Privacy Policy

Pal (pal.com.ng) is a campus food marketplace operated in Nigeria, connecting customers with independent campus kitchens (vendors) and delivery agents (riders). For the purposes of the Nigeria Data Protection Act 2023, Pal is the data controller — we decide what personal data the service collects and why. You can reach us at [email protected] for anything in this policy.

This policy covers personal data handled through:

• The Pal app and website — including the installed app (PWA) on your phone.
• Emails we send you — order receipts, receipt codes, refund notices and account emails.
• The WhatsApp groups Pal links to from the app (the vendor coordination group and the customer group) — the groups themselves run on WhatsApp's platform under WhatsApp's terms, but joining through Pal links is a choice you make with us.
• Push notifications, support tickets and the in-app callback request form.

The contractual side of the service — refunds, suspension, prohibited conduct — is governed by our Terms of Service; this document is only about data.

Customers come in two kinds — guests, who check out with a phone number, and account holders. Here is exactly what we hold for each:

If you create an account

• Name, phone number and email address — the identity trio used for sign-in, receipts and order updates.
• Your password, stored only as a salted hash — never in readable form, not even by our staff.

If you order as a guest

• Name and phone number (and an email address if you provide one for receipts). No password, no profile — your phone number does the work.

When you order

• Order details: items, add-ons, total, delivery or pickup, and the full order timeline — every event, including receipt-code issues, re-sends and confirmations. The timeline is our audit trail when something goes wrong.
• Addresses: the address on each order, plus — for accounts — saved addresses and your address history, so re-ordering is one tap.
• Carts, favourites and group-buy rooms: what is in your cart, the vendors and items you marked as favourites, and any group room you opened or joined (room code, participant name, items you added).
• Loyalty progress: your punch-card count per vendor, tied to your phone number — guests included.

Money

• Payment status and references only — "paid by card via Kora Pay", a transaction reference, a refund record, wallet ledger entries. Card numbers and bank credentials are never collected or stored by Pal.

Messages and help

• Push subscription keys, if you opt into notifications; email receipts; support tickets you open, including the callback phone number you give us.

Running a kitchen or delivering on Pal means we hold business data about you, not just an account:

• Business profile: kitchen name, slug, description, menu content, photos, hours, contact person — for riders, the profile we vetted you against.
• Payout details: the bank account information you give us so we can pay you.
• Service records: the orders you accepted, cooked, delivered or rejected — with the timelines that show how each went (acceptance speed, prep promise kept, handovers verified with codes).
• Withdrawal history: every payout and withdrawal you have made, with amounts and dates.
• Login records — device, browser, session — so we can keep unauthorised people out of your tools.

Vendors also see their own customers' order data (items, address, phone — see the sharing section); it is provided to fulfil orders and must be used for nothing else.

Like every web service, Pal keeps a small amount of technical data. What we keep and why:

• Device and browser type — so pages render correctly and bugs are reproducible.
• Security and audit logs — sign-ins, failed code attempts, payment events, admin actions, with timestamps and IP addresses. These exist to investigate abuse (fake orders, code guessing, refund disputes) and are the record we turn to when a case is contested.
• Aggregate usage patterns — how often features are used, in summary form, to decide what to improve. These are analysed in aggregate, not tied to an ad profile — Pal runs no advertising network and builds no ad profile of you.

Your own device also stores session and preference data in the browser's local storage — that is under your control, and we list it in the cookies and local storage section.

Under the NDPA we can only process personal data with a lawful basis. Here is every purpose we put your data to, mapped to the basis it stands on:

• Taking and fulfilling your orders — placing them, routing them to the vendor, assigning a rider, confirming with the receipt code, and the receipts you get afterwards. Basis: performing the contract you entered by ordering.
• Running your account — sign-in, saved addresses, favourites, wallet, loyalty. Basis: performing the contract.
• Notifying you about your orders — push notifications (which you opt into), emails with your receipt code, and status updates. Basis: contract and consent — you can switch pushes off any time in your device or app settings.
• Group-buy coordination — the room code you share, the items participants add. Basis: performing the contract.
• Paying vendors and riders — payout details, ledger entries, withdrawal history. Basis: performing the contract.
• Fraud and abuse prevention — verifying code attempts, spotting fake orders, referral farming and chargeback abuse, and enforcing our Terms of Service. Basis: our legitimate interest in keeping the platform honest for everyone.
• Service improvement — aggregate usage patterns, crash and bug reports. Basis: legitimate interest.
• Legal and finance obligations — tax and accounting records, responding to lawful requests. Basis: legal obligation.
• WhatsApp groups — the vendor and customer groups we link from the app carry order announcements and coordination. Basis: consent — joining is your choice, and leaving a group never affects your account.

We do not use your personal data for automated decision-making or profiling that legally affects you, and we do not use it to target you with third-party advertising.

