Privacy Policy

1. Who is responsible for your data

[COMPANY LEGAL NAME] (RC [RC NUMBER]), trading as BitBite Express, of [REGISTERED ADDRESS], is the data controller.

Contact for privacy questions and requests: [DPO/CONTACT], [CONTACT EMAIL].

Stores on BitBite receive the details they need to prepare your order (your first name, what you ordered and your notes). Businesses that give their staff a company account can see the orders placed on it.

2. What we collect

From everyone with an account: name, email, phone number, password (handled by our sign-in provider and never visible to us), the version of our terms you accepted and when, and your role (customer, rider, store or business).

When you order: pickup, drop-off and extra stop addresses and their map points, saved addresses, the names and phone numbers of the people at each stop, parcel descriptions, size, weight and declared value, food and shop items, notes, scheduled times, prices and fees, payment method, order history, ratings and comments, chat messages with the rider, store and our support team, and support requests. We don’t use your phone’s location; you choose addresses yourself.

People you send to: when you send a parcel to someone else, you give us their name and phone number. We use them to deliver and to text the delivery code and updates. Please tell them you’re using BitBite.

Payments: online payments go through OPay. We receive the payment reference, amount, status and the channel used (for example card or transfer), never your card number or PIN. For cash orders we record what the rider collected.

Riders: phone, home area, vehicle make, model, colour and plate; identity, licence and vehicle documents and photos you upload; bank name, account number and account name (checked with the bank before the first payout); earnings, cash held, ratings and trip statistics. Location: while you are online, the Rider app and rider web page share your location about every 30 seconds, including in the background in the Rider app (when the app is closed but you are still online). Sharing stops when you go offline. We use it to offer nearby jobs, show customers where their delivery is, check trips for safety, and settle disputes.

Delivery evidence: riders take photos at the pickup and drop-off, and we record the time and place of each step, which delivery or return code was used, and the name of anyone who received a delivery for you.

Stores: store and business details (including CAC number), location, opening hours, menu, the owner’s and staff’s contact details, and the owner’s bank account for payouts.

Business accounts: company name, RC number, industry, billing email, phone and address, and the names, emails and monthly budgets of the colleagues you invite.

Devices and technical data: a notification token if you turn on push notifications; a sign-in cookie that keeps you signed in; error reports when something breaks (the error, the page and the request type, without your account details); and, if enabled, anonymous page views (the page visited and a random ID stored in your browser, not linked to your account).

3. Why we use it, and our legal basis

The NDPA lets us use personal data only with a lawful basis. For each purpose:

“Contract” means we need the data to provide the service you asked for. “Legitimate interests” means we have a genuine business reason that we have weighed against your rights; you can object (section 7).

Automated decisions. Some things happen automatically: jobs are offered to the nearest suitable rider, cash on delivery is switched off after repeated cash no-shows, and stores are paused after repeated missed orders. You can ask for a person to review any of these.

4. Who we share it with

• Riders see the pickup and drop-off details, contact names and phone numbers and notes for orders they carry, only while they carry them.
• Stores see what you ordered, your notes and your first name.
• Customers see their rider’s name, phone number, rating, vehicle and plate number, location during the delivery, and the delivery photos.
• Your company, if you order on a business account: its admins see orders placed on the account.
• Service providers who process data for us under contract:
  • Supabase: database, sign-in and file storage (photos and documents)
  • Vercel: hosting of the website and web app
  • OPay: online payments, refunds, bank account checks and payouts
  • Termii: text messages (SMS)
  • Resend: email
  • Google: address search and road distances (Places and Routes); the addresses and map points you enter are sent to Google
  • Inngest: running background tasks such as dispatch, notifications and payouts
  • Expo, Google Firebase and Apple: push notifications to the Rider app; your browser’s push service for web notifications
  • Sentry: error monitoring
  • PostHog: anonymous page-view counts
• Authorities such as the police, courts or tax authorities, when the law requires it or to protect someone’s safety.
• A buyer or successor if BitBite’s business is sold or merged, under the same protections.

We do not sell your personal data.

5. Data stored outside Nigeria

Several of the providers above store or process data outside Nigeria, including in [CONFIRM: Supabase project region], the European Union and the United States. The NDPA allows such transfers only where the destination gives adequate protection or another lawful ground applies. We rely on [CONFIRM: data processing agreements with standard contractual clauses / other safeguards recognised by the NDPC] with these providers, and send them only the data they need. You can ask us for more detail about these safeguards.

6. How long we keep it

When a period ends we delete the data or remove what links it to you.

7. Your rights

Under the NDPA you can:

• Be informed about how we use your data (this policy).
• Access your data and get a copy.
• Correct data that is wrong or incomplete.
• Erase your data (delete your account). We will remove your personal details but must keep order, payment and accounting records for the period in section 6.
• Restrict how we use your data while a concern is looked into.
• Data portability: receive the data you gave us in a common machine-readable format, or have it sent to another organisation where technically possible.
• Object to our use of your data based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where we rely on it (for example push notifications or marketing), without affecting what we did before.
• Ask for human review of an automated decision that affects you.

How to use your rights: email [CONTACT EMAIL] or open a support request in the app. To delete your account, use “Delete your account” on your account page, or see Deleting your account. We may ask you to confirm your identity first. We respond without undue delay and within [CONFIRM: response period, e.g. 30 days], and it is free unless a request is clearly unfounded or excessive.

8. How we protect it

• Data travels encrypted (HTTPS). Passwords are stored scrambled (hashed) by our sign-in provider.
• Our database only shows each person their own records; staff access is by role and admin actions are logged.
• Rider documents and delivery photos are kept in private storage and opened through short-lived links.
• Delivery codes are shown only to the customer who placed the order.
• Messages from our payment provider are checked for a valid signature before we act on them.

No system is perfectly secure. If a breach puts your rights at risk, we will tell the Nigeria Data Protection Commission and, where required, you, as the NDPA requires.

9. Children

BitBite is not for children. You must be at least [18 — CONFIRM] to open an account. If we learn that we hold a child’s personal data without a parent’s or guardian’s consent, we will delete it. Contact us if you think this has happened.

10. Cookies and similar technology

• Sign-in cookies keep you signed in. They are needed for the app to work.
• If anonymous page counting is on, a random ID is stored in your browser so visits can be counted. It is not linked to your account.
• The product demo on our website keeps its simulated data in your browser’s storage.

We don’t use advertising cookies. You can clear cookies and site data in your browser at any time.

11. Complaints

Please contact us first at [CONTACT EMAIL] and we’ll try to put things right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.

12. Changes to this policy

We will update this policy when our services or the law change, show the new date at the top, and tell you in the app or by email about important changes. Our Terms of Service explain how you use BitBite.

13. Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Privacy contact: [DPO/CONTACT], [CONTACT EMAIL].