# Conneti — Privacy Policy

**Effective date:** 2026-08-27  
**Policy version:** 2026-08-27.v1  
**Compliance:** Nigeria Data Protection Act 2023 (NDPA) and NDPR.

## 1. Who we are

Conneti ("we", "us") is the data controller for the personal data we collect through the Platform. Contact: **support@conneti.ng**.

## 2. What we collect

**Account data**: full name, phone number, city, language, role (passenger/driver).  
**Driver KYC**: driver's licence, vehicle plate number, vehicle photos and inspection video, optional NIN.  
**Trip data**: pickup and drop-off points, requested vehicle type, suggested price, chosen driver, ratings.  
**Location data**: while the app is open, precise GPS location of drivers on duty and of passengers making a request. Location is **not tracked** when the app is closed.  
**Chat & call metadata**: messages exchanged for negotiation; masked-call connection records (not audio).  
**Device data**: device model, OS version, app version, IP address (for security).

## 3. How we use it

- Match passengers with nearby verified drivers.
- Verify driver identity and vehicle registration.
- Enable in-app negotiation, safety, and dispute resolution.
- Improve the Service (aggregated, anonymised analytics).
- Comply with legal obligations and lawful requests.

## 4. Lawful basis (NDPA / NDPR)

- **Contract**: to provide the Service you requested.
- **Consent**: for optional features (marketing, referrals).
- **Legal obligation**: KYC, tax, law-enforcement requests.
- **Legitimate interest**: fraud prevention, service safety.

## 5. Sharing

We share the **minimum necessary** data:
- With the matched driver or passenger, to enable the trip (name, phone via masked call, live location during trip).
- With verification partners (FRSC / NIMC) to check plate and identity.
- With hosting and infrastructure providers (Supabase, Vercel, Africa's Talking) under confidentiality obligations.
- When required by law, court order, or to protect rights and safety.

**We do not sell your data.**

## 6. Retention

- Account data: until you delete your account, then 90 days for legal reasons.
- Trip and chat data: 24 months, then anonymised.
- KYC documents: as long as you are an approved driver + 24 months after off-boarding.
- Location: real-time only; last known point kept for 24 hours; historical trip lines kept 24 months.

## 7. Your rights (NDPA)

You may request access, correction, deletion, portability, or restriction of your data, and withdraw consent at any time, by emailing **support@conneti.ng**. We respond within 30 days.

You may complain to the **Nigeria Data Protection Commission (NDPC)** if you are dissatisfied with our handling of your data.

## 8. Security

We use TLS in transit, encrypted storage at rest, role-based access, and row-level security at the database. No system is perfectly secure; we notify affected users of breaches within 72 hours of confirmation.

## 9. Children

The Service is not directed to persons under 18. We do not knowingly collect data from minors.

## 10. International transfers

Some processors (e.g., Vercel, Supabase) may host data outside Nigeria. Transfers use standard contractual clauses and equivalent safeguards.

## 11. Changes

We will notify you in-app before material changes take effect.

## 12. Contact

**support@conneti.ng**