Privacy Policy

This policy explains how Pundit Technologies ("PunditGo", "we") collects, uses, shares and protects personal data when you use the PunditGo app, the PunditGo Rider app, our website and web console, USSD, WhatsApp and Telegram services (the "Platform"). We are the data controller under the Nigeria Data Protection Act 2023 (NDPA) and the regulations and directives of the Nigeria Data Protection Commission (NDPC).

Data Protection Officer: Kamaluddeen Adamu, pundittechnology@gmail.com, No. 9A Drive 6, Prince and Prince Estate, Apo, FCT Abuja, Nigeria.

1. What we collect

Everyone

• Phone number, name, and email if you give one. Sign-in codes are stored only in scrambled (hashed) form.
• Optional profile details, only if you add them: your date of birth (to confirm you are 18 or older) and your gender (only to offer women-only shared rides). You can remove them in Profile at any time.
• Device information: a device identifier, app version, push notification token, IP address and the network events needed to keep your account secure.
• Your activity: jobs, orders, addresses and landmarks you save, ratings, reviews, support tickets, disputes and messages with support.
• Payment records: amounts, methods, references and wallet history. Card details are handled by our payment partner; we never see or store full card numbers or PINs.
• If you top up by direct bank transfer: the amount, the code we gave you, the receipt you upload, the name on the account you sent from, and the matching line from our bank statement or bank alert (amount, date, sender name and narration). Only our finance staff see the receipt, and every time they open it is recorded.
• Search by photo: the photo you search with is used once, to find the same or similar items, and is not kept. We make a small copy (location and other details in the file removed) and send it to Anthropic to recognise the item; we keep only a fingerprint of the photo, for a short time, so the same photo is answered faster.
• My Likes and Recently Viewed: the stores, dishes and items, listings, homes and events you heart or open, so you can find them again. Only you see them; clear Recently Viewed in the app at any time (we keep at most the last 100).
• Customer Service: your chats and requests with our team (messages, photos you send, the topic and any order they are about), the Help Center articles our assistant suggested and any rating you give. Our support staff see them, with your phone number masked. Kept like support tickets (section 6).
• Deliveries with several drop-offs or cash on delivery: each recipient's name, phone and address, the amount to collect, and proof of each drop-off (photo, name of the person who received it). The rider sees each recipient's first name, address and a masked number.
• "Happening soon": we put together what is coming up for you (appointments, pickups, payments due, offers ending) from your own records, to show on Home and, if you confirmed an email and kept email notifications on, in one short morning email. Turn email off in Account → Email.
• Messages you send through USSD, WhatsApp or Telegram to order or get help, and the WhatsApp or Telegram identifier they come from.

Parcels at motor parks

• When a parcel is left for you with a park agent: your name and phone number (as written on the parcel), the sender's details if given, where it came from, its description and photos. We use them to tell you it has arrived, hand it over and deliver it; the park's agents see them, and the rider sees what any delivery shows. Kept like job records (section 6).
• When you join a savings group (Adashe / Ajo / Esusu): the group, your turn, your contributions and payouts, and the bank account you cash out to. The operator sees your name, turn and payment record to run the group (your phone number stays hidden); other members see your first name and turn only. Kept like payment records (section 6).
• When you book a car wash: your vehicle's description and plate, the time, and (for pickup & return) where to collect and return the car. The car wash sees these and your first name to do the wash; it does not see your phone number (calls go through PunditGo). Kept like job records (section 6).

Buy & sell, Homes and Tickets

• Listings you post (photos, description, price, area and, for property, the exact pin, fees and title document type), and a fingerprint (hash) of each photo so we can spot the same photos used in other listings.
• Chats and in-app calls about a listing. We automatically check messages and listings for phone numbers, emails, account numbers, links and words used in scams, hide them, and keep a record of what was hidden so we can act on repeated attempts to take deals off the Platform. Call logs work like other masked calls (above).
• Government ID you upload to get the Verified badge, and property documents (title papers, owner's authority, utility bills). Only our verification staff see them; they are never shown to buyers, tenants or other users. Our staff's site visit records (location, photos, result).
• Orders, Safe Pay and Safe Rent payments, inspections and attendance codes, the summary agreement you sign (with the time you signed), reports and disputes.
• Tickets you buy, the name on them and when each was checked in. The event host and their door staff see the name on the ticket and its check-in status, not your phone number.
• What other users see: your first name and last initial, profile photo, whether your ID is verified, when you joined, completed sales or deals and your rating. Seekers see a property's exact location only once the lister confirms their inspection.

