Carrb - Privacy Policy

1.1 Information you provide

• Account and profile: name, email address, phone number, password (handled by our authentication provider), profile photo, and other information you choose to add (for example, vehicle details for drivers).
• Identity and compliance: documents or images you upload for verification (for example, driver's license, insurance, vehicle registration), payout details such as bank account information for drivers where collected for payments.
• Communications: messages you send through in-app chat, support tickets, feedback, ratings, and reviews.
• Trip and transaction data: pickup and drop-off locations or addresses you enter or confirm, route information, fares, wallet transactions, and payment-related records.

1.2 Information collected automatically

• Location: precise or approximate location from your device when you permit access, used for matching riders and drivers, navigation, safety, fraud prevention, and improving the Services.
• Device and log data: device type, operating system, app version, IP address, language, timestamps, and diagnostic data.
• Cookies and similar technologies: on web properties, we may use cookies, local storage, and analytics tools as described below.

1.3 Information from third parties

• We may receive information from authentication providers, maps or routing providers, payment processors, fraud and identity services, and publicly available sources, as permitted by law.

We use information to:

• Provide, operate, and improve the Services (including matching, pricing, routing, customer support, and driver onboarding);
• Process payments, maintain wallets, and prevent fraud;
• Send transactional messages, safety notices, and (where permitted) marketing communications - you may opt out of marketing where applicable;
• Personalize your experience and develop new features;
• Monitor and analyze usage, performance, and reliability, including crash and error reporting;
• Enforce our Terms, protect users and the public, and comply with law;
• Resolve disputes and investigate incidents.

We process personal data where Nigerian law allows, including on bases such as your consent (where required), performance of our agreement with you, legitimate interests that are not overridden by your rights, and compliance with legal obligations, consistent with NDPC guidance.

Location is core to the Services. If you deny location permission, certain features (for example, requesting or accepting rides) may not work.

We collect location when the app is in use and, where you grant permission and the feature requires it, in the background (for example, to complete an active trip or to show availability). You can manage permissions in your device settings. On Android and iOS, platform-specific disclosures in the store listing and in-app should match actual collection practices.

If the app requests microphone access, camera access, or photo library access (for example, for support, identity verification, or safety features), we use such access only for the purposes disclosed in permission prompts and this Policy. Disable permissions in device settings if you do not wish to grant them, understanding that some features may be unavailable.

We may share information:

5.1 Between riders and drivers as needed to arrange and complete trips (for example, name, photo, vehicle details, contact methods allowed by the app, and trip status).

5.2 With service providers who process data on our behalf under contractual obligations (for example, cloud hosting, authentication, database, storage, maps, analytics, crash reporting, customer support tools, email delivery, and payment processing), including vendors such as Google (including Google Maps), Firebase/Google Cloud, and Sentry for error monitoring, consistent with their policies.

5.3 For legal reasons, including to comply with law, regulation, legal process, or governmental requests; to enforce our policies; to protect safety; or to defend against legal claims.

5.4 In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and lawful bases.

5.5 With your direction or consent.

We do not sell your personal data inappropriately. If Nigerian law defines or restricts certain disclosures or requires specific notices or choices, we comply with those requirements (see Section 9).

Our users are in Nigeria. We primarily deliver the Services in Nigeria, but we and our service providers may process or store information in Nigeria and in other countries where our providers operate (for example, cloud hosting regions). Where personal data is transferred outside Nigeria, we take steps required under the Nigeria Data Protection Act and NDPC guidance, including appropriate safeguards and agreements with processors where applicable.

We retain information for as long as necessary to provide the Services, comply with law, resolve disputes, and enforce agreements. Retention periods vary by data type (for example, trip records and tax-related data may be kept longer). We may anonymize or aggregate data for analytics without time limit.

We implement technical and organizational measures designed to protect personal information. No method of transmission or storage is perfectly secure; we cannot guarantee absolute security.

Under the Nigeria Data Protection Act and related frameworks, you may have rights such as the following, subject to verification and any lawful exceptions:

• Access personal data we hold about you and obtain certain information about how we process it;
• Request correction of inaccurate data or completion of incomplete data;
• Request deletion or restriction of processing where applicable;
• Object to processing that is based on legitimate interests, where the law allows;
• Withdraw consent where processing is based on consent, without affecting the lawfulness of processing before withdrawal;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been infringed.

To exercise rights, contact carrbservices@gmail.com. We may need to verify your identity before responding. We will respond within timelines required by Nigerian law where applicable.

You may also control notifications and marketing preferences in-app or through device settings where available.

With your permission, we may send push notifications about trips, account alerts, promotions, and service updates. You can turn off notifications in your device settings.

We may use analytics and crash-reporting tools (for example, Sentry) to understand reliability and improve the Services. These tools may collect device and usage information consistent with this Policy and the providers' policies.

We may update this Policy from time to time. We will post the updated Policy and revise the “Last updated” date. For material changes, we may provide additional notice as required by law.