Privacy Policy
Last updated: October 8, 2026
RideArrivo is operated by RICHATHAOIR LIMITED (CAC RC 1654710), which is the data controller for the personal data described here. This policy covers ridearrivo.com and the RideArrivo rider and driver apps. It sets out what we collect, why we collect it, the lawful basis we rely on, who else sees it, how long we keep it and what you can ask us to do about it, under the Nigeria Data Protection Act 2023 (NDPA) and the transport rules we operate under in Lagos State.
1. Who we are and how to reach us
- Data controller: RICHATHAOIR LIMITED, registered with the Corporate Affairs Commission under RC 1654710.
- Registered office: Babajide Sanwo-Olu International Market, Ikosi, Lagos, Nigeria
- Data Protection Officer: privacy@ridearrivo.com
- General enquiries: info@ridearrivo.com
2. Information we collect
- Account information: name, email address, phone number, WhatsApp number, preferred language, country of residence, date of birth, and a hashed password. We never store plain-text passwords.
- Identity documents: a photograph of a government ID or a passport number where we need to confirm who you are. For drivers, this also covers driver's licence number, LASDRI number, insurance details, vehicle documents and photographs, and the vehicle owner's name and contact details.
- Trip and booking data: pickup and drop-off addresses and coordinates, additional stops, flight number if you give one, luggage details, vehicle preferences and accessibility choices, trip history, fares and payment references.
- Location data: precise GPS location from riders and drivers during an active trip, and from drivers whenever they are online and available for work. We do not collect a driver's location while they are offline.
- Safety data: the emergency contact name and number you choose to add, panic alerts you raise, route-deviation events generated during a trip, and in-trip audio recording only if you switch it on yourself.
- Communications: messages and calls between rider and driver placed through the app, support tickets you open, and the operational emails and WhatsApp messages we send you.
- Device and technical data: device type and operating system, app version, a push notification token, and the IP address your requests arrive from, which our servers process in order to deliver responses and to block abuse.
What we do not collect. We do not run advertising or analytics trackers in the apps or on this website, we do not build advertising or marketing profiles, and we do not sell personal data.
3. How we use your information, and our lawful basis
Section 27 of the NDPA requires us to give the purpose and the lawful basis for each activity, not just the purpose. This is the full list.
| What we do | Lawful basis |
|---|---|
| Create and run your account, take bookings, connect you with a driver, calculate the fare, take payment and send receipts and trip updates | Performance of a contract with you |
| Show live trip location to you, to your driver, and to anyone you send a tracking link to | Performance of a contract with you |
| Verify driver identity, driver's licence, LASDRI registration, insurance and vehicle documents before a driver can accept rides | Legal obligation under Lagos State transport rules, and performance of our contract with the driver |
| Keep transaction, invoicing and tax records | Legal obligation |
| Respond to a valid order from a court, the police or a regulator | Legal obligation |
| Safety monitoring during a trip: panic alerts, route-deviation checks, and contacting your emergency contact during an incident | Protection of your vital interests or those of another person, together with our legitimate interest in keeping trips safe |
| Record audio during a trip | Your consent, given by switching the setting on. It is off unless you turn it on, and you can turn it off at any time. |
| Prevent fraud, secure accounts, apply rate limits and investigate abuse of the service | Our legitimate interest in protecting the platform and the people using it |
| Diagnose faults and keep the service reliable using operational records | Our legitimate interest in running a working service |
| Send optional marketing, waitlist or product-update email | Your consent, which you can withdraw at any time |
4. Automated processing and automated decisions
Some parts of the service run automatically. We think it is clearer to say exactly which, and what each one does:
- Rides are not allocated to you by an algorithm. A booking is offered to drivers who are online, and a human driver decides whether to accept it.
- Fares are calculated automatically from vehicle class, booking type, distance and duration. The price is shown to you before you confirm.
- Vehicle class is suggested automatically from the luggage you enter. You can override the suggestion.
- Route deviation is monitored automatically during a trip by comparing the vehicle's position and direction against the expected route. If something looks wrong it raises an alert for a person to review. The check does not by itself penalise a driver or a rider.
- Identity and driver verification is decided by a person on our team reviewing the documents. It is not automated, and we do not use an external background-check or credit-scoring provider.
