Privacy Policy

The Choba Collective ("Choba", "we", "us", "our") runs a platform that lets users order food and other items from vendors and have them delivered. We owe you a clear account of what we do with your personal information, and this Privacy Policy ("Policy") is that account.

"Personal information" means information that identifies you — your name, email address, phone number, delivery address and any other data we hold that can be linked to you. Please read this Policy alongside our Terms of Use. Questions go to support@choba.app.

1. Changes to this Policy

We review this Policy at least annually to keep it accurate and compliant with the Nigeria Data Protection Act (NDPA) 2023 and other applicable law. We also update it when our practices change — new features, new service providers, new categories of data. Revised versions are published on our website and in our applications, and the review date at the foot of this document is updated. Where a change materially affects your rights, we will tell you directly before it takes effect.

2. When we collect your information

We collect personal information when you create an account, place an order, add a delivery address or payment method, subscribe to our updates, contact our support team, take part in a promotion or survey, or simply browse our website or applications. Where the law permits, we may also receive information about you from payment providers, fraud prevention services and our business partners.

3. What we collect

3.1. Account information — your name, email address, phone number, password (stored encrypted), and any profile details you add.

3.2. Order information — items ordered, vendors ordered from, order values and times, delivery addresses and instructions, order history, and any ratings or reviews you leave.

3.3. Payment information — the payment method used and the outcome of the transaction. Full card details are handled by our payment processors, not by us; we receive only limited details such as card type and the last digits of the card number.

3.4. Device and usage information — device model, operating system, unique device identifiers, IP address, app version, and how you navigate and use the platform.

3.5. Communications — your correspondence with our support team, including in-app chat and email.

3.6. Optional information — survey responses, promotional and referral activity, and any other information you choose to give us.

3.7. Other people's information — where you give us the name, address or phone number of someone else, such as when ordering on their behalf. We assume you have their consent to share it, and it is your responsibility to have obtained it.

4. Location

Choba does not currently request access to your device location. We rely on the delivery address you enter or save to your account.

We may introduce location features in future — for example, to show vendors near you or to support live order tracking. If we do, we will ask for your permission before accessing your device location, explain what we are collecting and why, and let you withdraw that permission at any time in your device settings. Note that your approximate location can be inferred from your IP address as part of ordinary web and app traffic.

5. Cookies and similar technologies

Our website and applications use cookies and comparable technologies such as pixels and SDKs. We use them to keep you signed in, remember your preferences, understand how the platform is used, measure our marketing, and detect fraudulent activity.

Where cookies are not strictly necessary for the platform to work — including analytics and advertising cookies — we ask for your consent first, and you can withdraw it at any time. You can also set your browser to refuse cookies, though parts of the Services may then not work as intended.

6. How we use your information

We use your personal information to provide and operate the Services, process orders and payments, arrange delivery, maintain and secure your account, communicate with you about your orders, provide customer support, verify identity, prevent fraud and abuse, understand and improve how the platform works, send you marketing where you have agreed to receive it, give vendors reports on their own orders, comply with our legal and tax obligations, and establish or defend legal claims.

7. Lawful basis for processing

We process personal information only where we have a lawful basis under the NDPA 2023. Depending on the processing, that basis is: performance of our contract with you (fulfilling and delivering your orders); your consent (marketing, non-essential cookies); compliance with a legal obligation (tax, record-keeping, lawful requests); or our legitimate interests (fraud prevention, platform security, service improvement), where these are not overridden by your rights. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

8. Who we share it with

We do not sell or rent your personal information. We share it with:

a) Vendors, so they can prepare and fulfil your order, and resolve complaints relating to it. They receive your name, your order details, and your phone number.

b) Logistics partners and riders, so your order can be collected and delivered. Deliveries are currently carried out by Munch Box who receives the information needed to complete the delivery, including your delivery address, delivery instructions and a means of contacting you. That partner is bound by contract to protect your information and to use it only for the delivery. We may in future operate our own rider fleet, in which case the same limits apply.

c) Service providers who support the platform, including payment processing, cloud hosting, messaging and notifications, analytics and customer support tooling. They act on our instructions under written agreements and may not use your information for their own purposes.

d) Banks, payment providers and fraud prevention services, to process transactions, refunds and chargebacks and to verify users.

e) Professional advisers, auditors and investors, and, in a merger, acquisition or sale of the business, the counterparty to that transaction, under confidentiality protections.

f) Law enforcement, regulators and courts, where required or permitted by law, or where necessary to establish or defend legal claims.

g) Anyone else you consent to or direct us to share with.

