Privacy Policy

LokaliConnect is a local commerce platform serving towns across Rivers State, Nigeria. We connect customers with local businesses for food ordering and delivery, and with dispatch riders for deliveries and rides.

The data controller is [Legal entity name], registered at [Registered business address]. When we say "we", "us" or "LokaliConnect" in this policy, we mean that entity.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA).

What we hold depends on how you use the platform.

Everyone with an account

• Your name, email address and phone number
• Your WhatsApp number, which we derive from your phone number so we can send you order updates
• Your password — stored only as a cryptographic hash by our authentication provider. Nobody at LokaliConnect can read it.
• Your role on the platform: customer, vendor, rider or admin

If you order food

• What you ordered, from which business, and what you paid
• Your delivery address as you typed it, and the map pin you set if you chose to set one
• The contact phone number you gave for that order
• A record of the order's progress through each status, and if it was cancelled or refunded, when and by whom
• Addresses you explicitly choose to save for reuse, with the label you give them
• Ratings and any written comments you leave after delivery

If you book a ride

• Your pickup and destination, as addresses and as coordinates
• The distance, estimated duration and fare for the trip

If you are a vendor

• Your business name, address, description and photograph
• Your opening hours
• Your bank name, account number and account name. We need these to create your Paystack subaccount so you can be paid. We do not use them for anything else.

If you are a rider

• Your vehicle registration number
• Whether you are currently online and available for jobs
• Your location — see section 3, which covers this in detail
• Which jobs you were offered, and whether you accepted or declined

If you join the waitlist

• Your email address, and nothing else

Held on your device, not by us

• Your shopping cart is stored in your own browser and never sent to us until you check out.
• A session cookie keeps you signed in. It is necessary for the platform to function and is not used for advertising.

Delivery and ride booking cannot work without knowing where places are. In a town where many buildings have no street number, we also improve our own map from how the service is actually used. This section explains that honestly.

When we ask for your device location

We request location access only when you are doing something that needs it — booking a ride, or setting a delivery pin. You can refuse and still use the platform: type an address instead, or place a pin on the map by hand. We do not ask for location permission simply because you opened the app.

Riders, and continuous tracking

This is the most significant collection we do, so we want to be direct about it. When a rider goes online, the app records their position continuously, including while the app is in the background, so that we can offer them the nearest jobs and show customers where their delivery is. We record position, accuracy, speed and heading.

This happens only while a rider is online. Going offline stops it. We keep these detailed movement trails for 30 days, after which they are deleted automatically.

Improving the map

When a delivery or ride completes, we record the coordinates involved and what the location was called, so the platform learns where real places are. Over time this builds a local map that works better than commercial ones for this area. Locations confirmed by several independent trips become part of our searchable map.

These records currently include an internal reference to the account that produced them, so we can tell whether two reports are genuinely independent rather than the same person twice. That reference is never shown to other users and never leaves the platform.

If you contribute a place

If you add a place our map does not know, we keep what you submitted and, where a contribution reward applies, a record of that reward and its payment status.

We use your information to:

• Create and run your account
• Take orders, process payments, and issue refunds
• Get your order or ride to the right place
• Send you order and delivery updates over WhatsApp
• Match riders to nearby jobs
• Let you and your rider contact each other about a live order
• Show ratings so other customers can judge a business
• Improve our map of the local area
• Detect and prevent fraud and abuse
• Meet our legal, tax and accounting obligations

Our lawful bases are: performance of a contract for anything needed to fulfil your order or ride; consent for device location access, which you can withdraw at any time in your device settings; legal obligation for financial records; and legitimate interests for fraud prevention and improving the map.

We do not sell your personal data. We share it only with the following, and only as far as each needs to do its job.

To run the service

• The business you ordered from — your name, order contents, delivery address and contact number.
• Your rider — your delivery address, map pin and contact number, for the duration of that job. Riders cannot see your order history or other customers.
• You, about your rider— a rider's name, phone number and vehicle details are visible to you only while they are carrying your job.

Service providers

• Supabase — database, authentication and file storage. They host essentially all of the data described above.
• Paystack — payment processing and refunds. Your card details go directly to Paystack and never touch our servers. For vendors, Paystack also holds bank details for payouts.
• Meta (WhatsApp Business Cloud API) — delivers our order and dispatch notifications. Meta receives the phone number being messaged and the message content.
• Vercel — hosting. Receives standard request logs, including IP addresses.

Loaded directly by your browser

When you use a map, your device contacts these services itself, which means they receive your IP address and the area you are looking at. We do not control this and receive nothing from it.

• OpenStreetMap — map images, and address lookup when you drop a pin.
• OSRM — calculates the driving route and distance for fare estimates.
• Google Maps — only if you tap a link to open a drop-off pin in Maps. Nothing is sent unless you tap it.

Otherwise

We may disclose information where the law requires it, to enforce our terms, or to protect the rights and safety of users. If our business is sold or merged, data may transfer with it — you would be told beforehand.

Financial records are kept for as long as Nigerian tax and accounting law requires, even after an account closes.

Under the NDPA you have the right to:

• Ask what personal data we hold about you, and get a copy
• Have inaccurate information corrected
• Ask us to delete your data, subject to records we must keep by law
• Object to, or ask us to restrict, certain processing
• Receive your data in a portable format
• Withdraw consent at any time — including revoking location access in your device settings
• Complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data

To exercise any of these, contact us using the details in section 11. We will respond within 30 days. We may need to verify your identity first, so that nobody else can request your data.

• All traffic between your device and our servers is encrypted.
• Passwords are hashed, never stored in a readable form, and cannot be recovered by anyone here.
• Database access rules mean each account can only reach its own records. A customer cannot read another customer's orders, and a rider's location is visible only to that rider, administrators, and the customer whose job they are carrying.
• Card details are handled entirely by Paystack.

No system is perfectly secure. If a breach occurs that puts your rights at risk, we will notify you and the NDPC as the law requires.

LokaliConnect is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the service changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will tell you directly rather than relying on you to notice.

For any question about this policy, or to exercise your rights:

• Email: lokaliconnect@gmail.com
• WhatsApp: message us
• Postal address: [Registered business address]
• Data Protection Officer: [Name and contact, if appointed]

You can also reach us through our contact page.