Privacy policy · Oyanau

Draft for review. Items in [brackets] must be completed, and the whole document checked by a Nigerian lawyer, before launch.

This policy explains what personal data Oyanau collects, why, who we share it with, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). Oyanau is operated by [Company legal name], [RC number], [registered address] ("Oyanau", "we").

What we collect

Account details: your email address, and the name you give us.
Contact details: the phone number you add at checkout, so the rider or vendor can reach you about your order.
Delivery addresses: addresses you type or save, and the area they are in.
Location: only when you tap "Use my current location". We use it in your browser to find your nearest delivery area; we don't store your coordinates.
Orders: what you ordered, from whom, prices, fees, promo codes, timestamps and status. Your 4-digit delivery code is visible only to you and our operations team.
Messages: what you send us through the contact form.
Preferences: whether you want offers by email or SMS (off unless you turn them on).
Technical data: cookies and browser storage that keep you signed in and remember your delivery area, basket and theme.

Why we use it, and our lawful basis

To deliver your orders (contract): sharing your name, phone and address with the vendor and rider handling your order.
To keep the service safe (legitimate interest): preventing fraud, resolving disputes and checking delivery codes.
To support you (contract and legitimate interest): answering messages and fixing problems.
To send offers (consent): only if you opt in under Preferences. You can opt out at any time.
To meet legal duties (legal obligation): tax, accounting and lawful requests from authorities.

Who we share it with

Vendors and riders, only what they need for your order: your name, phone number, delivery address and order items. Riders never see your delivery code.
Service providers who host and run Oyanau for us under contract: Supabase (database and sign-in) and Vercel (website hosting). [List payment and SMS providers when added.]
Authorities, when the law requires it.

We don't sell your personal data.

International transfers

Some of our providers store data outside Nigeria. Where they do, we rely on the safeguards the NDPA allows, such as contractual protections. [Confirm hosting regions and transfer basis.]

How long we keep it

Account data for as long as your account is open. Order records for [6] years for tax and accounting. Contact messages for [2] years. Saved addresses until you delete them, which you can do at any time from the delivery address menu.

Your rights

You can ask to access, correct, delete or move your data, object to or restrict how we use it, and withdraw consent for offers. To make a request, contact us and choose "Privacy and my data". We reply within 30 days. You can also complain to the Nigeria Data Protection Commission (NDPC).

Security

Data is encrypted in transit. Access inside our database is restricted by row-level rules so customers, vendors and riders only see what they need. No system is perfectly secure; if a breach affects you, we'll tell you and the NDPC as the law requires.

Children

Oyanau is for people aged 18 and over. [Confirm age limit.]

Changes

We'll post changes here and update the date above. For significant changes, we'll tell you by email.

Contact

Data protection contact: [Name or role], [email address]. Or send us a message.