Privacy Policy

OBAY ("we", "us", or "our") operates a community delivery platform that connects customers, local vendors, and delivery riders across Nigeria. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the OBAY mobile application and related services (collectively, the "Service").

By using our Service, you agree to the collection and use of information as described in this policy. This policy applies to all users of the OBAY platform — customers, vendors, and riders.

This policy complies with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023.

2.1 Information you provide directly:

• Account information: Full name, email address, phone number, and password when you create an account.
• Profile information: Date of birth, gender, delivery address, profile photo.
• Vendor information: Business name, business address, business category, business logo, banner image, CAC registration number, opening hours.
• Rider information: Vehicle type, vehicle plate number, National Identity Number (NIN), Bank Verification Number (BVN) for identity verification purposes.
• Payment information: Bank account details for withdrawal of earnings (vendors and riders). Card or payment details are processed directly by Paystack and are not stored on our servers.
• Communications: Messages or feedback you send to our support team.

2.2 Information collected automatically:

• Location data: GPS location is collected when you use the app — for customers to identify nearby vendors and set delivery addresses; for riders to enable real-time order tracking and navigation.
• Device information: Device type, operating system, unique device identifiers, and push notification tokens for sending order updates.
• Usage data: Pages viewed, features used, orders placed, and interactions within the app.
• Transaction data: Order history, payment references, delivery records, and earnings.

We use the information we collect to:

• Create and manage your account and provide the Service.
• Process orders, payments, and coordinate deliveries.
• Enable real-time order tracking between customers, vendors, and riders.
• Verify the identity of vendors and riders before approving them on the platform.
• Send push notifications about order status updates, promotions, and important service information.
• Process withdrawal requests for vendor and rider earnings.
• Detect and prevent fraudulent transactions and platform abuse.
• Improve the platform through analytics and usage insights.
• Respond to customer support inquiries.
• Comply with legal obligations under Nigerian law.

We do not sell your personal data. We share your information only in the following circumstances:

4.1 With other users (as necessary for the Service):

• Your name and phone number are shared with the assigned rider during an active delivery so they can contact you if needed.
• A rider's name and phone number are shared with the vendor when the rider is collecting an order.
• Your delivery area is shared with vendors when you place an order.

4.2 With third-party service providers:

• Paystack (paystack.com) — payment processing for orders and vendor/rider withdrawals. Paystack processes payment data under their own privacy policy.
• Appwrite — backend infrastructure, database, and authentication services. Data is stored securely on Appwrite's cloud infrastructure.
• Cloudinary — image storage for profile photos, vendor logos, and product images.
• Expo / Firebase — push notification delivery services.

4.3 For legal reasons:

We may disclose your information if required to do so by Nigerian law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights, property, or safety of OBAY, our users, or others.

OBAY requires access to your device's location to function properly. Specifically:

• Customers: Location is used to show nearby vendors, set your delivery address, and display your order on the tracking map. Location access can be revoked in your device settings, though this will affect your ability to use certain features.
• Riders: Location is continuously tracked during active deliveries to enable real-time tracking for customers and vendors. Location tracking stops when you go offline in the app.

We do not track your location in the background when the app is closed.

For rider and vendor verification, we collect sensitive personal data including NIN (National Identity Number) and BVN (Bank Verification Number). This data is:

• Collected solely for identity verification purposes.
• Stored securely and accessible only to authorised OBAY administrators.
• Not shared with third parties except as required for verification services.
• Handled in compliance with the NDPR 2019 requirements for sensitive personal data.

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account and profile data is retained while your account is active.
• Order history is retained for up to 5 years for financial record-keeping purposes.
• If you request account deletion, we will anonymise your personal data within 30 days. Order records may be retained in anonymised form for legal and financial compliance.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encrypted data transmission using HTTPS.
• Secure authentication with email verification.
• Role-based access controls — only authorised administrators can access sensitive user data.
• Secure payment processing via Paystack — we do not store card details on our servers.

No method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Under the Nigeria Data Protection Regulation, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your account and personal data.
• Restriction: Request that we restrict the processing of your personal data.
• Objection: Object to the processing of your personal data in certain circumstances.
• Portability: Request a copy of your data in a portable format.

To exercise any of these rights, please contact us at obayng@gmail.com. We will respond within 30 days.

You may also delete your account directly within the OBAY app via Settings → Account → Delete Account, which will initiate the data removal process.

OBAY is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account on our platform, please contact us at obayng@gmail.com and we will take steps to remove the account.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or via email. Your continued use of the Service after changes become effective constitutes your acceptance of the updated policy.

The date at the top of this policy indicates when it was last updated.

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us: