Privacy Policy

Last updated: [DATE]

This policy explains what personal data GoCart collects, why, who it's shared with and your rights under the Nigeria Data Protection Act 2023 (NDPA). The data controller is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Contact us about privacy at [PRIVACY EMAIL].

1. What we collect

DataWhere it comes fromWhy we need it
Name and emailGoogle sign-in or the email you enterYour account, order emails, support
Phone numberYou enter itSo riders can call you at delivery
Delivery area, landmark and address detailsYou enter themTo price and deliver your order
Location pin (optional)Your phone, only when you tap "Use my location"To find your area and guide the rider
Orders, ratings and support requestsYour use of the appTo fulfil orders, handle refunds and complaints, and improve GoCart
Payment detailsOur payment partnerTo take payment. We see the payment status and amount, not your full card number
Wallet and refund recordsYour ordersTo keep track of your GoCart credit and payouts
Bank account for wallet payouts (optional)You enter itTo send your GoCart credit to your bank
Device and usage dataYour browserTo keep the app secure and fix problems

2. Our legal bases

  • Contract: to create your account, process and deliver orders, and handle refunds.
  • Legal obligation: to keep financial records and respond to lawful requests.
  • Legitimate interest: to prevent fraud, keep the app secure and improve our service.
  • Consent: for your location pin and for offers and news emails. You can withdraw consent at any time without affecting your orders.

3. Who sees your data

  • Vendors see your order items and delivery area only, not your phone number or exact landmark.
  • Your assigned rider sees your name, phone number, area, landmark, address details and location pin (if given), only for that order.
  • Service providers who process data for us under contract: [Supabase] (database and hosting), [Vercel] (website hosting), [Resend] (email), [Monnify / Moniepoint] (payments), and [Google] (sign-in, if you use it).
  • Authorities, where the law requires it.

We don't sell your personal data.

4. Data stored outside Nigeria

Some of our service providers store data on servers outside Nigeria. Where this happens, we rely on the safeguards the NDPA allows for cross-border transfers, such as contractual protections with those providers.

5. How long we keep it

  • Account data: while your account is open, and up to [12] months after you close it.
  • Order, payment and refund records: [6] years, for tax and accounting.
  • Location pins: kept with the order they were used for.
  • Support requests: [2] years after they're resolved.

6. Your rights

Under the NDPA you can ask us to:

  • give you a copy of your personal data, or send it to another service;
  • correct inaccurate data (you can edit your name and phone in Account);
  • delete your data, subject to records we must keep by law;
  • restrict or object to how we use it;
  • withdraw consent you've given.

You can also complain to the Nigeria Data Protection Commission (NDPC). Contact us at [PRIVACY EMAIL] or use Account → Delete my account. We'll respond within [30] days.

7. Security

We protect your data with access controls that limit each person to only what they need, encrypted connections, and trusted providers. If a data breach is likely to put you at risk, we'll tell you and report it to the NDPC as the law requires.

8. Cookies and storage on your device

GoCart stores small amounts of data in your browser, such as your sign-in session, cart and chosen delivery area, so the app works. We don't use advertising cookies.

9. Children

GoCart is not intended for children under 18 using it without a parent or guardian. We don't knowingly collect data from children.

10. Changes

We'll post updates here with a new date and tell you by email or in the app about significant changes.