Privacy Policy

Who is responsible

ROZY APP SERVICES operates ROZY and is responsible for the personal information processed for its platform. For privacy questions or requests, email hello.rozyapp@gmail.com. This notice covers ROZY, not independent restaurant websites or other services you visit through external links.

Information we use

Account and contact information includes your name, email address, phone number, account identifier and role. Authentication information is handled through our authentication provider, Supabase.

Ordering information includes your cart, chosen restaurant and meals, delivery address and instructions, order history, delivery confirmation records, payment references, wallet transactions and support messages. We receive payment results from Paystack; card-entry information is handled through the payment provider rather than requested in support messages.

Partner information includes the application details you submit, such as restaurant or residential address, relevant rider or restaurant details, application status and payout bank details. Browser or device information includes notification subscription details, permission choices, session information and technical request data processed by our hosting providers.

Location and device permissions

When you choose Use my location and permit device access, ROZY uses the coordinates supplied by your device to check delivery availability, estimate distance and delivery charges, and support fulfilment. Saved delivery coordinates can remain in your account until updated or removed through an appropriate request.

Rider tracking uses device location while the rider's delivery-tracking feature is active, so relevant customers and authorised operations staff can follow delivery progress. Device or browser settings let you revoke location permission. Denying access can prevent location-dependent functions from working; it does not mean that ROZY can identify your exact position without permission.

Push notifications require your browser or device permission and a saved subscription. You can manage them through the available ROZY settings or your device settings. Push delivery involves your browser or operating-system provider, and notifications may be visible on your lock screen.

Why we process information

We use information to create and secure accounts, review partner applications, fulfil orders, calculate charges, process payments and payout requests, provide order updates and resolve support issues.

Our processing relies on the applicable lawful basis: performing the service you request, meeting legal and accounting obligations, or legitimate interests such as preventing fraud and resolving disputes, subject to your rights. Permission-based features, including optional push notifications, use your consent where required. Withdrawal of consent does not invalidate earlier lawful processing.

Who receives information

Relevant restaurants, ROZY purchasing representatives and riders receive the information needed for their part of an order, which may include meal choices, contact details, delivery instructions and delivery location. Authorised administrators access information needed for operations, support, security or finance. Account access does not give other customers permission to read your records.

Service providers include Supabase for authentication and database services, Netlify for hosting, Paystack for payment and payout processing, and browser or operating-system providers for push notifications. Embedded maps request map tiles from OpenStreetMap infrastructure; these requests expose technical information such as your IP address and the requested map area to the map service.

If you contact us through WhatsApp, that service also processes your messages under its own privacy terms. We may disclose relevant records to authorities, banks or professional advisers where legally required or necessary to investigate fraud, handle disputes or protect rights. We do not sell your personal information.

Browser storage and security

ROZY uses browser storage for functions such as maintaining your session, saving account-specific cart or checkout state, and remembering interface choices. Some information is stored on your device and some in our database. Clearing browser data can remove local information without deleting server-side account or transaction records.

ROZY does not use advertising-tracking scripts in its current application. Hosting and infrastructure providers may maintain technical logs under their own terms. We use authentication and access controls to restrict records, but no online service can promise absolute security. Do not send passwords, OTPs, bank PINs or full card details to support.

Retention and international processing

We retain information for the time needed to provide the service and address legitimate accounting, legal, fraud-prevention or dispute requirements. Different records can need different retention periods; an account-deletion request does not automatically erase records that must lawfully be retained.

Our infrastructure providers may process information outside Nigeria. Applicable data-protection requirements and appropriate safeguards must be observed for such transfers. You can contact us to ask about the providers and safeguards relevant to your information.

Your choices and rights

Subject to applicable Nigerian data-protection law, you can request access to your information, correction of inaccurate information, deletion, restriction or objection to processing, and portability where applicable. You can withdraw consent for consent-based processing and request human review of decisions where the law provides that right.

Email hello.rozyapp@gmail.com to make a request or complain about data handling. We may need proportionate identity verification before acting, to protect your account. Requests are reviewed manually and handled within applicable legal time limits; this page is not an automatic account-deletion tool. You may also complain to the Nigeria Data Protection Commission at https://ndpc.gov.ng.

Children and changes to this notice

ROZY is intended for adults who can enter into transactions. If you believe a child has provided information without appropriate authorisation, contact us so we can review it.

We will update this notice when our practices change. The last-updated date appears below. Where a material change requires notice or renewed consent, we will provide it as required by law.