We do not make decisions that produce legal effects concerning you, or similarly significant effects, by solely automated means, and we do not carry out profiling for advertising. If that changes, we will update this section before it starts, and you will be able to ask for a human to review the decision, to put your point of view, and to contest it.
5. Who we share your data with
We do not sell your personal data and we do not share it with advertising networks. It is shared in these situations only.
Other people using the service
- A matched rider and driver see each other's name, a way to contact each other through the app, and the trip's pickup and drop-off locations, for that trip.
- Anyone you choose to send a live tracking link to can see that trip's progress while it is running.
Service providers
These companies process personal data on our instructions in order to provide a specific part of the service. Each is engaged under a contract that allows them to use the data only for that purpose. This is the complete list of providers that actually receive personal data.
| Provider | What they do for us | Where they process it |
|---|---|---|
| Neon | Hosts our main database | United States |
| Render | Runs our backend servers | United States |
| Cloudflare | Serves this website and protects it from attack | Global edge network |
| Paystack | Takes card and transfer payments. Your card details go to Paystack and are never held by us. | Nigeria |
| Google Maps Platform | Address search, geocoding, and distance and travel-time estimates | United States |
| Mapbox | Recalculating a driver's route during a trip | United States |
| Stream | In-app chat and voice or video calls between rider and driver | United States |
| Resend | Sends account and trip emails | United States |
| Twilio | Sends WhatsApp messages about your booking | United States |
| Expo, with Apple Push Notification service and Firebase Cloud Messaging | Delivers push notifications to your device | United States |
| AviationStack | Looks up flight status when you enter a flight number | European Union |
| Google and Apple | Confirm your identity to us if you choose Sign in with Google or Sign in with Apple | United States |
| Supabase | Stores what you submit through our public enquiry, charter, membership and booking forms: your name, email address, phone number, message and trip details | European Union (Ireland) |
| Google Tag Manager and Google Analytics | Count visits to our public forms and how far people get through them, only if you accept analytics on those forms. We do not send the answers you type, such as your name, email address or phone number. Google receives your IP address and device details, as with any web request. | United States |
| Google Fonts | Serves the typefaces on this website, which means Google receives your IP address when a page loads | United States |
Law enforcement and legal requests
We will disclose user or GPS location data to police, government bodies, or legal authorities only when presented with a valid court order, subpoena, or legally binding mandate under Nigerian law, or in emergency situations involving immediate physical safety threats.
Business transfers
If the business is sold or reorganised, personal data may transfer to the buyer. We will tell you before that happens, and the data stays subject to this policy until you are told otherwise.
6. Storage, security and international transfers
- Security: data in transit is protected with HTTPS. Passwords are stored only as bcrypt hashes. Access to production data is limited to the people who need it for their work, sign-in tokens expire, and changes made through our internal tools are restricted to administrator accounts.
- Where your data is processed: we serve Nigeria, but the providers listed in section 5 operate mainly in the United States, with flight lookups and the storage of our public forms handled in the European Union. Your data is therefore transferred outside Nigeria.
- The basis for those transfers: under sections 41 to 43 of the NDPA we may send personal data outside Nigeria only on a recognised basis, and for each provider we check which basis applies and record that assessment. Where we rely on contractual clauses, we use them only after assessing that the safeguards they give are adequate for that provider and that transfer. Ordinary vendor terms are not treated as meeting the NDPA on their own. We rely on the transfer being necessary for a contract only where it is genuinely needed to deliver the trip you booked, for example a map lookup or a payment. If neither basis applies to a provider or a purpose, we will ask for your consent before transferring.
7. Cookies and similar technologies
This website sets no cookies, and it runs no analytics, advertising or tracking technologies. It stores three things in your browser's local storage, all of which are needed for the site to work:
- your sign-in token, so you stay signed in;
- your language choice; and
- the state of a safety feature while one is running, so that it survives a page reload.
Clearing your site data removes all three and signs you out. Because none of it is used for analytics, advertising or tracking, no consent banner is required for it.
The apps store a sign-in token on the device and hold a push notification token so we can send you trip updates. They contain no analytics, advertising or crash-reporting SDKs.
The one third party your browser contacts on these pages is Google Fonts, which receives your IP address in order to serve the typefaces.
