BuPrivacy Policy
Effective date: 15 October 2026 · Version 2.0
1. Who we are
BuDash operates a web platform that lets buyers choose items from market shops listed by BuDash and have a verified individual, called a "Dasher", buy and deliver them on foot. The data controller is BuDash .
We process personal data in line with the Nigeria Data Protection Act 2023 ("NDPA") and applicable regulations.
2. Data we collect
- Account data (everyone): full name, email address, phone number, password (stored only as a hash by Firebase Authentication), your role (buyer, dasher or admin), and the time you accepted our Terms and Privacy Policy.
- Order data (buyers): items ordered, shop, drop-off address and delivery notes, order status and timestamps, payment reference, amounts, ratings and comments you give.
- Dasher verification data: a profile photo of your face and a photo of your school ID card. The ID image is deleted after an admin reviews it. The profile photo is kept and shown to buyers who view or work with you.
- Dasher payout data: bank name/code, account number and account name, which are sent to Paystack to create your payout sub-account. We keep only the Paystack sub-account code, your account name and the last four digits.
- Live location (dashers): while you have an order marked "purchased", your device location is collected and shown to that order's buyer. Sharing stops when the order is completed and the location record is deleted.
- Dasher performance data: number of completed jobs and average star rating, shown next to your name.
- Technical data: browser storage needed to keep you signed in and remember your cart (see our Cookie Policy), and server logs (IP address, timestamps, errors) kept by our hosting provider.
We do not store your card or bank card details. Card payments are handled by Paystack.
3. Why we use your data (legal bases)
- To provide the service (contract): creating accounts, matching buyers with dashers, processing payments and delivering orders.
- Consent: collecting dasher live location through your device permission, and your photo/ID submission. You can withdraw consent by turning off location or deleting your account, but then we may be unable to provide the service.
- Legitimate interests: preventing fraud and abuse, keeping the platform safe, resolving disputes and improving reliability.
- Legal obligation: keeping transaction records and responding to lawful requests.
4. Who we share data with
- Between buyer and dasher: your name and drop-off address go to the dasher once they accept; both parties' phone numbers are shared after payment is confirmed. Buyers see the dasher's name, photo, jobs done, average rating, and live location during delivery.
- Service providers (processors): Google Firebase (authentication and database), Vercel (hosting and serverless functions), Paystack (payments, bank account verification and payouts), Resend (transactional email such as verification links and receipts), and OpenStreetMap (map tiles, which receive your IP address when a map is displayed).
- Authorities: where required by law or to protect rights and safety.
We do not sell your personal data.
5. International transfers
Our providers may process data on servers outside Nigeria. Where this happens we rely on appropriate safeguards required by the NDPA, such as contractual protections.
6. How long we keep data
- School ID image: deleted after admin review.
- Live location: deleted when the order is completed.
- Order and payment records: kept as long as needed for accounting, dispute handling and legal obligations.
- Account data: kept while your account is active and deleted or anonymised on request, subject to the records above.
7. Your rights
Under the NDPA you may ask us to: access your data, correct it, delete it, restrict or object to processing, receive a portable copy, and withdraw consent.
8. Security
We use HTTPS, role-based database rules, server-side validation of prices and payments, and limit staff access to verification documents. No system is perfectly secure; please use a strong, unique password and keep your account private.
9. Children
BuDash is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, contact us and we will delete the account.
10. Changes
We may update this policy. We will change the date above and, for material changes, notify you in the app or by email.