Privacy Policy

1. Who controls your data

KoboRoute Nigeria Ltd is the data controller for personal data processed through KoboRoute, within the meaning of the Nigeria Data Protection Act 2023 (NDPA). Contact us about anything in this policy, including to exercise your rights, at privacy@koboroute.ng.

2. What we collect, and why

If you buy a Trip Pass

• Full name — to identify the Pass as yours and to address the confirmation.
• Email address — to deliver your Pass and its access link. Without it we cannot deliver what you paid for.
• Phone number and country — optional, and only used to send your Pass on WhatsApp if you tick that box.
• Payment reference, amount, status and product — to prove your purchase and support refunds and disputes.
• An anti-fraud fingerprint — a one-way cryptographic hash combining your email address, IP address and browser user-agent. We store the hash, not the values behind it. It lets us notice the same device or identity opening many orders in a short window. It is a flag for review; it never blocks a purchase by itself.

We never see your card details. Card number, CVV and PIN go directly to Paystack and never reach our systems.

If you ask for fare alerts or report a wrong fare

• Email address — to notify you when the route you asked about is verified or changes.
• Your feedback text and the route it concerns — to check and correct the fare.

If you report fares or carry out field work for us

• Your identity and contact details as a reporter or validator.
• GPS position and accuracy at the moment of a submission — to confirm a fare was observed at the park it claims, which is the difference between a field observation and a guess.
• Your submissions — fares, vehicle and capacity counts, departure counts, and any notes.

Everyone

• Language and display preferences — stored in your browser so the site remembers them. See the Cookie Policy.
• Saved routes — kept in your own browser's local storage, not on our servers, and cleared when you clear site data.
• Server and security logs — including IP address, kept by our hosting provider for security and abuse prevention.

3. Our lawful basis

Under section 25 of the NDPA, we rely on:

• Performance of a contract — for everything needed to sell and deliver a Trip Pass.
• Consent — for WhatsApp delivery and for fare alerts. You may withdraw it at any time, and withdrawing it does not affect anything done before.
• Legitimate interests — for fraud prevention, security logging, and improving the accuracy of published fares. We have weighed these against your interests; the anti-fraud measure stores a hash rather than raw identifiers for that reason.
• Legal obligation — where tax, accounting or law-enforcement duties require us to keep records.

4. Who else processes your data

We do not sell personal data. We share it only with providers who process it on our instructions:

• Paystack — payment processing. Receives your name, email and payment details directly.
• Supabase — the database holding the records described above.
• Vercel — website and API hosting, and server logs.
• Brevo — sending your Pass and notification emails.
• WhatsApp (Meta) — only if you opted in to WhatsApp delivery.

Some of these store data outside Nigeria. Where they do, we rely on the transfer conditions in Part VIII of the NDPA and on the contractual protections in our agreements with them.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

5. How long we keep it

• Trip Pass orders and entitlements — seven years from purchase, to meet tax and accounting obligations.
• Anti-fraud fingerprints — twelve months, then deleted. They only serve their purpose while recent.
• Alert subscriptions — until you unsubscribe, and no more than twenty-four months after your last interaction.
• Fare feedback — twenty-four months, so we can trace how a published figure was corrected.
• Field observations, including GPS — for the life of the study and up to five years, as the evidence base behind published fares.
• Audit logs — seven years. These are immutable by design and record who changed what.
• Server logs — as set by our hosting provider, typically thirty days.

Some records cannot be deleted on request where we must keep them by law — a paid transaction, for example, or an audit entry. Where that applies we will tell you which records and why.

6. Your rights under the NDPA

You have the right to:

• be told what we hold about you, and get a copy;
• have inaccurate data corrected;
• have data deleted, where we have no lawful reason to keep it;
• object to processing based on legitimate interests, and to withdraw consent where consent is the basis;
• ask us to restrict processing while a dispute is resolved;
• receive your data in a portable format;
• complain to the Nigeria Data Protection Commission.

Write to privacy@koboroute.ng. We will respond within thirty days. We may ask you to confirm your identity first — usually by replying from the email address on the record — so that we do not disclose your data to someone else.

7. Children

KoboRoute is not intended for children under 18, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

8. Security

Data is encrypted in transit. Access to the database is restricted to service accounts used by the application; the public data interface has no read access to personal records. Administrative pages require a signed session that expires after twelve hours. Every administrative action writes an audit record.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours and tell you directly where the NDPA requires it.

9. Changes

If we change this policy in a way that materially affects you — a new purpose, a new category of data, or a longer retention period — we will update the effective date and, where we hold your email address for that purpose, tell you before the change takes effect.