Privacy Policy

1. Scope

This Policy applies to everyone who uses the App — Consumers, Riders, Node Operators, and Admins — and to the personal data of receivers that Consumers provide to us when booking a delivery.

2. Information We Collect

Information you provide directly:

• Account information — first name, last name, email, phone number, password.
• Rider verification — current employer, license number, and an uploaded identity/rating-screenshot document.
• Node Operator onboarding — business name, address, city, state, country, GPS coordinates, capacity, and operating hours.
• Delivery details — parcel description and size, and the receiver’s full name, email, and phone number (provided by the Consumer).
• Team member information, for Admin-invited staff — name, email, phone.

Information collected automatically

• A session cookie and a locally cached copy of your session, used only to keep you signed in.
• Your device’s location, only if you actively search for nearby Nodes — never collected in the background.
• We do not use analytics, advertising, or tracking cookies of any kind.

From third parties

We do not currently receive personal data about you from any third party, including social login providers — Google sign-in is present in the App’s code but is not active and collects nothing today.

3. How We Use Information

• To create and secure your account, and authenticate you when you sign in.
• To operate the delivery lifecycle: matching Riders to jobs, coordinating Node handoffs, notifying receivers, and tracking an order’s status.
• To verify Rider and Node Operator eligibility before approving them to operate on the network.
• To process payments through Paystack.
• To detect fraud, confirm correct parcel recipients, and maintain a safe platform.
• To respond to support requests and, where applicable, resolve disputes.

4. Legal Bases for Processing

Under the NDPA, we rely on: your consent (given at registration); the necessity of processing to perform our contract with you (booking and fulfilling deliveries); our legitimate interests in preventing fraud and keeping the platform secure; and, where applicable, legal obligations we must comply with.

5. How Information Is Shared

We limit what each role can see of another user’s data by design:

• Riders never see a receiver’s name, email, or phone.
• Node Operators never see a Rider’s personal identity — only the handoff code exchange.
• A receiver’s collection code is emailed only to the receiver.
• A Node Operator does record the receiver’s name at the point of physical collection, as an identity/fraud check.
• Admins have platform-wide visibility for approvals, support, and dispute resolution.

6. Service Providers We Use

• Cloudinary — securely stores Rider verification document images, uploaded directly from your browser using a time-limited signed link.
• Paystack — processes payments; we never receive or store your card details.
• Geoapify — provides maps and converts addresses you search into coordinates.
• Vercel — hosts our frontend infrastructure.
• Railway — hosts our backend infrastructure.

7. International Data Transfers

Locoomo may use third-party service providers that process personal data outside Nigeria. Where personal data is transferred outside Nigeria, we will take appropriate steps to ensure that the transfer and processing are carried out in accordance with the Nigeria Data Protection Act (NDPA) and applicable data-protection requirements. We require appropriate safeguards to protect personal data and will only transfer data where permitted by applicable law.

8. Cookies & Similar Technologies

We use one essential session cookie to keep you signed in, and browser storage to cache your session and, briefly, a pending payment reference. We do not use cookies for advertising, analytics, or cross-site tracking.

9. Data Retention

We retain personal data only for as long as reasonably necessary to provide our services, maintain your account, process transactions, prevent fraud, resolve disputes, enforce our agreements, and comply with applicable legal, regulatory, and accounting obligations.

Different categories of information may be retained for different periods. Account and profile information may be retained while your account remains active and for a reasonable period thereafter. Order, transaction, and payment records may be retained for as long as required for accounting, tax, legal, and regulatory purposes. KYC and verification records are retained only for as long as necessary to satisfy applicable legal, regulatory, and fraud-prevention requirements.

When personal data is no longer required, we will securely delete it or anonymize it where appropriate, subject to any legal obligation requiring continued retention.

10. Data Security

We use signed, time-limited links for uploaded documents, encrypted transport for all App traffic, and cookie-based authentication. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Under the NDPA, you have the right to access, correct, or request deletion of your personal data; object to or restrict certain processing; request a portable copy of your data; and withdraw consent at any time.

12. Access, Correction & Deletion Requests

You can update most of your own profile information directly within the App. For anything you cannot change yourself, or to request a copy or deletion of your data, email info@locoomo.com. We will respond within a reasonable time and consistent with NDPA requirements.

13. Account Deletion

The App does not currently offer a self-service “delete my account” option. To request that your account and associated personal data be deleted, email info@locoomo.com. We will confirm the request and let you know what, if anything, we are required to retain and for how long.

14. Marketing Communications

We do not currently send marketing emails. We only send transactional messages required to operate the App — account verification, password resets, and delivery/collection notifications. If we introduce marketing communications in future, we will provide a clear way to opt out.

15. Children’s Privacy

The App is intended for users 18 and older. We do not knowingly collect personal data from children below that age. The App does not currently verify age at registration; if you believe a child has provided us with personal data, contact info@locoomo.com so we can remove it.

16. User-Generated Content

Parcel descriptions and uploaded verification documents are visible only to the users and Admins who need them to complete a specific function.

17. Automated Decision-Making

The App calculates delivery fares automatically based on route and delivery method, but this is a pricing calculation, not a decision that produces a legal or similarly significant effect about you, and it does not involve profiling. We do not currently use AI features that make decisions about your account or eligibility.

18. Data Breach Notification

If a security incident affecting your personal data occurs, we will assess it and, where required under the NDPA, notify the Nigeria Data Protection Commission and affected users within the applicable timeframe.

19. Changes to This Policy

We may update this Policy from time to time. Material changes will be communicated through the App or by email before they take effect.

20. Data Protection Officer

Locoomo is in the process of designating a Data Protection Officer (DPO) in accordance with applicable data-protection requirements. Once appointed, the DPO’s contact details will be made available in this Privacy Policy. In the meantime, privacy-related enquiries may be directed to info@locoomo.com.

21. Contact

General questions and privacy/data-protection requests: info@locoomo.com. Postal address: 16 Ehighieda Street, off Ekosodin Road, Benin City, Edo State, Nigeria.