Privacy policy

Last updated: 5 November 2026 · Version 2

This policy explains how CDG Nexus ("CDG", "we", "us") handles personal data when you use the CDG Nexus app, our website and our customer support. We follow the Nigeria Data Protection Act 2023 (NDPA) and the General Application and Implementation Directive 2025 (GAID) issued by the Nigeria Data Protection Commission (NDPC). We collect only what we need, keep it only as long as we need it, and never sell it.

1. Who we are and how to reach us

CDG Nexus is the data controller for the personal data described here.

• Address: [Your Ibadan address], Oyo State, Nigeria
• Email: [privacy@yourdomain]
• WhatsApp: 0706 298 2971
• Data Protection Officer (DPO): [Name], [dpo@yourdomain]. You can contact our DPO about anything in this policy.

2. What we collect

From everyone who uses the app

• Account: phone number, name, city and area, profile photo (optional for customers).
• Bookings and deliveries: pickup and drop-off addresses, receiver's name and phone number, job details, dates, prices, booking status, reviews you write.
• Messages: chats and photos you send inside the app.
• Delivery tracking: delivery progress updates, estimated arrival times, the 4-digit delivery code (shown only to the customer) and any report you make about a delivery.
• Payments: amount, date, reference and status from our payment partner. We never see or store your full card number, PIN or CVV.
• Device: a notification token, app version and basic error reports so the app works and we can fix crashes.

From sellers (artisans, delivery companies, riders, landlords, developers, car dealers)

• Identity: National Identification Number (NIN), and the result of checking it against your name and photo.
• Business: business name, CAC registration number, services, prices, rate cards, areas covered, vehicles.
• Photos and videos: profile photo, intro or work videos, photos of past work, pickup and delivery photos, finished-job photos and videos, receipts for materials.
• Property documents (landlords): ownership papers such as the C of O. These are kept in private storage and only our verification team can open them.
• Riders (delivery companies): each rider's name, phone number, face photo, vehicle and plate. The company must tell its riders that it shares these with CDG, and customers see them only for their own delivery.
• Payouts: wallet balance and, when withdrawals are switched on, the bank account you choose for payouts.

From our website: what you type into the waitlist or seller forms (name, phone, city, area, interests, business details).

We do not collect your contacts, your exact live location in the background, or your health, religion, political or biometric data, other than the face match in section 5.

3. Why we use it, and our lawful basis

• To provide the service you asked for (contract): creating your account, matching you with sellers, bookings, deliveries, chat, holding and releasing payments, refunds.
• To keep the platform safe (legitimate interest, which we have assessed and documented, and legal obligation): verifying sellers, preventing fraud and fake reviews, investigating disputes, and warning when someone asks to be paid outside the app.
• To meet the law (legal obligation): tax and accounting records, and lawful requests from regulators, courts or the police.
• To verify your identity (consent, which you can withdraw): checking your NIN and comparing your face with your NIN photo.
• To send you news and offers (consent only): launch news, promotions and surveys. You can stop these at any time, and saying no never affects your account.
• To answer you in "Ask CDG", our AI help assistant (contract and consent): see section 6.

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing doesn't affect what we did before, but we may not be able to keep offering a service that depends on it, for example selling on CDG without a verified NIN.

4. Who we share it with

We share the minimum needed, only with:

• The other side of your booking. For example, the delivery company sees the pickup address and the receiver's phone number; the customer sees the seller's name, photo, rating and prices. Exact home addresses for viewings are shared only after a viewing is confirmed.
• Service providers who process data for us, under written contracts that require them to protect it and use it only on our instructions:
  • Paystack (payments and payouts)
  • Supabase (database, storage and login)
  • Termii (SMS login codes)
  • Expo and Google Firebase (app updates and push notifications)
  • our identity verification provider (NIN checks)
  • Anthropic (the AI model behind Ask CDG)
  • our website and email hosts
• Authorities, when the law requires it, or to protect someone's life or safety. We check every request is lawful and share only what is required.
• A buyer or investor, if CDG is sold or merged. They must protect your data under this policy, and we will tell you first.

We do not sell your personal data, and we do not share it with advertisers.