We share personal data only with the parties a job genuinely needs — never as a product to sell:

• The vendor on your order — sees the items, your name, the delivery address (or the pickup instruction) and your phone number: what they must cook, and how to reach you about it.
• The rider on your delivery — sees the pickup at the vendor and your address and phone number for the handover. Nothing else about your account.
• Kora Pay (our payment processor) — processes your card or transfer payments. They receive the payment data they need and hold card data under their own bank-grade, PCI-DSS-level security rules. Pal receives only a status and a reference back.
• Email and push providers — carry our messages (receipts, codes, updates) and receive only what is needed to deliver them.
• Hosting and infrastructure providers — run the servers and databases the platform lives on, under contractual confidentiality.
• Law enforcement and regulators — where we are legally required to disclose, or where we must protect the rights and safety of our users.

Pal is operated in Nigeria, but some of the processors above — payment, email, push or hosting providers — may operate servers outside Nigeria. Where your data crosses a border it travels only under safeguards: we transfer the minimum the service needs, over secured channels, under contractual protections with the provider, and in line with the transfer conditions the NDPA requires.

If a transfer arrangement ever changes materially, this policy is updated and the change is announced in the app.

We do not use advertising or tracking cookies. No ad networks, no third-party trackers, no profiling pixels. What we do use is your browser's local storage — data that lives on your own device — to make the app work:

• Cart — the items in your cart, so a refresh or an app install never loses your order in progress.
• Session — the sign-in token that keeps you logged in. It expires; it is not permanent.
• Theme — your light/dark preference.
• App preferences — the small choices you make: your saved delivery address pick, filters you set on the market page, view state like an open group room.
• Guest profile — if you check out as a guest, your typed details so the next order is faster — on your device, under your control.

You can clear local storage any time in your browser settings; the cost is losing your cart and preferences, not your account. Server-side, the sign-in cookie we set is http-only and expires on a schedule.

The honest rule: personal data lives as long as it has a job. Specifically:

• Account data — for as long as your account is open. Close it and your profile, saved addresses, cart-linked data, favourites and loyalty progress are deleted per the data deletion page.
• Guest order data — kept only as long as the order matters: fulfilment, support and the dispute window. Old guest data is de-personalised or deleted on a schedule.
• Financial records — orders, payouts, refunds and ledger entries are kept for the period tax and accounting law in Nigeria requires, then de-personalised: the numbers stay, the identities fade.
• Security and audit logs — kept long enough to investigate abuse and disputes, then pruned.

After your account closes, what remains is statistical or statutory — not a profile of you. The exact deletion mechanics, including what a closure request does to each data type, are documented on the data deletion page.

The defences we actually run, in plain language:

• Passwords are hashed — stored only as salted cryptographic hashes. Nobody at Pal can read your password; resets work through one-time links and codes, not by us looking it up.
• Sessions expire — sign-in tokens are http-only, scoped and expire on a schedule, so a stolen browser tab is a short-lived problem.
• Least-privilege access — only the staff who need personal data to do their jobs (a support case, a refund, a fraud investigation) can reach it, and vendor tools show vendors only their own orders.
• Audit logging — sensitive actions on the platform are logged, so misuse is traceable after the fact.
• Card data never arrives — payments run inside Kora Pay's checkout, so there is no card database of ours to breach.

No system is perfect, and we will not pretend otherwise. If a breach ever affects your personal data, we will notify affected users and the relevant authorities as the NDPA requires, and say plainly what happened and what we are doing about it. If you ever believe your account is compromised, contact [email protected] immediately.

The Nigeria Data Protection Act gives you real rights over your personal data, and we honour them:

• Access — ask what personal data we hold about you.
• Rectification — have wrong or outdated data corrected (a mistyped name, a dead phone number).
• Erasure — have your data deleted, in line with the retention rules above.
• Portability — receive your data in a structured, usable format where the law applies.
• Restriction — ask us to pause certain processing while a question about your data is resolved.
• Objection — object to processing that rests on legitimate interest (we weigh it seriously — the main ones are fraud prevention, and we will tell you if we cannot stop).

How to exercise them: use the request form on the data deletion page (it covers deletion, exports and corrections), or email [email protected] from the address or number on your account. We verify it is really you, and respond within 30 days — including an honest explanation if something cannot be done (for example, financial records the law requires us to keep, de-personalised).

Pal is not intended for children under 13, and we do not knowingly collect personal data from under-13s. The service is built for university students and campus adults.

Users aged 13 to 17 may use Pal with the involvement of a parent or guardian — the guardian may be the account holder or the payer, and orders for minors should be made under a guardian's supervision. If we learn that we hold data from a child under 13, we delete it.

If you are a parent or guardian who believes your child's data is on Pal, contact [email protected] and we will act on it directly.

As the service grows, this policy will grow with it. The effective date at the top always shows the current version; material changes are announced in the app before they take effect, and continuing to use Pal afterwards means the updated policy applies.

Anything unclear — or a request this policy does not cover — goes to [email protected], or the in-app support form from any page (footer → Leave feedback). We usually reply within a day.