Privacy policy

Campus Hub Ltd (RC 1710580, a private company limited by shares registered with the Corporate Affairs Commission of Nigeria) operates CarryMeGo for users in Nigeria and is the data controller for your personal data under the Nigeria Data Protection Act 2023.

“CarryMeGo”, “we” and “us” in this policy mean Campus Hub Ltd. You can reach us about anything in this policy at support@carrymego.com.

This policy explains how we handle personal data when you use carrymego.com and the CarryMeGo app, whether you post or join delivery routes as a customer or carry them as a Runner. It does not cover the restaurants and vendors (Local Spots) you buy food from: you deal with them directly, and they handle your data under their own policies.

When you create an account:

• Your email address, used to sign you in with a one-time code.
• If you choose Google sign-in, the basic profile Google shares with us: your name, email address and profile picture.
• Your display handle. Other people see your handle, never your full name.
• Your country, which you confirm at signup.
• An optional phone number. We do not verify it, and we show it only to the matched Runner or customer while a delivery is in progress.
• The date and time you accepted the chat disclosure and confirmed that you are 18 or older.

When you become a Runner, we also collect:

• Your transport mode and your caution deposit choice.
• For Runners in Nigeria, your National Identification Number (NIN), which you type in. We store it as entered, and only you and authorised CarryMeGo staff can see it.
• The result of your identity verification: the decision, the type of document you used, its expiry date and the verification session reference. We never store a picture of your document or your selfie.
• If you verify by video call instead, a short record written by our staff: when the call took place, the type of document seen, and whether the name and face matched. Nothing from the call is recorded or uploaded.

We also keep records of the decisions our staff make about accounts (for example approving or rejecting a Runner), and basic technical data needed to run and secure the service, such as your sign-in session and the country suggested by your connection when you sign up.

We use personal data only for these purposes:

• To provide the service you asked for (performance of our contract with you): creating and securing your account, matching customers and Runners on routes, showing your handle and, during a delivery, your phone number to your counterpart, and sending service emails such as sign-in codes and verification decisions.
• To keep people safe and prevent fraud (our legitimate interests, and our legal obligations where they apply): verifying the identity and age of Runners before they can carry anyone's order, checking that documents are valid and unexpired, keeping chats long enough to resolve disputes, and acting on reports.
• To meet legal obligations: keeping records the law requires and responding to lawful requests from authorities.
• With your consent where we ask for it, which you can withdraw at any time without affecting what we did before.

We do not sell your personal data, we do not use it for advertising, and we do not build marketing profiles about you.

Runners verify their identity with Didit, an identity verification provider. Didit captures a photo of your document and a selfie, and checks that the document is genuine and unexpired, that you are a live person, that your face matches the document, and that you are 18 or older. Didit holds the images under its own terms; we receive only the result.

Didit's checks are automated. A passing result still goes to a CarryMeGo staff member, who approves you before you can carry orders. If an automated check declines you, you can try again, or email support@carrymego.com and ask for a person to review the decision. Runners in Nigeria who hold only a NIN slip can verify by video call with our staff instead.

We share personal data only as needed to run CarryMeGo:

• Other users: your handle, and during an active delivery your phone number and chat messages, with the matched Runner or customer only.
• Service providers who process data for us, under terms that require them to protect it and use it only to provide their service to us: Supabase (database and sign-in), Netlify (website hosting), Resend (service emails), Didit (identity verification) and Google (only if you choose Google sign-in).
• Payment providers: payments are not live yet. When they are, Paystack will process payments in Nigeria, and we will update this policy before any payment data is collected.
• Authorities, when the law requires it, or when it is necessary to protect someone's safety or to establish or defend a legal claim.

Our database and several of our service providers operate outside Nigeria, including in the United States. When your personal data is transferred abroad, we rely on the safeguards permitted by the Nigeria Data Protection Act 2023, including the data processing terms our providers have committed to, and we transfer only what each provider needs.

• Your account data: for as long as your account is open. When you ask us to close your account, we delete or anonymise it, except what we must keep for a legal obligation, an open dispute or the defence of a legal claim.
• Chats between a Runner and a customer: 30 days after the delivery ends, longer only if the chat is attached to a dispute, and then deleted.
• Verification bookkeeping (the technical record that a verification update arrived): 90 days.
• Records of staff and safety decisions: kept as an audit trail for as long as needed to account for those decisions.

Data travels over encrypted connections. Access is limited by role: each user can read only their own account data, and staff access is restricted and logged. We never store identity document images or selfies.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Nigeria Data Protection Commission (NDPC) within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

Under the Nigeria Data Protection Act 2023 you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data, or restrict how we use it;
• stop using it where we rely on our legitimate interests;
• give you your data in a portable format;
• withdraw a consent you gave us; and
• have a person review a decision about you that was made automatically, such as an identity verification result.

Email support@carrymego.com from the address on your account. We may ask you to confirm your identity, and we reply within 30 days. Exercising your rights is free.

If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission (NDPC).

CarryMeGo is only for people aged 18 or older, and every account confirms this at signup. If we learn that an account belongs to someone younger, we close it and delete its data.

• A sign-in session cookie, so you stay signed in.
• A setting in your browser that remembers whether you dismissed the install prompt.
• We do not use advertising or analytics cookies.

We update this policy before a change in how the product handles personal data takes effect. The date at the top shows when it last changed. If a change is significant, we also tell you by email or in the app.

Questions or requests about your personal data: support@carrymego.com. Data controller: Campus Hub Ltd.