Privacy Policy

7feastr Technologies Ltd (“7feastr”, “we”, “us” or “our”) is the data controller for personal data processed through the 7feastr website, the customer and agent apps, 7feastr City and 7feastr Logistics (the “Platform”). This Policy explains what we collect, why, who we share it with, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023 (the “NDPA”).

It applies to customers, agents, vendors and merchants, and to recipients of 7feastr Logistics shipments (Section 6).

1. The short version

• We collect what we need to take your order, get it to you, keep payments safe and run the service.
• We share your details with the restaurant and rider handling your order, and with the companies that help us run 7feastr.
• We do not sell your personal data, and we do not use third-party advertising cookies.
• You can see, correct, download or delete your data, subject to the legal records we must keep.

2. What we collect

Information you give us

• Account: name, email address, phone number, password (stored only in hashed form), profile photo and your 7feastr tag.
• Orders: what you order and the choices you make, delivery addresses and their map position, notes for the restaurant or rider, group orders you start or join, and your order history.
• Payments: payment references, amounts, wallet top-ups and withdrawals. Card details are handled by our payment providers; we never see or store full card numbers.
• Reviews and messages: ratings and reviews you leave, messages with riders in the in-app chat, and messages to our support team.
• Meal plans (optional): your diet, foods to avoid, goal, portion size, budget and meal times, and, only if you choose to give them, your height, weight and activity level. We collect these only with your consent, use them only to suggest meals, and you can delete them at any time.
• Agents: identity details, driver’s licence, vehicle information, verification documents, bank account for payouts, and an authenticator app link for confirming withdrawals.
• Vendors and merchants: business details, registration and identity documents, contact persons, settlement bank details and, for merchants, API keys and webhook settings.

Information collected as you use the Platform

• Location. With your permission, your device location, to suggest your address, show restaurants that deliver to you and save the exact delivery point. For agents, location is collected while they are online and during a delivery so orders can be dispatched and customers can follow their rider live. Agents can stop this by going offline.
• Device and usage. IP address, device model, operating system, app version, browser, push notification token, crash reports, and the screens and features you use.
• Product analytics. We use PostHog to understand how the Platform is used and where it breaks: for example, which screens are opened, where checkout is abandoned and which features are slow. Events are linked to your account ID once you sign in. Where we record sessions to diagnose problems, text you type, passwords and payment fields are masked before anything leaves your device.
• 7feastr City: your progress, coins, items, scores and any feedback you send from the game.
• API logs: for merchants, requests made to the 7feastr Logistics API with timestamps and key identifiers.

Information from others

• Payment providers tell us whether a payment succeeded.
• If you sign in with Google, we receive your name, email address and profile photo from Google.
• A vendor or rider may tell us about a problem with your order, and other users may mention you in a group order by your tag.

3. Why we use it, and our legal basis

• To provide the service you asked for (contract): creating your account, taking and delivering orders, live tracking, chat with your rider, group orders, wallet and payouts, shipments.
• To meet our legal duties (legal obligation): tax and accounting records, anti-money laundering and know-your-customer checks, and responding to lawful requests.
• To keep the Platform safe and working (legitimate interests): fraud and abuse prevention, securing accounts, resolving disputes, analytics, fixing bugs and improving features, personalising recommendations from your order history. We balance these interests against your rights and you can object (Section 9).
• With your consent: precise device location, meal-plan details including height and weight, marketing messages, and session recording on the web where we ask first. You can withdraw consent at any time in the app, in your device settings or by writing to us.

4. Who we share it with

We share only what each party needs:

• Restaurants and stores: your name, order, delivery area and any note, so they can prepare it. Restaurants are not shown your phone number in the Platform; our team contacts the restaurant on your behalf if needed.
• Riders: your name, phone number, delivery address and map pin, so they can deliver and contact you. Riders see your name next to any rating you leave them.
• Other users: your tag and first name to people in the same group order.
• Service providers who process data for us under contract: payment providers (such as Paystack and OPay), maps and address search (Google Maps Platform), cloud hosting and databases, image hosting (Cloudinary), push notifications (Firebase Cloud Messaging), email and messaging delivery, product analytics (PostHog), and internal tools our team uses for support.
• Authorities: regulators, law enforcement and courts, where the law requires it or where it is needed to prevent fraud or protect someone’s safety.
• A buyer of our business: if 7feastr is merged or sold, on terms that protect your data at least as well as this Policy.

5. Transfers outside Nigeria

Some of our providers store or process data outside Nigeria, including in the European Union and the United States. Where this happens we rely on the transfer grounds allowed by the NDPA, including contractual safeguards that give your data a level of protection equivalent to Nigerian law.

6. Shipment recipients

When a merchant sends a package through 7feastr Logistics, the merchant gives us the recipient’s name, phone number and address. For that data, the merchant is the controller and 7feastr acts as its processor. The merchant is responsible for having a lawful basis to share it. We use it only to deliver the package, provide tracking by tracking code and handle any dispute.

7. How long we keep it

• Account data: while your account is open, and up to two years after it closes, to deal with disputes and claims.
• Orders, payments and wallet records: at least six years, as tax and financial record-keeping law requires.
• Chat messages with riders: up to twelve months after the order, for safety and disputes.
• Rider live location: detailed trails are kept for up to ninety days after a delivery, then summarised.
• Verification documents: while the agent, vendor or merchant account is open, and afterwards for as long as anti-money laundering rules require.
• Analytics data: up to two years; recordings of sessions, up to ninety days.
• Meal-plan details: until you delete them or close your account.

8. Security

We encrypt data in transit, hash passwords, limit staff access to what each role needs, protect agent withdrawals with an authenticator app or email code, and protect merchant access with API keys. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, you, within the time the NDPA sets.

9. Your rights

Under the NDPA you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or restrict how we use it;
• give you the data you provided in a portable format;
• stop using your data for direct marketing, or object to processing based on our legitimate interests; and
• not subject you to a decision based solely on automated processing that has a legal or similarly significant effect on you.

You can also withdraw any consent you have given. Write to support@7feastr.com from the email address on your account; we may ask you to confirm your identity, and we will reply within the time the NDPA allows. Some data cannot be deleted while the law requires us to keep it (Section 7). You can complain to the Nigeria Data Protection Commission at any time.

10. Cookies and similar technology

• Essential: keep you signed in, protect your session and remember your cart. These cannot be switched off.
• Preferences: remember choices such as your delivery area and theme.
• Analytics: PostHog and Google Analytics help us see how the site is used. You can block them in your browser without affecting ordering.

We do not use third-party advertising or cross-site tracking cookies.

11. Children

The Platform is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, write to support@7feastr.com and we will delete it.

12. Changes to this Policy

We will update this Policy when our practices or the law change, and tell you about material changes by email or in the app before they take effect. The date at the top shows the latest version.

13. Contact us

For privacy questions or to use your rights, email support@7feastr.com or call +234 905 606 2230. You can also write to 7feastr Technologies Ltd, Attention: Data Protection, Lagos, Nigeria.