Privacy Policy

GalaxyGo (United States) is operated by Saint March, Inc., a California corporation ("Saint March", "we", "us"), the data controller. Customers in Honduras are covered by the Política de Privacidad of Galaxy Go, S. de R.L.

Last updated: July 26, 2026

This Privacy Policy explains how we collect, use, share and protect personal information when you use the GalaxyGo apps and websites (the "Platform"). By using the Platform, you agree to this Policy.

1. Information We Collect

• You provide — name, email, phone number, password (stored hashed), optional profile photo, delivery addresses and instructions, order details, and communications with support, Couriers and Merchants (including in-app chat). Payment method details are processed by our payment processor; we do not store full card numbers.
• Location data — precise GPS location (with your permission) to show nearby Merchants, enable delivery and track order progress. You can disable location in device settings, which may limit functionality.
• Device & usage data — device type, OS, app version, identifiers, IP address, log data, and interactions with the Platform.
• From third parties — payment confirmation from our processor; sign-in confirmation from authentication providers where enabled.

2. How We Use Information

• Provide and operate the Platform — create accounts, process and route orders, enable delivery and tracking.
• Process payments, subscriptions (GalaxyGo Pass), Wallet top-ups, transfers and refunds/credits.
• Communicate order updates, receipts, service notices and (with consent where required) marketing.
• Provide customer support, prevent fraud, enforce our Terms, and comply with legal, tax and accounting obligations.
• Improve and analyze the Platform.

3. How We Share Information

• Merchants — order details needed to prepare your order.
• Couriers — your name, delivery address and order details needed to deliver; your phone number may be masked through in-app calling/chat.
• Service providers / processors — Stripe (payments); Supabase (application database and hosting, United States); HERE Technologies (mapping, geocoding, address autocomplete); Google Firebase Cloud Messaging (push notifications); Meta Platforms / WhatsApp Cloud API (one-time verification codes); Resend (transactional email); Supabase Auth (authentication).
• Legal & safety — to comply with law, respond to lawful requests, or protect rights and safety.
• Business transfers — in a merger, acquisition or asset sale.
• We do not sell your personal information.

4. Payment Data

Card payments are handled by our payment processor (Stripe). We receive limited information such as a payment token, card brand and last four digits — not your full card number. The processor's handling of card data is governed by its own privacy policy and PCI-DSS standards.

5. Location Data

We use precise location to show nearby Merchants, calculate delivery and provide live order tracking. You may revoke location permission at any time in your device settings.

6. Data Retention

We retain personal information while your account is active and as needed to provide the Platform. We retain order, payment and tax records for 7 years to satisfy U.S. legal, accounting and tax obligations, after which we delete or anonymize it.

7. Security

We use administrative, technical and physical safeguards including encryption in transit, access controls and hosting on secured U.S. infrastructure. No system is perfectly secure; we cannot guarantee absolute security.

8. Your U.S. Privacy Rights (including California — CCPA/CPRA)

Depending on your state, you may have the right to know/access the personal information we hold, request deletion, request correction, and opt out of "sale" or "sharing" of personal information (we state we do not sell). We will not discriminate against you for exercising these rights. To exercise a right, contact [email protected] or use the in-app request. We will verify your identity before acting.

9. Children's Privacy

The Platform is not directed to children under 18 and we do not knowingly collect their personal information. If we learn we have, we will delete it.

10. International Data Transfers

The Platform's data is hosted in the United States. If you access it from outside the U.S., you understand your information will be processed in the U.S.

11. Marketing Communications

You may opt out of marketing emails/notifications at any time via the message's unsubscribe link or app/device settings. Transactional messages (order and account notices) are not optional while you have an account.

12. Account Deletion

You may delete your account in-app or by contacting us. On deletion we anonymize your personal data and disable login; certain records are retained in anonymized form as described in section 6.

13. Changes to This Policy

We may update this Policy; material changes will be notified in-app or by email and are effective upon posting (or as stated).

14. Contact

Saint March, Inc. — Privacy: [email protected] · Support: [email protected]