BridgitPrivacy Policy
Draft of 12 October 2026
DRAFT FOR LEGAL REVIEW. This policy is not yet in force. Highlighted items need to be confirmed by Bridgit and reviewed by a lawyer against the Nigeria Data Protection Act 2023 before it is published as final.
Who we are
Bridgit is a campus delivery platform. Students order meals from campus restaurants, and verified runners deliver them. The service is run by [legal company name, RC number and registered address] (“Bridgit”, “we”, “us”).
This policy covers the Bridgit mobile apps, ordering on the web, this website and the restaurant and admin dashboard. If you have a question about your information, email support@bridgitcampus.com. [Name or role of our Data Protection Officer, if appointed.]
What we collect
Everyone who has an account
- Your name, email address and, if you give it, your phone number.
- Your account type (student, runner, restaurant or admin) and your campus, which we work out from your email address.
- Sign-in records: the one-time codes we email you and the sessions that keep you signed in.
- If you allow notifications, a notification token for your device and whether it is Android, iOS or web.
- Error reports when the app crashes. We set error reporting not to send personal details such as your name or email.
Students
- An optional class or year you give at sign-up.
- Your orders: what you ordered, from which restaurant, the delivery location you type, any note, and the order’s progress.
- Your wallet balance and transactions: top-ups, payments, refunds.
- Messages you exchange with your runner, ratings you give, and any problem you report, including a photo if you add one.
Runners
- Verification details: the type of ID you use, a photo of your ID, a selfie and, if you ride, a photo of your vehicle with its type and plate number. We also keep the result of our review.
- Photos you take at pickup (the handoff photo) and at delivery (the proof of delivery).
- Your deliveries, earnings and wallet transactions.
- Your payout bank account: bank, account number and account name.
- Ratings students give you.
Restaurants
- Your business details, menu, prices, logo and food photos.
- Orders, earnings and payouts, and your payout bank account.
- Your dashboard sign-in email and password. We store passwords only in a protected (hashed) form.
Location
When an independent rider goes online, the app checks the phone’s location once, on the phone, to confirm they are on campus. That location is not sent to us or stored by us. Students’ delivery locations are what they type, not their device location. [Update this section before live order tracking launches: it will collect runners’ locations during a delivery.]
Payments
Card and bank payments are handled by Paystack. We never receive your full card details. We receive the payment’s reference, amount and result. To pay out runners and restaurants, we share their bank account details with Paystack.
What stays on your phone
Your app passcode is checked on your phone and stored there only in a protected form. If you unlock with a fingerprint or Face ID, your phone handles it. We never receive your fingerprint or face data.
How we use it
- To run your account, confirm you belong to a supported campus and keep your account secure.
- To verify runners before their first delivery.
- To place, prepare, deliver and track orders, and to hold your payment until you confirm delivery with your code.
- To process top-ups, refunds, earnings and payouts.
- To look into problems you report, resolve disputes and prevent fraud.
- To send you sign-in codes, password resets and notifications about your orders.
- To fix errors and improve the service.
We do not sell your personal information. [Confirm whether Bridgit will send marketing messages. If so, say how people opt in and out.]
We rely on these legal bases under the Nigeria Data Protection Act 2023: [to confirm with a lawyer] performing our contract with you, complying with the law, our legitimate interests in keeping the service safe, and your consent where we ask for it, for example for notifications.
Who can see your information
| Who | What they can see |
|---|---|
| The restaurant you order from | Your order and any note, and the details needed to prepare and hand it over. [Confirm whether restaurants see the student’s name.] |
| Your runner | The delivery location and note you gave, and your messages. They confirm delivery with your code; they don’t see your wallet. [Confirm whether runners see the student’s name.] |
| Students you deliver to (runners) | Your name and your messages. |
| Bridgit staff | Only what they need for their role: for example, reviewing runner verification photos, looking at delivery photos when a problem is reported, and checking payments. ID and delivery photos are kept in private storage and opened only through links that expire after 10 minutes. |
| Service providers | Companies that run parts of Bridgit for us, under contract: Railway (hosting, the Netherlands), Backblaze (photo storage, United States), Paystack (payments, Nigeria), Brevo (email, European Union), Google Firebase (notifications) and Sentry (error reports) [confirm whether Sentry is switched on in production]. |
| Authorities | When the law requires it, or to protect someone’s safety. |
Some of these providers store information outside Nigeria. [Confirm the safeguards relied on for these transfers under the Nigeria Data Protection Act 2023.]
How we protect it
Information travels encrypted between your device and our servers. Verification and delivery photos are stored privately, separate from public menu photos. Staff access is limited to people who need it, and passwords are stored only in hashed form.
How long we keep it
We keep your account information while your account is open. After that: [confirm each period]
- Runner verification photos: [for example, deleted within 90 days of the account closing or the application being rejected].
- Delivery and handoff photos, problem reports and messages: [for example, 12 months after the order, or longer while a dispute is open].
- Payment and wallet records: as long as Nigerian law requires us to keep financial records [confirm the period].
- Sign-in codes expire within minutes.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask to see the information we hold about you, correct it, delete it, receive a copy, object to how we use it, or withdraw consent you gave. You can also complain to the Nigeria Data Protection Commission.
Deleting your account
Email support@bridgitcampus.com from the email address on your account, with the subject “Delete my account”. We’ll confirm it’s you and reply within [30 days].
Please withdraw or use your wallet balance first. [Confirm what happens to a remaining balance.] We may keep some records after deletion where the law requires it, such as payment records, or while a dispute or fraud check is open.
Age
Bridgit is for people aged [18] and over. [Confirm the minimum age, and how younger students are handled.]
Changes to this policy
If we change this policy in a way that matters, we’ll tell you in the app or by email before the change applies.
Contact
support@bridgitcampus.com · [postal address]