border transfers
We use a small number of sub-processors. Some are located outside Ethiopia, primarily in the United States.
| Provider | Purpose | Location |
|---|---|---|
| Google Firebase | Push notifications (Cloud Messaging) and crash reporting (Crashlytics). | United States |
| Google Gemini API | Advisory pre-check of uploaded identity documents to help our team spot unreadable or inconsistent submissions. The result never decides your verification on its own; a person always reviews it. | United States |
| Vercel | Hosting of the Kora backend and web services. | United States |
| Neon (on Amazon Web Services) | Hosting of the Kora database. | United States |
| OpenStreetMap Foundation or CARTO | Map tiles shown in the app. Your device requests tiles directly, so the tile provider receives your IP address and the map area viewed, under its own privacy policy. Kora sends it no account data. | United Kingdom (OpenStreetMap) / United States and Europe (CARTO) |
| AfroMessage | SMS one-time passcodes to Ethiopian numbers. | Ethiopia |
| Twilio | SMS fallback for numbers AfroMessage cannot reach. | United States |
| Telebirr, Chapa | Processing Kora Credit purchases. | Ethiopia |
Where personal data leaves Ethiopia, the transfer is made on a lawful basis under Proclamation No. 1321/2024 with appropriate safeguards, including a data processing agreement with each provider. Transfers of sensitive personal data are made only with the prior approval of the Ethiopian Communications Authority where the Proclamation requires it.
9. Data retention
- Shipment, settlement, invoice, and electronic agreement records are retained for as long as Ethiopian tax and commercial law requires, generally up to 10 years, in line with Art. 14 of the Electronic Transaction Proclamation No. 1205/2020. This applies even after you delete your account.
- Identity document images are removed when your account is deleted.
- Location history is kept for no more than 90 days.
- In-app messages are kept while the related shipment record is kept, so they remain available as evidence in a dispute.
- Crash and diagnostic data is kept for up to 90 days by Firebase Crashlytics.
- All other personal data is deleted or irreversibly anonymised when your account is deleted.
10. Account deletion
You can delete your Kora account at any time from inside the app: open Settings, choose Delete account, and confirm. If you can no longer sign in, you can request deletion by email instead. Full instructions and what happens to each type of data are on our account deletion page.
Deletion cannot be completed while you have a load in progress. Complete or cancel it first, then delete your account. When you delete your account, open loads you posted that have not been booked are cancelled and your pending bids are withdrawn.
11. Your rights
Under Proclamation No. 1321/2024 you have the right to:
- Access a copy of the personal data we hold about you.
- Rectify inaccurate or incomplete data. Most profile fields can be edited directly in the app.
- Erase your personal data, subject to records we are legally required to keep (section 9).
- Restrict or object to processing based on our legitimate interests.
- Port your data in a commonly used, machine-readable format.
- Withdraw consent at any time for processing that relies on consent.
- Complain to the Ethiopian Communications Authority (ECA).
To exercise any right, contact us using the details in section 18. We respond within 30 days and may ask you to confirm your identity first.
12. Automated decision-making
Kora uses automated logic to rank loads, bids, and return-load suggestions, and to run an advisory pre-check on identity documents. These tools support, but never solely determine, outcomes that significantly affect you. Identity verification is always confirmed by a person. You may object to automated processing and request a manual review by contacting us.
13. Security
Data is encrypted in transit using TLS 1.2 or higher and at rest by our hosting providers. Passwords are hashed with bcrypt. Electronic records carry tamper-evident SHA-256 checksums. Authentication tokens on your device are kept in the platform's secure storage. Access to personal data is limited to authorised Kora personnel on a need-to-know basis, and privileged administrative actions require a second approver and are logged.
14. Data breach notification
If a personal data breach occurs, Kora will notify the Ethiopian Communications Authority within 72 hours of becoming aware of it, and will inform affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
15. Children
Kora is a business service for adults. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.
16. Regulator and data protection contact
Data-protection requests are handled by Kora's privacy contact (section 18). A dedicated Data Protection Officer is being appointed and this policy will be updated with the DPO's contact details once the appointment takes effect.
Kora's registration as a data controller with the Ethiopian Communications Authority is in progress under Proclamation No. 1321/2024. This policy will be updated with the registration reference once it is granted. The ECA is the supervisory authority and you may lodge a complaint with it at any time.
17. Changes to this policy
We may update this policy as the product, our providers, or the law change. The "last updated" date at the top will change, and for material changes we will notify you in the app or by the contact details on your account before the change takes effect. The current version is always available at this address and inside the app under Settings.
18. Contact
- Data controller
- Olyad Kassim Fite, a sole proprietorship registered in Ethiopia, trading as Kora
- Registered address
- Malkaa, Dukem Town, Oromia Region, Ethiopia
- Operations
- Addis Ababa, Ethiopia
- vyaesop@gmail.com
- Phone
- +251 933 392 463