OneStopPrivacy Policy
Effective 1 August 2026 · Last updated 10 October 2026
Before publishing: replace the highlighted fields and delete this box. This draft has not been reviewed by a lawyer.
1. Who we are
OneStop is a multi-service mobile application operated by Ilesa Tech Community Foundation (“OneStop”, “we”, “us”), a non-governmental organisation registered in Nigeria with the Corporate Affairs Commission as an incorporated trustee, registration number [CAC REGISTRATION NUMBER], whose registered address is [REGISTERED ADDRESS].
For the purposes of the Nigeria Data Protection Act 2023 (NDPA) we are the data controller for the personal data described here.
Privacy enquiries: hello@ilesa.tech
Data Protection Officer: [DPO NAME AND EMAIL — or remove]
This policy applies to the OneStop mobile application (tech.ilesa.onestop) and related services.
2. What we collect
We only collect what a given feature needs. If you never use a feature, we do not collect the data listed for it.
2.1 Information you give us
| Data | When | Why |
|---|---|---|
| Full name, email, phone number | Registration | Create and secure your account |
| Password | Registration | Authentication — stored only as a cryptographic hash |
| School or university | Registration | Show services available at your campus |
| Profile photo | If you upload one | Displayed on your profile |
| Delivery and pickup addresses | Saving a location, placing an order | Fulfil deliveries and rides |
| Order, ride and accommodation details | When you transact | Provide the service, show your history |
| Ratings, reviews, enquiries | When you submit them | Operate reviews; shared with the partner |
| Support messages | When you contact us | Resolve your issue |
2.2 Collected automatically
| Data | Notes |
|---|---|
| Precise and approximate location | Only while the app is in use, to show nearby restaurants, set your delivery address, and show where you are on your campus map in UniNav with walking directions. We do not track your location in the background. |
| Campus map suggestions and photos | Building names, details and photos you choose to send, with your account, so mappers can review them and limit spam |
| Ask UniNav questions | The questions you type to the campus assistant and the answers it gives, so we can answer follow-ups, prevent abuse and fix gaps in the campus map |
| Device push token | So we can send order and payment notifications |
| Device model, OS version, app version | Diagnostics and compatibility |
| Usage and transaction records | Order history, wallet activity |
2.3 Payments
Wallet funding is processed by Paystack. Card numbers, CVVs and bank credentials are entered with and held by Paystack — they never reach OneStop’s servers and we cannot see them. We keep only the transaction reference, amount, status and timestamp.
2.4 Camera and photos
We ask for camera access only when you choose to take a photo of a campus building to help map your campus. Choosing a photo from your gallery uses your phone’s photo picker, which shares only the image you pick. We never access your photos in the background.
Photos and building details you send are reviewed by campus mappers before anyone else sees them. If accepted, they become part of the public campus map without your name.
2.5 What we do not collect
- We do not collect location while the app is closed or backgrounded.
- We do not sell your personal data.
- We do not use your data for third-party advertising or ad profiling.
- We do not collect contacts, SMS, call logs or browsing history.
3. Lawful basis
| Purpose | Basis under NDPA s.25 |
|---|---|
| Creating your account, providing services you request | Performance of a contract |
| Processing payments, maintaining your wallet | Contract, and legal obligation |
| Order, delivery and payment notifications | Performance of a contract |
| Promotional messages | Consent — withdrawable any time |
| Precise location for nearby services | Consent — via the OS prompt, revocable in settings |
| Fraud prevention, safety, platform security | Legitimate interests |
| Tax, accounting and regulatory duties | Legal obligation |
4. Who we share with
| Recipient | What they get | Why |
|---|---|---|
| Partners (restaurants, drivers, landlords) | Your name, phone and delivery address, for that order only | To fulfil your order |
| Paystack (Nigeria) | Payment details you enter, amount | Payment processing |
| Google — Firebase Cloud Messaging | Push token, notification content | Delivering notifications |
| Google — Maps and Places | Address text you type, approximate location | Address autocomplete |
| Cloudinary | Photos you send of campus buildings | Storing and serving images |
| Expo (EAS) | App version, platform, update identifier | Over-the-air app updates |
| Anthropic (Claude) — only when you use Ask UniNav | Your question and the earlier messages in that conversation; the nearest campus place to you (not your coordinates); the campus time; and your class timetable if you ask about your classes. Never your name, email or phone number. | Generating the answer. Anthropic does not use this data to train its models. |
| Law enforcement and regulators | Only what is legally compelled | Legal obligation |
We never share your data for a third party’s own marketing.
International transfers. Google, Expo and Anthropic process data outside Nigeria. We rely on the mechanisms permitted under NDPA s.41, including adequacy and contractual safeguards.
5. How long we keep it
| Data | Retention |
|---|---|
| Account profile | While active, then 90 days after deletion |
| Order, ride and booking history | 6 years — tax and accounting |
| Wallet and transaction records | 6 years — financial record-keeping |
| Push tokens | Until you disable notifications, uninstall, or log out |
| Support conversations | 2 years after resolution |
| Ask UniNav questions and answers | With your account; deleted when you delete your account |
| Campus map suggestions and photos | Pending and rejected ones are deleted with your account. Accepted ones are part of the public campus map and stay, without your name. |
When a period ends we delete the data or irreversibly anonymise it. See Account & Data Deletion for the full deletion process.
6. Your rights
Under the NDPA you may access, correct, delete, object to or restrict processing, port your data, and withdraw consent at any time.
Email hello@ilesa.tech. We respond within 30 days. We may verify your identity first, so nobody else can make a request in your name.
You can also act directly in the app: edit your profile in Settings, control notifications in Notification Preferences, revoke location/camera/photo access in device settings, and delete your account.
If you believe we have mishandled your data you may complain to the Nigeria Data Protection Commission at ndpc.gov.ng.
7. Security
Encryption in transit (HTTPS/TLS on every request), password hashing, secure on-device token storage via the platform keystore or keychain, and role-based access controls.
No system is perfectly secure. If a breach is likely to result in a high risk to your rights, we will notify you and the NDPC within 72 hours of becoming aware, per NDPA s.40.
8. User-to-user features
Roommate matching and partner messaging make what you share visible to other users. Only share what you are comfortable making visible. Never post financial details or identity documents. You can report or block another user in the app, and we may suspend accounts that breach our terms.
9. Notifications
- Service notifications — order status, delivery, payments. Part of the service.
- Promotional notifications — opt-in, and switchable off in Notification Preferences without affecting service notifications.
10. Children
OneStop is not intended for anyone under 18. We do not knowingly collect data from children below that age. If you believe a child has given us data, email hello@ilesa.tech and we will delete it.
11. Changes
We may update this policy. Material changes are notified in the app or by email at least 14 days before taking effect.
12. Contact
Ilesa Tech Community Foundation
[REGISTERED ADDRESS]
hello@ilesa.tech