Privacy
Policy

01Overview

RydeCircle Ltd ("RydeCircle", "we", "us") operates a commuter ride-matching platform serving passengers and drivers across Lagos, Nigeria. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and what rights you have.

It applies to all users of our mobile applications, website (rydecircle.com), driver portal (driver.rydecircle.com), and related services.

02Data we collect

We do not collect racial or ethnic origin, political opinions, religious beliefs, biometric data, or health information.

03How we use your data

• Providing the service — matching riders with drivers, processing trips, facilitating payments
• Account management — creating and maintaining your driver or passenger account
• Driver verification — reviewing applications, verifying documents, onboarding approved drivers
• Payments — calculating earnings, processing payouts to driver bank accounts
• Safety and security — fraud detection, incident investigation, enforcing our Terms of Service
• Customer support — responding to queries and resolving disputes
• Communications — transactional emails (password resets, account updates, trip receipts)
• Legal compliance — meeting obligations under Nigerian law, responding to lawful government requests
• Product improvement — analysing anonymised usage data to improve the platform (with consent where required)

04Data sharing

We share personal data only in these limited circumstances:

• Between drivers and passengers — first name and vehicle details are shared to enable a trip
• Service providers — cloud infrastructure (Supabase), email delivery (Resend), payment processors, contractually bound to use your data only on our instructions
• Legal requirements — when required by a court order, government authority, or applicable Nigerian law
• Safety emergencies — when disclosure is necessary to protect any person's physical safety
• Business transfers — in the event of a merger or acquisition, with equivalent privacy protections maintained

05Data retention

• Active account data — retained for the lifetime of your account
• Trip and payment records — 7 years from transaction date (required by Nigerian financial regulation)
• Driver documents — 2 years after account closure or application rejection
• Support communications — 2 years from resolution
• Device and usage logs — 90 days

When data is no longer required, we securely delete or anonymise it.

06Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate or incomplete data
• Erasure — request deletion of your data, subject to legal retention requirements
• Restriction — request that we limit processing of your data in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing

To exercise any right, email privacy@rydecircle.com. We respond within 30 days. If unsatisfied, you may lodge a complaint with the Nigeria Data Protection Commission.

07Security

• All data in transit is encrypted using TLS 1.2 or higher
• Passwords are hashed using bcrypt (cost factor 12) — never stored in plaintext
• Authentication uses short-lived JSON Web Tokens (JWT)
• Database access is restricted to authenticated application servers only
• Financial data (bank details) is accessible only to authorised finance staff
• Audit logs record all admin actions involving personal data

No system is completely secure. If you discover a security vulnerability, report it responsibly to security@rydecircle.com.

08Cookies

• Essential cookies — required for the website to function (session management, authentication). You cannot opt out of these.
• Analytics cookies — anonymous usage statistics (page views, browser type). Opt out via your browser settings.

We do not use advertising cookies and do not share cookie data with advertisers.

09Children

RydeCircle services are not directed at persons under 18. We do not knowingly collect data from children. If you believe we have done so inadvertently, contact privacy@rydecircle.com and we will delete it promptly.

10Changes to this policy

When we make material changes, we will update the effective date, send email notice to registered users, and display an in-app notice for 14 days. Continued use of our services constitutes acceptance of the updated policy.

11Contact us