Privacy policy

Who is responsible for your data

Sendbud decides how and why your personal data is used, so we are its data controller. Sendbud is a business name registered with the Corporate Affairs Commission of Nigeria (registration no. BN 3692661), Lagos, Nigeria.

For anything about your data, email privacy@sendbud.app.

This policy follows Nigeria's Data Protection Act 2023. If you are in the European Union, the General Data Protection Regulation (GDPR) also applies.

What we collect

Your account

• Your name and email address.
• Your mobile phone number, once you confirm it, and when you did.
• Your password, stored only as an argon2id hash. Nobody at Sendbud can read it.
• When you signed up.
• Your sign-ins: a hash of each sign-in token (not the token itself), when it started and when it expires.

Identity verification

Everyone verifies before posting trips, sending or accepting requests, or paying. For this we keep:

• Codes texted to your phone: Termii's reference for each code, the number it went to, when it was sent, when it expires and how many times it was tried. Never the code itself.
• For each identity check: its status, why it failed if it did, when it started and finished, Dojah's reference for it, and which version of the consent wording you agreed to and when.
• What the check confirmed: your first, middle and last name, your date of birth, the type of ID (such as NIN or passport) and the country that issued it, and the last 4 characters of the ID number.
• A fingerprint of your ID number: a keyed one-way hash (HMAC-SHA256) that lets us spot the same ID on two accounts. It can't be turned back into the number.
• If a check or a bank account goes to our team, their decision and note, and anything you tell us about it.

We never store your selfie or video, photos of your ID, NIN slips or your full ID number, and we never ask for your BVN. Nigeria's NIMC rules forbid keeping NINs, and we don't.

Trips and deliveries

• Trips you post: where from and to, the travel date, spare weight and any note.
• Requests you send or receive: the item description, weight, reward and status, who cancelled and when, and when the sender confirmed the item isn't prohibited.
• Chat messages, with the time they were sent.
• Ratings and comments you give.

Payments

• For each payment: Paystack's references, the amounts and fees, the status, when it was paid, and Paystack's reason if a card was declined.
• Refunds and payouts: the amount, status and Paystack's references.
• Travellers' payout accounts: the bank, the name on the account, the last four digits of the account number and Paystack's code for the account. Paystack checks and keeps the full account number; we don't store it. We compare the name on the account with your verified name, and record whether it matched or our team approved it.
• Card details go straight to Paystack on its checkout page. We never see or store card numbers.

Technical data

• Server logs: your IP address, the time, the page or address requested, details your browser sends such as its type and version, the response, and your account ID if you're signed in.
• To stop abuse, we count recent sign-ins and other actions per IP address, email address and account. These counts are kept in memory only and are forgotten within about an hour.

When you contact us

• Your email address and what you send us.

We don't ask for your device's location, and apart from the identity check's result we don't get data about you from other companies or social networks.

How we use it, and why we may

The law only lets us use your data when we have a lawful basis. Ours are:

• To provide Sendbud (our contract with you): running your account, showing trips, passing requests and messages between sender and traveller, taking payments, and making refunds and payouts.
• To keep Sendbud safe (our legitimate interests): preventing fraud and abuse, keeping our systems secure, fixing problems, enforcing our Terms of service, and dealing with reports and disputes. This is also why everyone verifies a phone number and their identity, why we check that people are 18 or over, why one ID can only verify one account, and why travellers are paid only into an account in their verified name.
• Your selfie (your explicit consent): a selfie used to check your face is biometric data, which the law treats as sensitive. Before the selfie step starts we ask you to tick a box agreeing to it; the box starts unticked, and we record the wording you agreed to and when. Dojah takes the selfie, checks it is of a live person, and compares it with the photo on your ID or in its official record. You can withdraw your consent by not starting or not finishing the check, but without verifying you can't post trips, send or accept requests, or pay.
• To meet our legal duties: keeping payment and accounting records, and answering lawful requests from authorities.

We only email you about your account, your deliveries and changes to our terms, not marketing.

Identity verification is decided automatically from the check's results: whether your ID was found, whether your selfie passed and matched it, and your age. So is whether a bank account's name matches your verified name. If either refuses you, you can try again, or ask for a person on our team to look at it by emailing support@sendbud.app. Checks that the system isn't sure about go to our team.

Who can see your data

Other Sendbud users

• Anyone, signed in or not, can see trips you post, with your name, your average rating and how many ratings you have.
• The sender and traveller on a request see each other's name, the request details and their chat.
• Your email address, phone number, ID details and bank details are never shown to other users. They see a Verified badge once you have passed identity verification. A sender sees whether the traveller has been paid, not where.

Companies that help us run Sendbud

They only use your data to provide their service to us.

