How the system handles what it is given.
This describes platform design, not a compliance certificate. Six areas where the system makes a deliberate choice about data.
Payments
Stripe is the sole payment processor. Card details are never handled by Scorto's own systems, which keeps card data out of scope for the platform and inside Stripe's PCI-DSS environment.
- Subscriptions, per-delivery charges, and courier payouts all run through Stripe
- Retailer wallet balances are reconciled against Stripe sessions
- Cash-on-delivery amounts are tracked as obligations between courier and retailer
Location data
Courier position is tracked during active deliveries so retailers can see progress and the platform can detect route deviation. It is operational data with an operational lifetime.
- Tracking is tied to an accepted delivery, not to a courier's day
- Location is transmitted over TLS and stored encrypted
- Route history supports dispute resolution and performance review
Proof of delivery
The courier photographs the order at the door. That photograph is the evidence a dispute is judged on, so it is retained against the consignment rather than discarded on completion.
- Attached permanently to the consignment record
- Available to the retailer and to Scorto
- Used as evidence in refund and dispute review
Contact details
A courier receives the customer's phone number only after accepting the delivery, and only for the duration of that delivery. The platform is designed so contact data is not accumulated.
- Released on acceptance, not on job posting
- Scoped to the delivery in progress
- Communication logs are available to the retailer for dispute review
Access control
Three roles with three different views. A courier cannot see deliveries they have not accepted; a retailer cannot see another retailer's orders; a franchise operator sees their territory.
- Role-based access control across every surface
- Multi-factor authentication for administrators
- Session expiry and automatic logout
GDPR
Scorto is built for the European and UK market, so data protection is a design constraint rather than a later adaptation. The specifics of controller and processor responsibilities are set out in the Privacy Policy.
- Data minimisation is built into the contact-sharing design
- Encryption in transit and at rest
- Franchise operators handle local data subject requests within their territory
Retention
Stated as durations before launch. Location data has an operational lifetime and we will say exactly how long it is.
Sub-processors
- Supabase
- Database, authentication and file storage, including proof-of-delivery photographs
- Stripe
- Payment processing, wallet balances and courier payouts
- Google Maps
- Routing, live traffic and location
- Cal.com
- Booking calendar, on the contact page only
What the evidence looks like.
A refund claim is settled against the record rather than against whoever argues hardest. The photograph taken at the door, the time it was taken, and how close the courier was to the address are attached to the consignment permanently, available to you, and to us when we review a dispute.
- Proof photograph
- Captured at door, 19:42
- Location at capture
- Within 12 m of address
- Retained
- Attached to record
Illustrative interface. Depicts the retailer portal, not a screenshot.
Customer states the order did not arrive
- Proof photograph
- Captured at door, 20:47
- Location at capture
- Within 9 m of the address
- Route
- Direct, no deviation flagged
- Delivered
- 20:47, three minutes early
Illustrative interface. Depicts the retailer portal, not a screenshot.
Further reading
The legal detail behind this page sits in the Privacy Policy and Terms of Service.