Privacy Policy

# ChopShift Platform Privacy Policy

*Last Updated: October 2026*

At ChopShift, safeguarding the privacy and personal data of our restaurant partners and dining guests is a core commitment. This Privacy Policy details our data collection, processing, and protection practices in compliance with the Nigeria Data Protection Act (NDPA) and global data protection standards (GDPR).

---

### 1. Information We Collect
We collect personal information across two primary categories:

#### A. Merchant & Restaurant Personnel Data
- **Identity & Contact Details:** Full name, business email, telephone number, and job title.
- **Business Verification (KYC):** Corporate Affairs Commission (CAC) registration documents, tax identification numbers, and verified bank account payout information.
- **Operational Logs:** Staff clock-in/out records, order handling timestamps, and administrative audit trails.

#### B. Dining Guest & Customer Data
- **Order Details:** Items ordered, special cooking instructions, table number, and order total.
- **Contact Details (optional or required for receipts):** Email address, telephone number for SMS/WhatsApp order updates.
- **Technical Telemetry:** Device IP address, browser type, and geolocation coordinates used to resolve table QR codes and delivery radiuses.

### 2. How We Use Personal Information
We utilize the collected data strictly for legitimate operational purposes:
- To process, prepare, and deliver restaurant food and drink orders;
- To issue electronic receipts via email, SMS, or WhatsApp;
- To disburse payment settlements to merchant bank accounts;
- To send critical system notifications and dispatch stuck order alerts via Telegram and email;
- To detect, prevent, and remediate fraud, chargebacks, and security vulnerabilities.

### 3. Sharing of Information
We never sell personal data. We disclose information only to:
- **The Restaurant Fulfilling the Order:** Kitchen staff and managers receive order details necessary to prepare and serve your meal.
- **Licensed Payment Processors:** Transaction details are transmitted securely to Paystack and Flutterwave for payment authorization.
- **Communication Infrastructure Providers:** Resend (email), Termii (SMS), and Meta/Telegram for transactional alert dispatch.
- **Legal Authorities:** When required by subpoena, court order, or applicable law enforcement mandate.

### 4. Data Security & Storage
ChopShift implements enterprise-grade technical safeguards:
- All communications are encrypted in transit using Transport Layer Security (TLS 1.3).
- Sensitive credentials, API keys, and access tokens are encrypted at rest with AES-256.
- Database access is restricted via Row-Level Security (RLS) policies and multi-factor authentication (2FA).

### 5. Your Rights
Under applicable data privacy regulations, you have the right to:
- Request access to the personal data we hold about you;
- Request correction of inaccurate or incomplete records;
- Request erasure of your personal data ("Right to be Forgotten"), subject to statutory financial retention requirements;
- Lodge a complaint with the relevant Data Protection Authority.

To exercise your privacy rights, please contact our Data Protection Officer at **privacy@chopshift.com**.