• Paystack (Nigeria) processes payments, refunds and payouts. It receives the sender's email address, the amount and the card details entered at checkout, and the traveller's bank, account number and account name. Paystack's own privacy policy covers its checkout page.
• Dojah (Dojah Technologies Limited, Lagos, Nigeria) runs the identity check, in a window from Dojah inside our verification page. It receives the ID number and any ID photos you give it, your live selfie, and your IP address and device details, and may ask your browser for your location, which you can refuse. It checks a NIN with NIMC's records, or reads and checks a passport, and keeps what it collects under its own privacy policy and its agreement with us. Dojah says it keeps one-way fingerprints (hashes) of faces and ID numbers to warn businesses about possible fraud, and not the selfie or ID images themselves.
• Termii (Nigeria) texts the codes that confirm your phone number. It receives your phone number and the code it sends.
• Hetzner (Germany) hosts our servers, database and backups.
• Cloudflare (United States) runs our domain name and forwards email sent to @sendbud.app addresses.
• Google (United States) hosts the mailbox where emails to us are kept.

Others, only when needed

• The police, courts or regulators, when the law requires it, or when needed to protect someone's safety, prevent fraud, or bring or defend a legal claim.
• A buyer of Sendbud, if the business is ever sold. They would have to follow this policy.

We don't sell your data or share it for advertising.

Data sent outside Nigeria

Our servers are in Germany, in the European Union. Cloudflare and Google may handle email in the United States and other countries. Dojah and Termii are Nigerian companies, but may use servers in other countries, and Dojah says it may send data outside Nigeria with the safeguards the law requires. When your data leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act 2023 allows: the data protection law of the country it goes to, such as the GDPR in the EU, and the data protection terms our providers have agreed to.

How long we keep it

• Your account, trips, requests, messages and ratings: while your account is open. When you delete your account, we delete them or remove what identifies you, except for what we must keep for the reasons below.
• Payment, refund and payout records: six years after the payment, because tax and accounting law requires it.
• Records of a dispute, report, suspension or suspected fraud: as long as we need them to deal with it and any legal claim.
• Your phone number and identity verification: while your account is open. When you delete your account we delete your phone number, the texted-code records, and your verified name, date of birth, ID details and ID fingerprint, and keep only that a check took place and how it ended. If our team resets your verification, the old check stays on record, with its details, until your account is deleted. What Dojah collected for the check, such as your selfie and ID photos, is kept by Dojah under its own rules and its agreement with us; email us if you want it deleted.
• Sign-ins: deleted when you log out or when they expire, after 30 days.
• Server logs: deleted automatically as newer logs replace them.
• Backups: the database is backed up every night, and each backup is deleted after at most 60 days. Data you delete stays in older backups until they are deleted.
• Emails to us: as long as we need them to help you and keep a record of what we agreed.

How we protect it

• Every page and payment uses an encrypted connection (HTTPS).
• Passwords are hashed with argon2id, and sign-in tokens are stored only as hashes. The sign-in cookie is HttpOnly, so scripts on the page can't read it.
• The database can't be reached from the internet, and backups copied off the server are encrypted.
• We never store ID numbers, only their last 4 characters and a keyed fingerprint. Results of identity checks reach us straight from Dojah, signed with a key only we share, and are read back from Dojah before we act on them.
• Only the people who run Sendbud can get into our servers.

No system is perfectly secure. If a breach puts your rights at risk, we'll tell you and the Nigeria Data Protection Commission as the law requires.

Your rights

Under the Nigeria Data Protection Act 2023, and the GDPR if you are in the EU, you can:

• ask what data we hold about you and get a copy;
• have wrong or incomplete data corrected;
• have your data deleted;
• ask us to stop or limit using it, including where we rely on our legitimate interests;
• get your data in a common, machine-readable format to take elsewhere;
• withdraw your consent at any time, where we rely on it, such as for the selfie check (though you then can't use the marketplace);
• not be subject to decisions made only by automated means that significantly affect you.

To use any of these rights, email privacy@sendbud.app from the address on your account. We may ask you to confirm it's you. It's free, and we'll reply within 30 days. Some rights have limits: for example, we must keep payment records for as long as the law says, even if you ask us to delete them.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, in the EU, to your country's data protection authority.

Cookies and local storage

• sendbud_session is a cookie that keeps you signed in. It is set when you log in or sign up, and it is HttpOnly, so page scripts can't read it. Your browser keeps it for up to a year, but it stops working when you log out or your sign-in expires after 30 days.
• theme is saved in your browser's local storage if you use the light and dark mode switch. It only holds your choice and is never sent to us.

That's all. We don't use analytics, advertising or tracking cookies, and our pages don't load scripts from other companies, apart from the identity check on the verification page, which runs Dojah's code and shows Dojah's own page, which may set its own cookies. Because the cookie is needed for signing in, we don't ask for cookie consent. Paystack's checkout is on Paystack's own site and sets its own cookies.

Children

Sendbud is for people aged 18 and over, and identity verification refuses anyone whose ID shows they are younger. We don't knowingly collect data from children. If you think a child has an account, email privacy@sendbud.app and we'll delete it.

Changes to this policy

We'll post any changes here with a new date. If a change affects you significantly, we'll tell you by email or in the app before it applies.

Contact

Email privacy@sendbud.app about your data or this policy.

Sendbud is a business name registered with the Corporate Affairs Commission of Nigeria (registration no. BN 3692661), Lagos, Nigeria.