Our public forms (forms.ridearrivo.com and the booking, membership, move, boat, air and easybook subdomains) work differently. They show a banner asking whether you accept analytics. Until you choose Accept, nothing from Google loads and no analytics cookies are set. If you accept, we load Google Tag Manager and Google Analytics to count visits and how far people get through each form. We do not send the answers you type into a form, such as your name, email address or phone number. You can change your choice at any time with the Analytics preferences link on those pages, and withdrawing stops further analytics.
If we ever add any other non-essential analytics or tracking, we will ask for your consent before it runs and give you a way to withdraw that consent.
8. How long we keep things
When you delete your account we remove or anonymise your personal data and keep only the minimum record we are legally required to hold. The account cannot be signed into again, and your email address is released so that it can be used for a new account.
| What | How long | Why |
|---|---|---|
| Account profile: name, email, phone, preferences | While your account is open. Removed or anonymised when you delete it. | Needed to provide the service |
| Trip invoice record: fare, currency, dates, status, vehicle class, pickup and stop addresses | 7 years from the trip | Statutory tax, accounting and dispute-resolution obligations |
| Precise GPS coordinates of a trip | Removed when you delete your account, and not part of the 7 year record | Finer than an invoice needs |
| Flight number | Removed when you delete your account | Says where you travelled, and is not needed to bill for a completed trip |
| Emergency contact name and number | Deleted with your account | Belongs to someone who never had an account with us |
| Support tickets | The type, status and dates are kept for the dispute trail. The text you wrote is removed when you delete your account. | Dispute resolution, without keeping your words longer than needed |
| Driver documents and photos: licence, LASDRI, insurance, vehicle and owner details | Removed when the account is deleted | Only needed while the driver is active |
| Rating comments you wrote | Removed when you delete your account | An opinion, with no tax or accounting purpose |
| Payment records held by Paystack | Per Paystack's own retention policy and Nigerian financial regulation | Held by Paystack for that purpose |
Deleting an account is blocked in two situations, so that nothing is lost by accident: while you have a trip that has not finished, and while there is money left in your wallet. The app tells you which one applies.
9. Your rights
Under the NDPA you can ask us to do any of the following.
- Access: confirm whether we hold data about you, and give you a copy of it.
- Correct: fix anything inaccurate or incomplete.
- Erase: delete your data. You can delete your account yourself in the app under Profile, or by emailing us. Erasure is subject to the records we are legally required to keep, listed in section 8, including tax, accounting, fraud-prevention and dispute-resolution obligations. Anything we are not required to retain is deleted or anonymised.
- Restrict: pause our processing while a dispute about the accuracy of your data, or about the grounds we rely on, is being resolved.
- Object: object to processing we carry out on the basis of legitimate interest.
- Port: receive the data you gave us in a structured, commonly used, machine-readable format, and have us send it to another provider where that is technically feasible.
- Withdraw consent: for anything we do on the basis of consent, such as in-trip audio recording or marketing email, withdraw it at any time. Withdrawing consent does not undo processing that already happened lawfully, and it does not affect anything we do on a different basis.
- Automated decisions: ask for a human to review any decision made about you by solely automated means, put your point of view, and contest the decision. As set out in section 4, we do not currently make decisions of that kind.
Email privacy@ridearrivo.com to use any of these. We will respond within 30 days, and there is no charge. We may need to confirm your identity first, so that we do not hand your data to somebody else.
If you are not satisfied with how we have handled it, you can lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
10. Minors
RideArrivo services are strictly intended for users aged 18 and older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@ridearrivo.com and we will remove it.
11. Changes to this policy
We may update this policy. The date at the top always shows the version currently in force, and it changes whenever the policy does.
If a change materially affects you, we will tell you directly by email or in the app, before or when it takes effect. Where a change involves processing that requires your consent, we will ask for that consent separately. We do not treat continued use of the app or website as agreement to a revised policy.
12. Contact
For privacy questions, to use any of the rights in section 9, or to reach our Data Protection Officer, email privacy@ridearrivo.com. For anything else, email info@ridearrivo.com.
RICHATHAOIR LIMITED (CAC RC 1654710), Babajide Sanwo-Olu International Market, Ikosi, Lagos, Nigeria.