Privacy Policy
This policy explains how SpinDrop Technologies Ltd ("SpinDrop", "we") collects and uses personal data when you use the SpinDrop app and website. It is written to meet the Nigeria Data Protection Act 2023 (NDPA), the EU and UK General Data Protection Regulation (GDPR) and similar laws wherever SpinDrop operates.
1. Who is responsible for your data
SpinDrop Technologies Ltd, [Registered business address], Lagos, Nigeria, is the data controller for the SpinDrop platform. Contact our data protection team at spindrop@ajudarconnect.com.
When you place an order, the laundry mart you order from receives the details needed to fulfil it and acts as an independent controller for its own records (for example its sales and tax records).
2. What we collect
- Account data: full name, phone number (verified by SMS code), email address, password (stored only as a secure hash), account type (customer or mart owner) and optional profile photo.
- Location and address data: your default pickup/delivery address and map pin; your device location while you browse nearby marts, only if you allow it. Device location is used in your browser to find nearby marts and is not stored.
- Order data: services and quantities, fulfillment method, preferred time, pickup address, order notes, receipts, order status history and ratings or reviews you write.
- Mart data (mart owners): business name, address and map pin, contact phone, photo, menu and prices, opening hours and the orders your mart receives.
- Consent records: which version of these documents you accepted, your age confirmation and your marketing preference, with the time of each choice.
- Technical data: notification subscriptions for your devices (if you turn on push notifications), session cookies that keep you signed in, and server logs kept by our hosting providers for security.
We do not collect payment card details. Payments are settled directly between you and the mart.
3. Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, verifying your phone number | Performance of a contract |
| Showing nearby marts, placing and tracking orders, and sending order updates, invoices and receipts in the app, by push notification and by email (order emails can be switched off in Account settings) | Performance of a contract |
| Sharing your name, phone and pickup details with the mart you order from | Performance of a contract |
| Keeping transaction records and receipts | Legal obligation (accounting and tax) |
| Preventing fraud and abuse, keeping the service secure | Legitimate interests |
| Publishing your rating and first name with your review | Legitimate interests (helping customers choose marts) |
| Sending offers and product news | Consent (you can withdraw it at any time) |
We do not sell your personal data and we do not use it for automated decisions that have legal effects on you.
4. Who we share it with
- The mart you order from: your name, phone number, pickup address, order details and notes.
- Service providers (processors) acting on our instructions: Supabase (database, authentication, file storage), Vercel (website hosting), our SMS provider (verification codes), our email delivery service operated through Ajudar Connect's automation platform (account and order emails), browser push services operated by Google, Apple and Mozilla (notifications) and OpenStreetMap services (map tiles and address search, which receive the map area or search text but not your account details).
- Authorities: when required by law or to protect rights and safety.
5. International transfers
Some providers process data outside your country. Where data leaves Nigeria, the EU/EEA or the UK, we rely on adequacy decisions or standard contractual clauses and the safeguards required by the NDPA and GDPR.
6. How long we keep it
- Account data: while your account is open. It is deleted when you delete your account.
- In-app notifications: automatically deleted after 12 months.
- Orders and receipts: kept for up to 6 years for accounting and tax purposes. If you delete your account, your name, phone number, address and notes are removed from them first.
- Reviews: kept after account deletion but no longer linked to you, and shown as "Former customer".
- Consent records: kept while your account exists, to show what you agreed to.
7. Your rights
You can:
- Access and portability: download a copy of your data from Account (or Settings) → Privacy & your data → Download my data.
- Rectification: update your name, email, address and photo in your account at any time.
- Erasure: delete your account from Account (or Settings) → Privacy & your data → Delete my account.
- Withdraw consent: switch off "Offers and updates" at any time. This does not affect processing that already happened.
- Object or restrict: object to processing based on legitimate interests, or ask us to restrict processing, by emailing spindrop@ajudarconnect.com.
- Complain: to the Nigeria Data Protection Commission (ndpc.gov.ng), your local EU supervisory authority, or the UK Information Commissioner's Office (ico.org.uk).
We respond to requests within 30 days and may need to verify your identity first.
8. Cookies and local storage
SpinDrop uses only strictly necessary storage: a session cookie that keeps you signed in, and your browser's local storage to remember your cart. We do not use advertising or analytics cookies, so no cookie consent banner is needed. If we add any in future, we will ask first.
9. Security
Data is encrypted in transit (HTTPS) and at rest. Access is restricted by database row-level security so each person can only see their own data, passwords are hashed, prices are computed on our servers and receipts cannot be altered.
10. Children
SpinDrop is for people aged 18 and over. We do not knowingly collect data from children.
11. Changes
If we change this policy materially, we will tell you in the app before the change takes effect and, where required, ask for your consent again.