How Comuta handles your information

1. Who we are

Comuta Technologies Ltd. ("Comuta", "we", "us") operates a recurring carpool marketplace that connects riders and drivers travelling the same routes in Nigeria. We are the data controller for the personal data described in this policy. You can reach us about privacy at support@comuta.com.ng. A Data Protection Officer will be formally designated before public launch.

2. Information we collect

Information you give us

• Account details: your name, email address and (where enabled) phone number.
• Identity and verification data: government-issued ID, National Identification Number (NIN), a selfie or liveness image, and for drivers a driver’s licence and vehicle documents. This is used only to confirm who is travelling.
• Trip data: pickup and drop-off stops, dates, times, seats, bookings, cancellations, boarding codes and the routes you post or book.
• Payment references: Comuta never receives or stores your full card number. Card payments are handled by our processor, Paystack, on their own hosted checkout; we retain only a transaction reference and status.
• Ratings, reviews and any reports or safety incidents you submit, including photos you attach to a report.
• Support messages you send us.

Information we collect automatically

• Device and app information needed to deliver push notifications (a device push token).
• Location data, when you grant permission, to match you to routes and — for a live trip — to show a trip’s progress on a map. Precise driver location during an active trip is used only for that trip and is deleted shortly after it ends.
• Basic diagnostic and crash information to keep the app working. Crash reporting is handled by Sentry. Reports from the app may be tied to your account ID, never to your name, email or phone number; reports from the website carry no account ID.
• Anonymous usage analytics, only if you allow it: which screens and steps are used, so we can improve them. This is handled by PostHog, hosted in the EU. On the website it runs only if you accept analytics in the cookie banner; in the app it is an opt-in setting, "Share anonymous usage data", that is off until you turn it on. It is tied only to an internal account ID, never to your name, email, phone number, ID documents, bank details, exact addresses, locations or booking PINs, and there is no session recording.

When you choose to share a trip with someone, we access only the single contact you pick from your device. We do not upload or store your address book.

3. Why we use your information

• To create and secure your account and to match riders with drivers on the same route.
• To verify identity and eligibility, so people know who they are travelling with.
• To take payment for a seat, confirm bookings and issue refunds.
• To operate safety features: trip sharing, live trip tracking, incident reports and SOS.
• To send you service messages and, with your permission, push notifications about your trips.
• To meet legal, accounting and tax obligations, and to prevent fraud and abuse.

We rely on your consent, the performance of our contract with you, our legitimate interests in running a safe marketplace, and compliance with legal obligations, as the lawful bases for these uses.

4. Who we share it with

We do not sell your personal data. We share it only as needed to run the service:

• With other members, but only in a limited form: a rider and driver on the same trip see each other’s first name, initial, photo and rating, and a masked vehicle plate. Full contact details are not exposed.
• With Paystack, our payment processor, to take payment and issue refunds.
• With Supabase, which hosts our database and authentication, and Resend, which sends our emails, acting as our processors under contract.
• With Sentry, for crash diagnostics. From the app these may be tied to your account ID; from the website they carry none.
• With PostHog, hosted in the EU, for usage analytics, only if you have allowed it as described above.
• With our safety team when you raise an incident or SOS, so it can be actioned.
• With law enforcement or regulators where we are legally required to, or to protect people’s safety.

5. How long we keep it

We keep personal data only as long as we need it. When you delete your account, your profile is removed and scheduled for purging, and your ID documents, selfie and identity check results are deleted straight away. Payment records are kept for six years after deletion, as Nigerian company and tax law requires, and are then permanently deleted. Live trip locations are deleted shortly after a trip ends.

6. How we protect it

Access to your data is controlled by row-level security in the database, so members can only reach their own records. Staff access is scoped to what a role needs and is limited to a small team. Sensitive data is encrypted in transit and at rest, and administrative actions are logged. No system is perfectly secure, but these controls are built into the product rather than added on top of it.

7. Your rights

Under the NDPA and NDPR you have the right to access your data, correct it, delete it, object to or restrict certain processing, withdraw consent, and receive a copy in a portable form. You can delete your account and its data from the Account screen in the app, or contact us at support@comuta.com.ng. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

8. Your data under the NDPA

Sensitive personal data

Your NIN, ID documents and the selfie used to check your identity are sensitive personal data under the NDPA, because a selfie compared against an ID photo is biometric data. We collect them only with your explicit consent, at the point you start verification, and use them only to confirm who is travelling. You can withdraw that consent at any time by deleting your account, which removes them.

Data stored outside Nigeria

Our database, sign-in, crash reports and optional analytics are hosted in the European Union, by Supabase, Sentry and PostHog. Emails are sent through Resend, which may process them in the United States. Payments are handled by Paystack in Nigeria. We transfer data abroad only to providers bound by contract to protect it to a standard the NDPA accepts, and only what each provider needs to do its job.

Answering your requests

To use any of your rights, email support@comuta.com.ng from the email address on your account, or use the in-app controls. We may ask you to confirm it is you before we act. We reply within 30 days and do not charge for a reasonable request.

If something goes wrong

If a breach of security puts personal data at risk, we will report it to the NDPC within 72 hours of becoming aware of it, and tell the people affected without delay where the breach is likely to put them at high risk, along with what they can do to protect themselves.

9. Children

Comuta is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, contact us and we will remove it.

10. Changes to this policy

We may update this policy as the product and the law change. We will post the new version here and, for significant changes, tell you in the app. The date at the top shows when it was last updated.

11. Contact us

Questions about privacy or your data? Email support@comuta.com.ng and include enough detail for us to find your account.