Privacy policy.

XtraPush provides air shipping from the UK to Malawi and a UK tech shop, through xtrapush.co.uk and the XtraPush app for iOS and Android. XtraPush is a trading name of Xtrapush Gadgets Ltd, a company registered in England and Wales (company number 16938444), which is the controller of the personal data described here.

We are registered with the Information Commissioner's Office, registration reference ZC212815. Our address is 1 Deene Close, Corby, NN17 1HY. Contact us about anything in this policy at info@xtrapush.co.uk.

• Account details — your name, email address, password (stored only as a secure hash by our authentication provider), phone number and saved address.
• Order and shipment details — what you buy or ship, parcel weights and contents, your chosen collection point, delivery address, and the name and phone number of the person collecting or receiving a parcel if that is someone else.
• Payment records — the amount, method and status of each payment and the provider's reference. We never see or store your full card number; card details are entered on the payment provider's own page.
• Messages — anything you send us by email or WhatsApp, and reviews you choose to submit.
• Approximate location — the country your connection comes from, worked out from your IP address when you check out, so we can show payment methods that work where you are. We do not use precise (GPS) location.

We do not use advertising trackers, sell your data, or track you across other apps and websites. The app does not access your camera, microphone, contacts, photos or precise location.

• To provide what you ordered (contract): taking payment, shipping your parcel, preparing labels, and letting you collect it.
• To run your account (contract): sign-in, saved details and order history.
• To meet legal obligations: keeping financial records and responding to lawful requests.
• Legitimate interests: preventing fraud, keeping the service secure, and answering your questions.
• Marketing only if you have opted in; you can opt out at any time.

Only the providers needed to run the service, each under contract to protect it:

• Supabase — account sign-in and database hosting.
• Vercel — website and API hosting.
• Revolut — card payments.
• OneKhusa — bank and mobile-money payments in Malawi.
• XtraPush Wallet — if you choose to pay from your wallet.
• Courier partners — the recipient's name and phone number, where a parcel is moved on within Malawi (for example to Blantyre).
• Email delivery provider — to send receipts and account emails.

Some of these providers process data outside the UK. Where they do, the transfer is covered by UK adequacy regulations or the UK International Data Transfer Agreement / Addendum. Your shipment details necessarily travel to Malawi with your parcel.

Account details are kept while your account is open. Orders and payment records are kept for six years because UK tax law requires it; if you delete your account, your personal details are removed from those records first, so what remains no longer identifies you. Messages are kept for as long as needed to deal with your enquiry.

Under UK data protection law you can ask for a copy of your data, ask us to correct or delete it, object to or restrict how we use it, and ask for it in a portable format. Email info@xtrapush.co.uk and we will reply within one month.

You can delete your account yourself in the app or on the website at any time — see how account deletion works.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Our services are for adults. We do not knowingly collect data from anyone under 18.

If we change this policy we will update the date below, and tell you directly if the change is significant.