Privacy Policy

From everyone with an account

• Account details: first and last name, email address, phone number and campus. Your password is handled by Google Firebase Authentication; we never see it.
• Profile photo, if you add one.
• Addresses: the delivery addresses and map pins you save. If you allow it, we read your device's location to help you pin an address.
• Orders: what you ordered, from whom, when, the amounts, delivery details and your receipts.
• Payments and wallet: payment references and results from Paystack, your wallet balance and transaction history. Your wallet PIN is stored only as a one-way hash, so nobody can read it back. We never receive your full card number.
• Bills: the phone, meter or smartcard numbers you enter, the plan and amount, and any token issued.
• Event tickets: the ticket holder's name and email, the ticket's code and whether it has been scanned.
• Messages: what you send our support team by email or WhatsApp, and the emails, texts, WhatsApp messages and notifications we send you.
• Device and technical data: a push-notification token for your device, basic device and browser information, and server logs such as IP address, time of request and errors.

Extra, if you are a vendor

• Your business name, business email and phone, campus and store location.
• Your menu, prices and product photos.
• Your bank account (bank, account number and account name), which we check with Paystack before paying out.
• Any information you give us to verify you or your business, and your sales and payout history.

Extra, if you are a rider

• Your vehicle type and plate number.
• The type and number of the ID you give us — student ID, NIN, driver's licence, voter's card or international passport.
• Your bank account, earnings and withdrawal history.
• Your location while you are online. The Rider app sends your position about every 90 seconds, and about every 20 seconds while you are carrying an order. We keep your latest position on your rider profile, and the positions from a delivery with that order's record. Sharing stops when you go offline. You can refuse location permission and still work, but you won't be matched by distance.
• Usage analytics. The Rider app uses Google Analytics for Firebase to see how the sign-up pages and app are used — which screens are opened and which steps are completed.

The NDPA lets us process personal data only when we have a lawful basis. These are ours:

Delivery dispatch is automated: the system offers each delivery to riders who are online and nearby. If you think an automated decision has treated you unfairly, contact us and a person will review it.

People on the other side of your order

• The vendor sees your name, your order and the delivery details they need to prepare it.
• The rider sees your name, phone number, delivery location and instructions so they can reach you.
• As a buyer, you see your rider's name, vehicle and live location while they carry your order.
• Event organisers see ticket holders' names and who has checked in.

Our team

Blorbmart staff and campus operations leads can see the data they need for their role — for example, to resolve a complaint or approve a vendor.

Service providers

These companies process data for us, only on our instructions:

When the law requires it

We may disclose data to police, courts or regulators when the law requires it, or to protect the safety, rights or property of our users, the public or Blorbmart.

If Blorbmart changes hands

If we merge with or are bought by another company, your data may pass to it, still protected by this policy.

We do not sell your personal data.

Some of our providers, including Google, Cloudinary, TomTom, Twilio, Render and Vercel, store or process data outside Nigeria. When data leaves Nigeria, we rely on the safeguards the NDPA allows, such as the recipient's contractual commitments to protect it to an adequate standard.

• Account data is kept for as long as your account is open.
• When you delete your account, we delete or anonymise your data within 14 days of confirming your request, except for the records below.
• Payment, order, top-up, ticket and payout records are kept for 6 years, because tax and company law require us to keep financial records.
• Records linked to fraud, a dispute or a legal claim are kept until the matter is closed.
• Support conversations are kept for as long as we need them to deal with your request and any follow-up.

The Delete your account page explains the process step by step.

Under the NDPA you have the right to:

• be told how your data is used — which is what this policy is for;
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict how we use your data, or object to our using it, including for direct marketing;
• receive your data in a portable format;
• withdraw consent you have given, such as for location access or newsletters;
• not be subject to a decision based solely on automated processing that significantly affects you;
• complain to the Nigeria Data Protection Commission (NDPC).

You can change your name, phone number, addresses and profile photo in the app. For anything else, email blorbmarthelpdesk@gmail.com. We may ask you to confirm your identity first, and we will reply within 30 days.

• All traffic between the apps and our servers is encrypted.
• Access to data is limited by role, so each person sees only what their job needs.
• Wallet PINs are stored as one-way hashes and lock after repeated wrong attempts.
• Delivery PINs make sure orders reach the person who placed them.

No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the NDPC as the NDPA requires.

This website sets no advertising or tracking cookies. It loads fonts from Google Fonts, which receives your IP address when your browser fetches them.

Our web apps store your sign-in session and preferences in your browser so you stay signed in. The Rider app's analytics may also store an identifier in your browser. You can clear this storage in your browser settings, though you will be signed out.

Blorbmart is meant for people aged 18 and over. Anyone younger may use it only with a parent's or guardian's permission. If you believe we hold a child's data without that permission, contact us and we will delete it.

We send newsletters and promotions only if you have agreed to receive them, and every one lets you unsubscribe. Service messages — order updates, receipts and security codes — are part of using Blorbmart and continue while your account is open. You can turn off push notifications in your device settings at any time.

We will update this policy whenever we change how we handle personal data. The date at the top of this page shows when it last changed. If a change matters, we will tell you in the app or by email.

• Blorbmart Limited
• Email: blorbmarthelpdesk@gmail.com
• WhatsApp: +234 902 259 4853

If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission at ndpc.gov.ng.