Privacy Policy

Information we collect

When you create an account or place an order, we collect:

• Your phone number, which is your login. A new account is verified with a one-time code we send to it by SMS.
• Your name and your email address. Your email address is required on your Account page. If you choose email as your sign-in method, the address you confirm is also saved there for you.
• Your delivery state and delivery address, if you add them to your account or enter them at checkout
• Your orders: what you ordered, the delivery date, the delivery address recorded on that order, the delivery fee and total, and the order's status
• Payment confirmation details for each order (amount, reference number and status). Not your card or bank details, which we explain below.
• Messages you send us through the support chat in the service
• Sign-in security details: the email address you chose for sign-in codes, and, if you use an authenticator app instead, an encrypted copy of its secret so we can check your codes
• Technical data: your network (IP) address, used for a short time, from minutes to a day, to limit abuse such as repeated sign-in attempts. We do not use it for advertising.

We do not collect your location from your device, your contacts, your photos, or any other files, and we do not use analytics or advertising tools.

On your device. The website keeps your cart in your browser's local storage, and the app keeps your cart in its own storage on your phone. Neither is on our servers until you place an order. The app also keeps your sign-in in your phone's secure storage so you stay signed in, until you log out.

Notifications (optional). If you turn on order-update notifications from your Account page, we keep a reference for that device so we can tell you when your order status changes: your browser's subscription reference on the website, or your phone's notification token (and whether it is Android or iPhone) in the app. Turning notifications off, or deleting your account, removes it.

How we use it

• To take, prepare, and deliver your order to the right address by the right morning
• To verify your identity when you sign in, using a code sent to your phone or email address, or from your authenticator app
• To contact you about an order: delivery updates, a problem with payment, or a question from the kitchen
• To answer the messages you send us
• To keep the service working: fraud prevention, limiting abuse of the sign-in system, and basic troubleshooting

We do not sell your information, and we do not use it for advertising.

Who we share it with

Only the companies that do a specific job for us:

• Paystack, to process payment. When you pay, your card or bank details go directly to Paystack on its own secure page. We never see or store them. We send Paystack the amount, an order reference, and your email address (or, if you have not given one, an address we generate from your phone number). We receive confirmation that a payment succeeded, for how much, and a reference number.
• Termii, to deliver the SMS that carries the one-time code for a new account.
• ProStack NG, our hosting provider, which stores the data described above on our behalf and sends the emails that carry your sign-in code.
• Google, in two ways: its mapping service receives your delivery address so we can work out the distance and the delivery fee, and its Firebase Cloud Messaging service delivers notifications to Android phones.
• Expo, whose service delivers notifications to the app and delivers app updates. It receives your phone's notification token, and the technical details any update request carries, such as the app version and your network address.

These companies act for us and do not use your information for their own purposes, except that Paystack, Google and Expo each handle data under their own privacy terms for the part of the job they perform. Some of them may process data outside Nigeria. We may also disclose information when the law requires it. We don't share your information with anyone else.

Cookies

On the website we use exactly one cookie: a session cookie that keeps you signed in, valid for 30 days or until you log out, whichever comes first. It's marked httpOnly and secure, meaning it can't be read by page scripts and is only ever sent over an encrypted connection. We don't use advertising or third-party tracking cookies. The app does not use cookies for sign-in; see "On your device" above.

How long we keep it, and deleting your account

We keep your account and order history for as long as your account is active, and for a reasonable period afterward for legitimate business and legal purposes, for example resolving a payment dispute or keeping records the law requires us to keep.

You can suspend or delete your own account any time from your Account page, in the website or the app. Suspending keeps everything as it is and blocks sign-in until you contact us to lift it. Deleting clears, immediately, your name, email address, sign-in email address, delivery state and saved address, and removes your notification registrations. What we keep after a deletion is your phone number, your order and payment records (including the delivery address recorded on each order), and the messages you sent to our support chat, for the business and legal reasons above. Once an account is deleted, that phone number cannot be used to sign in again unless you contact us.

The steps, and what to do if you can't sign in, are on our account deletion page.

Your rights

• You can see and update your name, email, state, and address any time from your Account page
• You can ask us what personal data we hold about you
• You can suspend or delete your own account any time, as described above
• You can log out at any time, in the website or the app
• You can complain to the Nigeria Data Protection Commission if you think we have mishandled your data

These rights come from Nigeria's Data Protection Act, which governs how businesses like ours handle personal data.

Children

The service is for people placing food orders and is not directed at children. We do not knowingly collect information from children.

Security

We use industry-standard practices to protect your information: encrypted connections, secured sign-in, authenticator secrets stored encrypted, and access controls on our systems. No system is perfectly secure, but we take reasonable steps to keep your data safe and will let you know if something ever goes wrong that affects you.

Changes to this policy

If we make a meaningful change to how we handle your information, we'll update the date at the top of this page. Significant changes will be communicated more directly, for example by SMS, in the app, or on the site.

Contact us

Questions about this policy or your data, or a request to see or delete it? Email us at [email protected], or message us on WhatsApp from your Account page.