Health bookings (sensitive data)

• When you book a clinic or laboratory: the patient's name, age and sex, the reason for the visit if you give one, the service, the time, the clinic's notes and results. This is sensitive health data: we collect it only with your explicit consent (given when you book), and only you and that clinic's or laboratory's staff can see it. Our support staff can see that a booking exists and its status, not the reason or results. We never use it for marketing. Results are opened in the app or through a link that works for 10 minutes.

Farm, livestock, school fees, artisans, giving and solar

• Produce pools: your pledges, delivery codes and what was accepted and paid; the buyer's staff see your name and bags. Vet checks: the animal, the place to visit and the vet's report (the report shows on your listing).
• School fees: the student's name, class and admission number (from the school), what was paid, by whom, and receipts. Someone paying with an admission number sees only the student's first name and class.
• Artisans: your job description, photos and place (the exact place only once you accept a quote), quotes, codes, ratings and any dispute.
• Giving: your donations and receipts. If you give anonymously, the charity and the public see the amount but not your name; we still keep who gave for our records and the law.
• Solar: your plan, address for installation, payments and whether the system was switched off. A verified ID is required, and the vendor sees your name, address and payment record.
• Waste collection: your address and landmark for collection, your plan, payments, each pickup (collected or missed and the reason, any photo the crew takes) and any report you make. The company sees your first name, your address and your plan and payment status; it does not see your phone number (calls go through PunditGo).
• Water tankers: where your tank is, the days and times you order, payments, delivery codes used and any report. The supplier and its driver see your first name, the address and your order; calls go through PunditGo.
• Tractor hire: your farm's location and description, the work and amount booked, the crop if you give it, what was done, payments and any complaint. The owner and operator see your first name, the farm location and the booking; calls go through PunditGo.
• Partner organisations (clinics, labs, vets, produce buyers, charities, solar companies, waste collection companies, water suppliers, farm machinery owners): the organisation's details, licences and documents (seen only by our verification staff), staff accounts and bank details.

Shops' customers and table orders (no account needed)

• When a shop that uses PunditGo records your purchase and you give your name or phone number (for a receipt or a delivery): the items, the amount and how you paid, and for a delivery your address and the delivery price. The shop sees these; the rider sees your first name, the address and a masked number.
• When you order by scanning the QR code at a table or counter: the dishes and notes you choose, and your name and phone number if you give them. The shop's staff see these to prepare and serve your order.
• We text you only about that purchase: the receipt you asked for, delivery updates and your delivery code, or that your order is ready. We do not use these numbers for marketing.
• For shops: which member of the team recorded each sale, table order and stock change.

Location

• Customers: pickup and drop-off points you choose, and your current location when you tap "use my location" or share it in chat.
• Riders and drivers: your location while you are online (every 45 seconds or so) and continuously during a job (about every 15 seconds or 30 metres), including speed and accuracy. We do not track your location when you are offline.

Riders, drivers and fleet owners

• Identity and licence documents (such as NIN, driver's licence, vehicle papers, permits), photos, vehicle details, plate number, bank account for payouts, cash collected and remitted, ratings, acceptance and cancellation rates, and safety or fraud reviews.

Merchants, businesses and schools

• Business name, registration (CAC) details, contact people, bank details, staff accounts and, for schools, the information described in the School Transport Terms.

Children (school transport only)

• A child's name, class, photo, route and stop, the QR card used to board, and boarding and drop-off times and locations. This is provided by the school or by the parent/guardian, and is used only to run and secure school transport. We do not let children create accounts.

Calls

• Calls between customers and riders go through a masked number. We log who called whom, when and for how long, but neither side sees the other's number. If call recording is switched on, you will hear a notice before the call is connected. Recordings are kept only as long as stated in section 6 and can only be accessed by authorised support staff for a stated reason, which is logged.

Photos and proof

• Delivery and cargo photos, signatures and handover codes used as proof that a job was completed.

Prescriptions (health data)

• When you order a prescription-only medicine, the photo of your prescription and the patient's name. This is sensitive health data: we collect it only with your explicit consent (given when you upload it), share it only with the pharmacy you ordered from so its pharmacist can check it, never with riders, and never use it for marketing.

2. Why we use it, and our legal basis

Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for that assessment.

