Privacy Policy

Cravvingss is operated by KIMTECH TECHNOLOGIES LTD, a company registered in Nigeria and based in Lagos. KIMTECH TECHNOLOGIES LTD is the data controller for the information described here — meaning we are the ones who decide what is collected and why, and the ones answerable for it.

You can reach us at support@cravvingss.shop.

If you order food

• Your phone number — this is your account. There is no password; verifying a code we send over WhatsApp is how we know it's you.
• Your Instagram account ID, if you message us on Instagram instead. This is an ID scoped to our app, not your login.
• Your name, if you tell us.
• Delivery addresses and their coordinates — including a live location if you choose to share one.
• Your orders: what you bought, from whom, what it cost, and when. We keep your chat with us so the conversation makes sense across messages.

If you sell food

• Business name, address and coordinates, category, and your menu.
• CAC registration number, where you provide one.
• Bank account details, so we can pay you out.

If you deliver for us

• Identity documents for verification: a selfie, date of birth, an ID document, driver's licence and vehicle papers where relevant.
• Your NIN — stored only as a one-way hash. We keep a fingerprint that lets us tell whether two applications use the same NIN. We do not keep the number itself, and we cannot recover it.
• Vehicle type, plate and photo.
• Bank account details, for delivery payouts.
• Next-of-kin and guarantor contacts.
• Your location while you are online and on a delivery, so we can offer you nearby jobs and show the customer where their food is. We stop when you go offline.

If you turn on notifications

• A subscription for your specific browseron your specific device: an address your browser's push service gives us, two keys used to encrypt the message so only your device can read it, and the browser and device type the subscription came from.
• We use it for one thing — telling you a new order has come in, or that a delivery needs you. Never for marketing.
• Turning notifications off in your browser, or signing out, ends it. We also drop a subscription once your browser tells us it is dead, which happens when you uninstall or clear the site.

If you earn money on Cravvingss

• A record of every amount you have earned, what order it came from, and whether it has been paid out to you. This is how your balance is worked out — we do not store a balance figure, we add up the records.
• Your earnings sit with us until you withdraw them, and we keep these records after payout because they are our accounting trail and yours.

To take your order, work out delivery distance and price, find a courier near the vendor, let you track the delivery, take payment, pay vendors and couriers, and answer you when something goes wrong. Courier identity checks exist because someone is coming to your address.

We do not sell your data, and we do not use it for advertising.

The Nigeria Data Protection Act 2023 requires us to have a lawful reason for each thing we process. Ours are:

• To do what you asked. Your phone number, address and order exist so we can take the order, price the delivery and get the food to you. Without them there is no service to provide.
• Because we have a legitimate interest. Courier identity documents, fraud checks and crash reports fall here — someone is travelling to your address, and that is a safety question, not a marketing one.
• Because the law requires it. Records of completed transactions, which we cannot delete on request.
• Because you agreed. Sharing a live location is always your choice, and you can stop at any time.

We use other companies to run parts of the service. Each sees only what it needs:

• Meta — WhatsApp and Instagram carry the messages between you and us.
• Paystack — takes your payment and sends payouts. Card details go to Paystack directly; we never see or store them. Money you pay is held in our Paystack account until it is paid out to the kitchen and the rider. If you sell or deliver, we hold your bank account number so Paystack can pay it; we show only its last four digits back to ourselves.
• Mapbox — turns addresses into coordinates and estimates driving times.
• Groq — runs the model that understands what you type. Prices, menus and totals always come from our own database, never from the model.
• Resend — delivers our replies to support messages.
• Prembly— checks that the NIN a kitchen owner or courier gives us belongs to them, when they sign up to sell or deliver. Only their NIN and, if they send one, their photo goes across; we keep Prembly's reference rather than their documents. Customers are never checked.
• Sentry — reports crashes so we can fix them.
• Your browser's own push service — Google, Apple, Microsoft or Mozilla — delivers a notification to your device, if you turned them on. Which one it is depends on the browser you use, not on us. The message is encrypted with the keys your browser gave us, so the push service carries it without being able to read it.
• Neon, Railway and Vercel — host the database, the service itself and the website.

The vendor you order from sees your order and your first name. The courier delivering it sees your delivery address and phone number, because they have to reach you. Neither sees your full order history.

Some of these providers process data outside Nigeria. We may also disclose information where the law requires it.

The short-lived things expire on their own, and these are the actual timings:

• A basket you have not checked out — 20 minutes.
• Where you are in a chat with us — 1 hour.
• A login code — minutes, and it is single use.
• A signed-in session — 30 days, extended while you keep using it, and destroyed the moment you log out.
• A courier's live position — held only while they are online, and dropped when they go offline.

Order records stay while your account is open — you can reorder from them, and we need them for tax and dispute records. Courier verification documents are kept while you ride with us, and afterwards only for as long as Nigerian law requires us to keep them.

Under the Nigeria Data Protection Act 2023 you can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email support@cravvingss.shop from the address we have for you, or message us on the number you order from.

You can also ask us to stop using your data for a particular purpose, ask for a copy in a portable format, or withdraw consent where you gave it. We answer within 30 days.

Deletion has limits we would rather state than hide: we cannot delete records we are required to keep, such as completed transactions.

If you are not satisfied with how we have handled a request, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. You do not need our permission to do that.

The website uses cookies that keep you signed in and remember what you are doing. We do not use cookies to follow you around other websites, and we do not run advertising trackers. Blocking the essential ones will sign you out.

Traffic is encrypted in transit. Sessions are server-side tokens we can revoke instantly, not tokens that stay valid once issued. Sensitive identifiers are hashed rather than stored in the clear where hashing is possible. Staff access to the admin tools requires a second verification step beyond signing in.

No service can promise perfect security. If a breach affects you, we will tell you and the regulator.

Cravvingss is not intended for anyone under 18.

If we change this policy we will update the date at the top. Material changes will be announced in the chat you order from.