Privacy Policy

Last updated: August 2026

ShareRide2Go ("we", "our", "the platform") is committed to protecting your personal data in accordance with the Nigeria Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and the guidelines of the National Identity Management Commission (NIMC). This policy explains what data we collect, why we collect it, how we protect it, and your rights as a data subject.

1. Who we are

ShareRide2Go is a Nigerian intercity carpooling platform that connects drivers making private journeys with passengers travelling the same route. We are registered in Nigeria and operate under Nigerian law.

Contact: support@shareride2go.com

2. What data we collect

Account data: Full name, email address, phone number, and password (stored as a secure hash — we never store your actual password).

Identity verification — Virtual NIN (vNIN): We verify your identity using your Virtual NIN (vNIN) — a temporary 16-character code you generate from NIMC via USSD (*346*3*NIN*SR2GO2024#) or the NIMC mobile app. We do not collect, store, or transmit your raw 11-digit NIN. This complies with the Nigeria Data Protection Act 2023 and NIMC regulations, which prohibit the direct collection of raw NIN by third parties.

Biometric data: A live selfie photograph taken during registration. This is compared against your NIMC government photo by Didit's face-matching service. The selfie is also used as your driver profile photo so passengers can identify you at pickup. We store only the result of the face match (pass/fail and confidence score) — we do not retain the NIMC government photo after verification is complete.

Payment data: Bank account name and number (for driver payouts), collected and verified through Paystack. We do not store card numbers. Paystack handles all payment processing under CBN regulations.

Journey location evidence: When a driver taps "Start Journey" and "Complete Journey" in the app, the device's GPS records the coordinates at that moment. These coordinates are sent to our server and stored as journey evidence. We also resolve the coordinates to a human-readable address using Google Maps. A static map image of the location is generated and stored. This evidence is used exclusively for dispute resolution — for example, to verify whether a driver was at the agreed pickup location or whether a journey was completed. We do not track your location continuously during a journey. GPS evidence is captured only at journey start and journey completion.

Trip data: Ride history, booking history, ratings, and reviews.

Referral data: If you use a referral code or share one, we record the referral relationship, ride credits earned, and milestone achievements. Ride credits are non-transferable, non-withdrawable, and expire 12 months from the date they are earned.

Device data: Device and browser identifiers used for security analysis (detecting suspicious login patterns and fraud). We do not link device data to advertising profiles.

Communications: Messages sent through the in-app ride chat between drivers and passengers.

3. Why we collect it

• Account management — to create and maintain your account
• Identity verification — vNIN and biometric face match ensure every driver and passenger is a real, identifiable Nigerian citizen, compliant with NIMC guidelines
• Safety and dispute resolution — GPS journey evidence provides verifiable proof of pickup and drop-off locations in the event of a dispute
• Payment processing — to collect fares and pay drivers through Paystack
• Ride coordination — to match passengers with drivers on the same route
• Notifications — to alert you about bookings, ride updates, and payments
• Referral system — to track and issue ride credits for verified referrals
• Fraud prevention — device and IP analysis to detect account abuse
• Legal compliance — to meet our obligations under Nigerian law

4. How we share your data

We do not sell your data. We share only what is necessary:

• Paystack — payment processing. Paystack's privacy policy applies to payment data.
• Dojah / QoreID — NIMC-approved vNIN verification providers. Your vNIN code is sent to query the NIMC database. We receive your name, date of birth, and NIMC government photo. Your raw NIN number is never transmitted to us.
• Didit — biometric face-matching service. Your NIMC government photo and live selfie are compared to produce a face match score. Didit is bound by their data processing agreement and NDPC guidelines.
• Google Maps — GPS coordinates from journey evidence are sent to Google Maps to resolve the address and generate a static map image. Only coordinates are shared — no personal identity information.
• Africa's Talking / Termii — OTP SMS delivery. Only your phone number is shared.
• SendGrid — transactional email delivery (booking confirmations, account notifications). Only your name and email address are shared.
• Other users — your first name, profile photo, driver rating, and vehicle type are visible to other platform users. Your phone number, NIN, bank details, and GPS evidence are never shown to other users.
• Law enforcement — we will disclose data when required by a valid Nigerian court order or lawful directive from a Nigerian regulatory authority.

5. GPS journey evidence — detail

By registering as a driver on ShareRide2Go, you consent to GPS location evidence being captured at the start and completion of each journey you post. This is disclosed here and forms part of the terms you accept at registration.

• GPS is captured at two moments only: when you tap "Start Journey" and when you tap "Complete Journey"
• We do not track your location continuously during a journey
• Evidence includes: GPS coordinates, accuracy reading, resolved address, static map image, and a server-generated timestamp
• Evidence is stored securely and accessed only by ShareRide2Go staff in the event of a dispute
• Evidence is retained for 7 years alongside trip and payment records
• If a dispute is resolved and no further action is required, evidence may be anonymised after 12 months

6. How long we keep your data

• Active account data: retained while your account is active
• Trip, payment, and GPS evidence records: 7 years (Nigerian financial and safety record requirements)
• Referral credit records: 12 months from credit expiry
• Deleted accounts: personal data anonymised within 30 days of deletion request
• vNIN hash: deleted when account is deleted
• Biometric face match result: deleted when account is deleted

7. Your rights under the NDPA 2023

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and data
• Withdraw consent for non-essential processing
• Object to processing where our legitimate interest is the legal basis
• Request a copy of your data in a portable format
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng

To exercise any of these rights, email support@shareride2go.com. We will respond within 30 days.

8. Security

We use industry-standard security measures:

• All data transmitted over HTTPS (TLS 1.2+)
• Passwords hashed using bcrypt (never stored in plaintext)
• vNIN stored as a one-way SHA-256 hash only — raw vNIN is never retained
• Biometric face match score stored — not the biometric image itself
• Payment data handled entirely by Paystack (PCI-DSS compliant)
• GPS evidence stored in an access-controlled database, not publicly accessible
• Database access restricted to backend services only
• JWT authentication tokens expire after 60 minutes
• Device and IP analysis active on all registrations to detect fraud

9. Cookies and local storage

We do not use advertising cookies or third-party tracking. We use only essential session storage in your browser to keep you logged in. This is necessary for the app to function and does not require your consent under the NDPA 2023.

10. Children

ShareRide2Go is not intended for users under 18 years of age. We do not knowingly collect data from minors. vNIN verification through NIMC also serves as an age confirmation — only registered adult Nigerians have an NIN. If you believe a minor has created an account, contact us immediately at support@shareride2go.com.

11. Changes to this policy

We will notify registered users by email and in-app notification at least 14 days before making material changes to this policy. Continued use of the platform after that notice period constitutes acceptance of the updated policy.

12. Contact and data controller

ShareRide2Go is the data controller for all personal data processed under this policy.

For privacy questions, data requests, or complaints:
Email: support@shareride2go.com
ShareRide2Go, Nigeria

For NDPC complaints: ndpc.gov.ng