Cravvingss

Privacy Policy

Last updated 8 August 2026

Cravvingss is a food-delivery service you use by chatting with us on WhatsApp or Instagram. This page says exactly what we collect, why we need it, and who else sees it. We have tried to write it in plain language rather than legal padding.

Who we are

Cravvingss operates in Lagos, Nigeria. We are the data controller for the information described here. You can reach us at support@cravvingss.shop.

What we collect

If you order food

  • Your phone number — this is your account. There is no password; verifying a code we send over WhatsApp is how we know it's you.
  • Your Instagram account ID, if you message us on Instagram instead. This is an ID scoped to our app, not your login.
  • Your name, if you tell us.
  • Delivery addresses and their coordinates — including a live location if you choose to share one.
  • Your orders: what you bought, from whom, what it cost, and when. We keep your chat with us so the conversation makes sense across messages.

If you sell food

  • Business name, address and coordinates, category, and your menu.
  • CAC registration number, where you provide one.
  • Bank account details, so we can pay you out.

If you deliver for us

  • Identity documents for verification: a selfie, date of birth, an ID document, driver's licence and vehicle papers where relevant.
  • Your NIN — stored only as a one-way hash. We keep a fingerprint that lets us tell whether two applications use the same NIN. We do not keep the number itself, and we cannot recover it.
  • Vehicle type, plate and photo.
  • Bank account details, for delivery payouts.
  • Next-of-kin and guarantor contacts.
  • Your location while you are online and on a delivery, so we can offer you nearby jobs and show the customer where their food is. We stop when you go offline.

Why we collect it

To take your order, work out delivery distance and price, find a courier near the vendor, let you track the delivery, take payment, pay vendors and couriers, and answer you when something goes wrong. Courier identity checks exist because someone is coming to your address.

We do not sell your data, and we do not use it for advertising.

Who else sees it

We use other companies to run parts of the service. Each sees only what it needs:

  • Meta — WhatsApp and Instagram carry the messages between you and us.
  • Paystack — takes your payment and sends payouts. Card and bank details go to Paystack directly; we never see or store them.
  • Mapbox — turns addresses into coordinates and estimates driving times.
  • Groq — runs the model that understands what you type. Prices, menus and totals always come from our own database, never from the model.
  • Resend — delivers our replies to support messages.
  • Sentry — reports crashes so we can fix them.
  • Neon, Upstash, Railway and Vercel — host the database and the service itself.

The vendor you order from sees your order and your first name. The courier delivering it sees your delivery address and phone number, because they have to reach you. Neither sees your full order history.

Some of these providers process data outside Nigeria. We may also disclose information where the law requires it.

How long we keep it

Order records stay while your account is open — you can reorder from them, and we need them for tax and dispute records. Cart and chat session state lives in temporary storage and expires on its own. Courier verification documents are kept while you ride with us and for as long as afterwards as the law requires.

Your rights

Under the Nigeria Data Protection Act 2023 you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email support@cravvingss.shop from the address we have for you, or message us on the number you order from.

Deletion has limits we would rather state than hide: we cannot delete records we are required to keep, such as completed transactions.

Security

Traffic is encrypted in transit. Sessions are server-side tokens we can revoke instantly, not tokens that stay valid once issued. Sensitive identifiers are hashed rather than stored in the clear where hashing is possible. Staff access to the admin tools requires a second verification step beyond signing in.

No service can promise perfect security. If a breach affects you, we will tell you and the regulator.

Children

Cravvingss is not intended for anyone under 18.

Changes

If we change this policy we will update the date at the top. Material changes will be announced in the chat you order from.