Skip to content
    Blupo

    Privacy Policy

    This Privacy Policy explains how Blupo (“Blupo,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use our websites, apps, and services (the “Services”). Blupo is a community-powered, peer-to-peer delivery platform with real-time tracking and wallet payouts built for Nigeria. We are committed to protecting your privacy and processing personal data lawfully and transparently.

    Who we are

    For purposes of Nigeria’s Data Protection Act 2023 (“NDPA”), Blupo acts as the Data Controller for personal data we collect through the Services. You can contact us at hi@blupo.org.

    Scope

    This Policy applies to users who send packages, travelers who carry packages, and visitors to our sites/apps. It does not apply to third-party websites/services that are not operated by Blupo.

    Information we collect

    • Account & Profile: name, email, phone number, password hash, optional avatar and bio.
    • Identity & Verification: where required for safety, KYC or legal compliance, government-issued ID details (e.g., ID type/last digits), date of birth, selfie/liveness checks, and verification results.
    • Delivery & Transaction Data: pickup/drop-off addresses, package descriptions (provided by you), instructions, timestamps, prices/fees, wallet balances, payouts, refunds, and dispute/appeal history.
    • Location: precise or approximate location if you enable location (e.g., during active pickups/deliveries, route optimization, or safety features).
    • Device/Usage: IP address, device IDs, app version, language, crash logs, pages/screens viewed, referral source, session events, and cookies or similar technologies.
    • Communications: messages between senders and travelers (where supported), customer support chats/emails, and call metadata (if routed via our systems).
    • User-Generated Content: ratings, reviews, feedback, and survey responses.
    • Third-Party Data: if you choose, sign-in data from identity providers (e.g., Google/Apple), and signals from fraud-prevention, identity, payment, or analytics partners.

    Sources of data

    • Directly from you when you create an account, request/fulfill a delivery, contact support, or participate in promotions.
    • Automatically via your device and our Services (e.g., telemetry, location when enabled).
    • From partners (payments, ID verification, anti-fraud, analytics) as allowed by law.

    How we use information (Purposes & lawful bases)

    We process personal data under NDPA-recognized bases such as contract, consent, legitimate interests, legal obligation, and vital interests. Examples include:

    • Provide the Services (create/maintain accounts, match senders/travelers, enable tracking, process wallet transactions) — contract.
    • Safety, trust & integrity (KYC/verification, fraud and abuse prevention, risk scoring with human review, dispute handling) — legitimate interests / legal obligation.
    • Communications (service updates, security alerts, support) — contract / legitimate interests.
    • Personalization & analytics (improve routes, reliability, pricing transparency, performance) — legitimate interests.
    • Marketing (with your choices) — consent / legitimate interests.
    • Compliance (tax, regulatory requests, record-keeping) — legal obligation.
    • Emergency use (to protect life/safety) — vital interests.

    Cookies & similar technologies

    We use cookies, SDKs, and device identifiers to remember settings, keep you signed in, analyze usage, and improve features. You can manage cookies/permissions in your browser or device settings. Some features may not function without essential cookies/permissions.

    Sharing & disclosure

    We do not sell personal data. We share limited data:

    • Between users as needed to complete a delivery (e.g., first name, pickup/drop-off details, contact options).
    • Service providers (hosting, cloud storage, payments, identity verification, communications/SMS/email, analytics, customer support) bound by contracts.
    • Safety and compliance (law enforcement/legal requests, preventing fraud or harm, protecting rights).
    • Business transfers (merger, acquisition, financing). We will continue to protect data consistent with this Policy.

    International transfers

    We may process/store data in countries outside your own (e.g., cloud providers). Where required, we use contractual safeguards and technical/organizational measures to protect your data in line with this Policy and applicable law.

    Data retention

    We keep data only as long as necessary for the purposes above and to comply with legal obligations. Standard retention windows include:

    • Account data: for the life of the account and up to 5 years after closure (disputes, tax/audit, fraud prevention).
    • Delivery & transaction records: typically 7 years from transaction date (financial/legal obligations).
    • Location data: high-precision, route-level data retained for the active trip and a limited period thereafter (generally 90–180 days), unless needed for safety, fraud, or legal claims.
    • Support communications: typically 36 months.
    • Where legal claims are anticipated, we may retain relevant data until resolution.

    Your rights

    Subject to the NDPA and other laws, you may have the right to:

    • Request access to your personal data and obtain a copy.
    • Request correction (rectification) or deletion (erasure).
    • Object to or restrict certain processing, and withdraw consent where processing is based on consent.
    • Request data portability (to the extent applicable).
    • Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

    To exercise rights, use in-app settings where available or email hi@blupo.org. We may ask for information to verify your identity and request.

    Automated decision-making

    We use automated systems (e.g., fraud/risk signals, route/pricing optimization). We do not make decisions that produce legal or similarly significant effects solely by automated means without appropriate human review. You may request human review of significant automated outcomes.

    Security

    We implement technical and organizational measures appropriate to the risk (encryption in transit, access controls, monitoring, and staff training). No system is 100% secure; you are responsible for safeguarding account credentials and keeping your app updated.

    Children

    The Services are not directed to anyone under 16. We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided personal data, contact us to delete the information.

    Third-party links & services

    Our Services may link to third-party sites or integrate third-party SDKs. Their privacy practices are governed by their policies.

    Changes to this Policy

    We may update this Policy periodically. We will post updates here, adjust the effective date above, and if changes are material, provide additional notice (e.g., in-app or email).

    Contact

    Questions, requests, or complaints? Email hi@blupo.org or visit our Support page. You may also contact the Nigeria Data Protection Commission at ndpc.gov.ng.

    If any part of this Policy is held invalid under applicable law, the remaining sections will continue in full force and effect.