Privacy Policy

Version 2026-10-20 · Effective [effective date]

Draft — have a Nigerian data-protection lawyer review before launch. This is a starting template written around what the Naija Wash app actually collects and does. It is not legal advice. It is aimed at the Nigeria Data Protection Act 2023 (NDPA), which is enforced by the Nigeria Data Protection Commission (NDPC), and the NDPR/GAID instruments that continue under it. Things to settle with your lawyer: whether you must register with the NDPC as a data controller of major importance, whether you need to appoint a Data Protection Officer, a data-protection impact assessment, and the retention periods marked below. Fill in every highlighted [placeholder], then remove this box.

1. Who is responsible for your data

[COMPANY LEGAL NAME] (RC [RC NUMBER]), [REGISTERED ADDRESS] ("Naija Wash", "we") decides how and why your personal data is used and is the "data controller". Data protection contact: [DPO / PRIVACY EMAIL].

2. What we collect

Data	Why we need it	Legal basis
Account details: name, email, phone, password (stored only as a one-way hash)	To create and secure your account, confirm your email and phone, and contact you about bookings	Contract; consent for optional SMS
Location: the address, city and coordinates you give at signup or when booking; your device's location only if you press "Use my location"	To show Providers near you and let Providers find the job	Contract; consent for device location
Bookings: service, time, address, vehicle details, price, status, reviews you write	To run your booking, handle problems, and show reviews	Contract; legitimate interest (safety, fraud prevention)
Payment records: amount, status, payment reference. We do not receive or store your card number	To confirm payment, issue refunds, pay Providers, keep accounts	Contract; legal obligation
Photos: listing photos (public), job photos and dispute evidence (visible only to the people on that booking and our staff)	To show services and resolve problems	Contract; legitimate interest
Provider verification (KYC): full name, date of birth, gender, ID document photo and type, home address, CAC number, a short live face video and a still frame from it, bank account details (for payouts)	To check who is offering services and to pay them. ID photos are visible only to the Provider and our staff	Legitimate interest (preventing fraud and unsafe service); contract
Technical data: IP address, rate-limit counters, server logs, a sign-in token saved in your browser	To keep the service secure and working	Legitimate interest
Messages: in-app notifications, emails and SMS we send you (booking updates, reminders, security alerts)	To keep you informed about your bookings	Contract; legitimate interest

We do not knowingly collect data from anyone under 18, and we do not sell your personal data.

3. Who we share it with

The Provider (or customer) on your booking sees what they need to do the job: your name, the time, the address (for mobile services), vehicle details, and your phone if you've verified it for SMS updates.
Our payment partner (only if online payments are switched on) processes payments, splits them and pays Providers' banks. It is an independent controller of the payment data you give it.
Email and SMS providers ([Resend / Termii — confirm which you use]) receive the recipient's address or number and message text so they can deliver it.
AI service provider ([Anthropic — confirm; add its location and your data-processing terms]): when a customer reports a problem, the report text, the job details, the photos attached to it, and basic booking history are sent to an AI system so it can review the report. Nothing else from your account is sent.
Hosting and database providers ([hosting provider, region]) store the data on our behalf.
Google Fonts: our web pages load fonts from Google, which means your browser's IP address is sent to Google when a page loads.
Authorities where the law requires, or to protect rights and safety.

Some of these providers are outside Nigeria. When data leaves Nigeria we rely on the safeguards the NDPA allows (such as contract terms that give equivalent protection). [Lawyer: confirm the mechanism for each provider.]

4. How long we keep it

Account and profile data: while your account is open.
Payment and booking records: [X years — confirm with your accountant/lawyer; tax and accounting law requires records to be kept], even after you close your account, but stripped of your identity (see "Deleting your account").
Verification links and codes: they expire within minutes or hours and are stored only as hashes.
Dispute evidence and ID documents: deleted when your account is deleted.

5. Automated decisions

Reports about a job may be reviewed first by an automated assistant that can refund or close small, clear-cut cases without a person. It does not use your protected characteristics, and every decision is logged. You can always ask for a person to review an automated decision from My bookings. [Lawyer: confirm this meets the NDPA's rules on solely automated decisions and add the legal basis.] Providers may be warned or suspended by fixed rules if they repeatedly lose reports or leave refunded amounts unpaid; a person can reverse a suspension.

5A. Your rights

Under the NDPA you have the right to: know whether and how we process your data; get a copy in a common electronic format; correct it; have it erased; object to or restrict some processing; withdraw consent at any time (this doesn't affect what we did before); not be subject to decisions made only by automated means; and complain to the Nigeria Data Protection Commission.

Download your data and delete your account yourself from your account page.
Correct your details on the same page.
For anything else, contact [DPO / PRIVACY EMAIL]. We aim to reply within [30] days.

6. Deleting your account

You can delete your account unless you have bookings in progress or under dispute (or, for Providers, unsettled amounts owed to us). Deleting it removes your name, email, phone, address, location, photos, notifications and sign-in data, and removes your review text. We keep the financial record of past payments (amounts, dates, references) without your identity, because we must keep accounts. This cannot be undone.

7. Security

Passwords are hashed. Email and SMS codes are stored only as hashes and expire quickly. Access to private photos is limited to the people involved in the booking and our staff. Connections to our service should use HTTPS. We limit sign-in attempts and messages to reduce abuse. No system is perfectly secure; if there is a personal-data breach likely to put your rights at risk we will notify the NDPC within 72 hours of becoming aware, and tell affected people where required.

8. Cookies and similar storage

We do not use advertising or tracking cookies. Your browser stores a sign-in token (and a few display preferences) in local storage so you stay signed in. Clearing your browser data or signing out removes it.

9. Changes

If we change this policy in a meaningful way we will tell you and, where needed, ask you to accept it again.

10. Contact and complaints

[DPO / PRIVACY EMAIL] · [REGISTERED ADDRESS]. You can also complain to the Nigeria Data Protection Commission.