3. Automated decisions

Some decisions are made by software, for example: scoring listings for scam risk (hiding high-risk listings until staff review them), hiding contact details in chats and warning people who repeat it, offering jobs to the nearest suitable rider, blocking cash payment after repeated cancellations, holding a rider's cash jobs when their cash limit is reached, flagging unusual GPS or payment patterns, and pausing an account for review. Automated flags do not permanently close an account on their own. You can ask for a human review of any automated decision that significantly affects you, give your side, and contest it, by contacting pundittechnology@gmail.com.

4. Who we share it with

Your phone number is never shown in full to riders, drivers, stores, park agents, fleets, businesses or our own staff screens. Calls between you and them go through masked calling (neither side sees the other's number). Support staff can reveal a number only when they need to call you about a case or a safety alert, and every such reveal is recorded.

We share only what each party needs:

• The other side of your job. Customers see the rider's first name, photo, vehicle and plate, rating and live location during the job. Riders see the customer's first name, pickup and drop-off details and instructions. Phone numbers are masked. Merchants see what they need to prepare the order.
• Fleet owners see their drivers' trips, earnings, cash held, ratings and incident categories (not customers' identities or complaint text).
• Business account admins see trips booked on the company account by their employees (time, route areas, amount and purpose).
• Schools and parents see boarding and drop-off events and the bus location for their own children. Where a school checks children off the bus at its gate, the gate staff it appoints see the names and classes of the children on that day's buses and record their arrival and departure.
• Service providers working for us, under contracts requiring confidentiality and security: AI checks of listings and listing photos, and help writing listings, and recognising the item in a photo you search with (Anthropic; listing text and photos and search photos only, never your phone number, ID documents or chats), payments and payouts (Paystack; for partners who choose direct payout, the payout bank account and business name are also used to set up a Paystack sub-account that pays them directly), bills payments (VTpass), SMS (Termii), voice and USSD (Africa's Talking), WhatsApp (Meta), Telegram, push notifications (Expo, Google, Apple), map tiles (OpenStreetMap), and our cloud hosting provider.
• Authorities, when the law requires it or to protect someone's life or safety, for example the Nigeria Police Force, FRSC, courts or regulators with a lawful request. We check that requests are lawful and share only what is required.
• A buyer or investor if PunditGo is reorganised or sold, under the same protections.

We do not sell your personal data.

5. Transfers outside Nigeria

Some providers process data outside Nigeria (for example cloud hosting, push notifications, AI listing checks, WhatsApp and Telegram). We only transfer data where the NDPA allows it: to countries or organisations with adequate protection, under contractual safeguards, or where another lawful condition applies. Ask us for details of the safeguards.

6. How long we keep it

When the period ends we delete or anonymise the data, unless the law requires us to keep it longer or it is needed for a legal claim.

7. How we protect it

Encrypted connections (TLS); encryption of sensitive secrets at rest; masked phone numbers; access to personal data limited to staff who need it, with two-factor authentication for staff and audit logs of sensitive access; one-time codes for sign-in and handovers; and regular reviews. No system is perfectly secure. If a breach is likely to put you at risk, we will notify the NDPC within 72 hours and tell you without undue delay, with what you can do to protect yourself.

8. Your rights

Under the NDPA you have the right to:

• be informed about how we use your data (this policy);
• get a copy of your data, and receive it in a commonly used format (portability);
• correct inaccurate data;
• have data deleted where there is no longer a lawful reason to keep it;
• restrict or object to our use of your data, including for direct marketing and legitimate-interests processing;
• withdraw consent at any time (this does not affect what we did before);
• not be subject to a decision based solely on automated processing that significantly affects you, and to ask for human review.

To use these rights, contact pundittechnology@gmail.com or use support in the app. We may need to verify your identity. We respond within 30 days, and tell you if we need longer. It is free unless a request is clearly unfounded or excessive.

If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

9. Children

The Platform is for people aged 18 and over. We only process children's data for school transport, with a parent's or guardian's consent. If you think we hold a child's data without consent, contact pundittechnology@gmail.com and we will delete it.

10. Cookies and similar technology

Our web console uses only the browser storage needed to keep you signed in and remember settings. We do not use advertising cookies. The mobile apps store sign-in tokens securely on your device.

11. Changes

We will tell you in the app before material changes to this policy take effect, and ask you to accept them where required.

12. Contact

Pundit Technologies, No. 9A Drive 6, Prince and Prince Estate, Apo, FCT Abuja, Nigeria. Privacy: pundittechnology@gmail.com. Support: pundittechnology@gmail.com, +234 703 740 9950.