We may also share aggregated or anonymised information that cannot be used to identify you.

9. Our relationship with vendors

Choba is a marketplace and logistics platform. Vendors listed with us are independent businesses that we onboard onto the platform; we are not affiliated with them, and we do not prepare, produce or package what they sell.

We do not warrant that a vendor's descriptions, images, prices, ingredient or allergen information are accurate or complete, and we are not responsible for the quality or fitness of the items they supply. Our responsibility is to facilitate your order and arrange its delivery to the address you provide once payment is confirmed. If something is wrong with an order, contact our support team and we will help you resolve it.

10. Third-party services and links

Our platform may include links to or integrations with services operated by third parties, including social media platforms and payment providers. These operate under their own privacy policies, which may differ from ours. We do not control them and are not responsible for how they handle your information — please read their terms before using them.

If you contact us on social media, avoid posting account details or payment information publicly. Use a direct message, email or our in-app support instead.

11. Security and storage

We use physical, technical and administrative safeguards to protect your information against loss, misuse, unauthorised access and alteration. These include encryption in transit and at rest, TLS across our website and applications, firewalls, access controls and authentication requirements, and monitoring. Access within our organisation is limited to people who need it to do their job, and they are bound by confidentiality obligations.

Personal information is stored on servers located in United States of America (USA) and Ireland, and operated by Railway and Supabase. Where information is transferred outside Nigeria, we ensure the transfer complies with the NDPA 2023 and that appropriate safeguards are in place.

No system is completely secure. If a breach occurs that is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, you.

We will never ask for your password, one-time passcode, PIN or full card number through an unsolicited call, message or email. If you think your account has been compromised, contact us immediately.

12. How long we keep it

We keep personal information only as long as we need it for the purposes in this Policy or as long as the law requires. As a general rule, account and transaction records are retained for seven (7) years after your last active use of the platform. When information is no longer needed, we delete it or anonymise it permanently.

13. Marketing

Where you have consented, we may send you offers, promotions and vendor news by email, SMS or push notification. You can opt out at any time using the unsubscribe link in any marketing email, the opt-out keyword in any marketing SMS, your in-app notification settings, or by emailing hello@choba.app.

Opting out does not stop service messages you need — order confirmations, delivery updates, receipts, security alerts and notices about changes to our terms.

14. Your rights

Under the NDPA 2023 you can ask us to: confirm what personal information we hold about you; give you access to it; correct anything inaccurate or out of date; delete information we no longer need or that we hold on your consent; restrict or object to certain processing, including direct marketing; give you a copy of the information you supplied in a portable format; or withdraw your consent.

To make a request, email support@choba.app. We may ask you to verify your identity first, and we will respond within the period the law requires. If we cannot act on a request, we will explain why.

You can delete your account in the Choba application. We may retain some information afterwards where there is an unresolved dispute or outstanding balance, where the law requires it, or where we need it to defend a legal claim or prevent fraud.

If you are unhappy with how we have handled your information, please contact our Data Protection Officer — and you also have the right to complain to the Nigeria Data Protection Commission (NDPC).

15. Data Protection Officer

We have not appointed a Data Protection Officer. You can contact us about anything in this Policy or about your personal information at support@choba.app.

16. Governing law

This Policy is governed by the laws of the Federal Republic of Nigeria. Where any provision conflicts with applicable law, that law prevails to the extent of the conflict and the rest of this Policy continues to apply. This Policy applies to everyone who uses the Choba Services or submits information to us.

Last reviewed: August, 2026.
www.choba.app · support@choba.app