Legal Document

Privacy Policy

We are committed to protecting your personal data and your right to privacy.

Effective: June 1, 2025 Updated: June 19, 2026 ~8 min read
🔒

Your privacy matters. This Privacy Policy explains how CaRide ("we", "our", "us") collects, uses, shares, and protects your information. By using CaRide, you agree to the terms described here.

1. Overview

CaRide is a ride-hailing platform connecting passengers ("Customers") with independent drivers ("Drivers") across Nigeria. We operate the Customer mobile application, Driver mobile application, and supporting backend infrastructure.

This Privacy Policy applies to all users and complies with the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA) 2023.

2. Information We Collect

2.1 Information You Provide

  • Account Registration: Name, email address, phone number, and password.
  • Profile: Profile photo, gender (optional), and contact preferences.
  • Driver Onboarding: Government-issued ID, driver's licence, vehicle registration documents, vehicle details, and bank account details.
  • Payment Information: Card details (tokenised via PCI-DSS compliant processors), bank transfer info.
  • Communications: Messages sent via in-app chat or to our support team.

2.2 Information Generated Through Use

  • Location Data: Precise GPS location while the app is actively in use (foreground only for Customers).
  • Ride Data: Pickup/destination, route, duration, distance, fare, and status updates.
  • Device Information: Device type, OS version, unique identifiers, IP address, and app version.
  • Usage Data: Feature interactions, session times, error logs, and crash reports.
  • Transaction Records: Wallet balances, payment history, and commission records.
  • Ratings & Reviews: Ratings and feedback you give or receive.

2.3 Information from Third Parties

  • Payment verification data from processors (Paystack, Stripe).
  • Map and routing data from Google Maps Platform.
  • Identity verification data from KYC providers (for Drivers).

3. How We Use Your Data

  • Service Delivery: Match Customers with Drivers, process requests, enable navigation, and complete trips.
  • Payments: Process payments, manage wallets, disburse driver earnings.
  • Account Management: Create, verify, and manage accounts; authenticate identity on login.
  • Safety & Security: Detect and prevent fraud, investigate suspicious activity, enforce anti-fraud policies.
  • Customer Support: Respond to inquiries, resolve disputes, and handle reports.
  • Notifications: Push notifications and emails for ride status, bids, driver arrival, and platform news.
  • Platform Improvement: Analyse usage patterns, diagnose technical issues, improve performance.
  • Legal Compliance: Comply with applicable laws and enforce our terms of service.
  • Promotions: Manage referral codes, promo credits, and reward distributions.

4. Sharing of Data

We do not sell your personal data. We share data only in these limited circumstances:

  • Between Customers and Drivers: Driver name, photo, vehicle details, and rating shared with matched Customer. Phone numbers shared in masked format only.
  • Service Providers: Trusted third-party vendors (cloud hosting, payment, mapping, analytics, KYC) — contractually bound to handle data securely.
  • Legal Requirements: Disclosure to law enforcement or courts when required by law.
  • Business Transfers: In the event of a merger or acquisition, subject to equivalent privacy protections.

5. Location Data

  • Customers: Precise location accessed only while the app is in the foreground (active use). We do not collect background location data from the Customer app.
  • Drivers: Foreground location accessed while logged in and active. Background location may be requested only when the Driver enables "Online" mode and explicitly grants permission.
  • Location data is transmitted securely and retained only as long as needed to complete and verify the trip.
  • You may revoke location permissions at any time in device settings, though this will prevent core functionality.

6. Data Retention

  • Account Data: Retained for the lifetime of your account and up to 6 months post-deletion.
  • Trip Records: Retained for up to 3 years for financial audit and dispute resolution.
  • Payment Data: Retained per financial regulations and PCI-DSS requirements.
  • Driver Verification Docs: Retained for up to 5 years per Nigerian transport regulatory obligations.

When data is no longer required, it is securely deleted or anonymised.

7. Data Security

  • All data transmitted over HTTPS with TLS encryption.
  • Passwords stored using strong one-way hashing.
  • Payment card data tokenised and processed by PCI-DSS compliant providers.
  • Internal access to personal data restricted to authorised personnel on a need-to-know basis.
  • Regular security reviews and audits conducted.

In the event of a breach, we will notify affected users promptly in accordance with applicable law.

8. Your Rights

Under the Nigeria Data Protection Act (NDPA) 2023, you have the right to:

  • Access — Request a copy of your personal data.
  • Correction — Request correction of inaccurate or incomplete data.
  • Deletion — Request deletion of your account. See our Account Deletion page.
  • Objection — Object to processing activities such as marketing.
  • Restriction — Request restricted processing in certain circumstances.
  • Portability — Request your data in a structured, machine-readable format.
  • Withdraw Consent — Withdraw consent at any time where processing is consent-based.

Contact privacy@caride.ng to exercise your rights. We'll respond within 30 days.

9. Children's Privacy

CaRide is not intended for persons under 18. We do not knowingly collect data from minors. If we discover a minor has registered, their account and data will be promptly deleted. Contact privacy@caride.ng if you believe a minor has registered.

10. Third-Party Services

11. Policy Changes

We may update this policy to reflect changes in our practices or applicable law. Material changes will be communicated via push notification, email, and an in-app notice. Continued use after the effective date constitutes acceptance.

12. Contact Us

Have a privacy question?

Our team responds within 24–48 hours.

Email Privacy Team