5. Identity checks and automated decisions

Every seller must give their NIN. Our team, or our verification provider, checks that the NIN is real, that the name matches, and that the profile photo matches the NIN photo. The result (verified or doesn't match) is stored. The NIN itself can only be seen by our verification team, never by customers or other sellers.

Some checks may be automatic, such as fraud flags on unusual payments or the face match. A person on our team reviews any decision that rejects, suspends or refuses to pay you, and you can ask us to explain it and challenge it.

6. Ask CDG (AI assistant)

• When you use Ask CDG, your message is sent to our AI provider to write a reply. We only send the message and the conversation so far. We don't send your phone number, NIN, payment details or address.
• Don't type personal details such as your NIN, card number or address into Ask CDG.
• Our AI provider doesn't use your messages to train its models. We keep a count of how many messages each account sends, to prevent abuse, but we don't store the conversations themselves.
• Ask CDG can make mistakes. It can't make bookings, payments, refunds or verification decisions for you. Those always go through the app or our team.

7. Where your data is stored

Some of our providers store data on servers outside Nigeria. When data leaves Nigeria we follow Part VIII of the NDPA: we use providers in countries or under contracts that give adequate protection, and where the law requires it, we ask for your consent. You can ask us for details of the safeguards we use.

8. How long we keep it

• Account details: while your account is open, then deleted or anonymised within 90 days of closing it, except where the law requires longer.
• Booking, payment and wallet records: 6 years, for tax, accounting and dispute purposes.
• NIN and verification results: deleted 12 months after a seller account closes, unless there is an open dispute or fraud investigation.
• Property documents: deleted 12 months after the listing is removed.
• Chats, photos and videos linked to a booking: 2 years after the booking ends, or longer if a dispute is open.
• Website waitlist and seller forms: deleted 12 months after launch if you don't create an account.
• Error reports and logs: 90 days.

9. Your rights

Under the NDPA you have the right to:

• be informed about how we use your data (this policy);
• access your data and get a copy;
• correct data that is wrong or incomplete;
• delete your data (where we don't have to keep it by law);
• restrict or object to how we use it, including for direct marketing at any time;
• data portability: receive your data in a common format or have it sent to another provider;
• withdraw consent at any time;
• not be subject to a decision made only by automated means that seriously affects you, and to ask for a human review;
• complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

To use any of these rights, email [privacy@yourdomain] or WhatsApp 0706 298 2971 from the phone number on your account. We may ask you to confirm your identity. We reply within 30 days, free of charge. If a request is complex, we may extend this, but we'll tell you why within the first 30 days.

Closing your account: ask us using the contacts above. Account deletion from inside the app is coming soon. We will close the account, remove your public profile straight away, and delete or anonymise the rest as set out in section 8.

10. How we protect it

• All data is encrypted in transit (HTTPS/TLS).
• Database security rules mean each person can only reach their own data.
• NINs, property documents, chat photos and receipts sit in private storage that customers and other sellers can't open.
• Team access is limited by role, protected by password or phone code, and recorded.
• Card payments are handled entirely by Paystack, which is PCI DSS certified.
• We test our security rules automatically every time we change the app.

If a breach happens: we will notify the NDPC within 72 hours of becoming aware of it, as the law requires. If it is likely to put you at high risk, we will tell you directly and without delay, and say what happened and what you should do.

11. Children

CDG Nexus is only for people 18 and over. We don't knowingly collect data from anyone under 18. If you believe a child has created an account, contact us and we will delete it.

12. Cookies and tracking

Our website only uses what it needs to work. It has no advertising or cross-site tracking cookies. The app doesn't use advertising IDs. If we ever add analytics or advertising cookies, we will ask for your consent first and update this policy.

13. Changes to this policy

We'll post any changes here with a new date. If a change is important, we'll tell you in the app or by SMS before it takes effect, and ask for your consent again where the law requires it.

This policy is written to follow the NDPA 2023 and the GAID 2025. Before launch, a Nigerian data protection lawyer or a licensed Data Protection Compliance Organisation (DPCO) should review it, fill in the bracketed details and confirm whether CDG must register with the NDPC.