Legal

Privacy Policy

Last updated: May 2026

1. Controller

PODFY
EU · Western Europe
Contact: [email protected]

This privacy policy applies to delivery.podfy.net — the recipient-facing delivery portal where drivers and consignees can view proof-of-delivery (POD) documents linked to their email address.

2. Categories of personal data we hold

• Email address — the address you use to sign in and that carriers use to send you POD copy emails.
• IP address — collected on login token requests and session creation for abuse prevention.
• User-agent string — collected with login tokens for security diagnostics.
• Login timestamps — when magic links were requested and when sessions were created.
• POD documents — the proof-of-delivery files linked to your email, which may contain:
  • Delivery address and consignee name
  • Signer name and signature image
  • Delivery photos
  • GPS co-ordinates (if captured by the driver's device)
  • Date and time of delivery

3. Sources of your data

Your email address and POD documents were originally collected by PODFY tenant customers (the carriers and logistics companies that use the PODFY platform) when they processed a delivery to you or involving you. Those tenants uploaded the POD data and shared your email address as part of their normal delivery notification workflow.

PODFY receives that data as a data processor on behalf of each tenant, and stores it to allow you — the recipient — to access your own delivery history via this portal.

4. Lawful basis for processing

• Art. 6(1)(b) GDPR — contract performance: processing your delivery information is necessary to provide the POD portal service to the carrier and, by extension, to you as recipient.
• Art. 6(1)(f) GDPR — legitimate interest: retaining delivery proofs serves a legitimate interest in resolving delivery disputes for both carriers and recipients.

5. Retention periods

• Free tier: delivery records are available for 60 days from the delivery date.
• Paid tenant plans: the carrier may have purchased extended retention of 1 to 7 years. In that case your records remain accessible for the duration of their plan.
• Login tokens: expire after 15 minutes and are purged within 6 hours of expiry.
• Sessions: expire after 7 days of inactivity and are purged by automated cron.
• On deletion request: your personal data will be deleted within 30 days unless overridden by a legal retention obligation (e.g. commercial code requirements in your jurisdiction).

6. Sub-processors

• Cloudflare, Inc. — hosting, database, object storage, and network (EU Western Europe region, WEUR). Data does not leave the EU region under normal operation.
• Resend, Inc. — transactional email delivery (magic-link emails). Only your email address and the login URL are passed to Resend.

7. Your rights under GDPR

As a data subject you have the following rights. To exercise any of them, email [email protected]. We will respond within 30 days per Art. 12(3) GDPR.

• Right of access (Art. 15): request a copy of all personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten").
• Right to data portability (Art. 20): receive your data in a machine-readable format.
• Right to restriction (Art. 18): request that we restrict processing of your data.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to lodge a complaint: you may complain to your national supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens.

8. Cookies and local storage

This portal uses one session cookie named pfy_delivery_session. It is set after a successful magic-link login and is:

• HttpOnly — not accessible to JavaScript
• Secure — only sent over HTTPS
• SameSite=Lax — allows the first request from a magic-link email click
• Expires after 7 days of inactivity

We also use localStorage for your colour-mode preference (podfy-delivery-theme). This contains no personal data and is never transmitted to our servers.

No analytics cookies, no marketing cookies, no third-party tracking.

9. Contact

For all privacy requests: [email protected]
For data deletion specifically: [email protected] — subject: Data deletion request