Privacy Policy

Last updated: September 2026

1. About this Policy and Who We Are

This Privacy Policy explains how Munchspace ("we", "our", "us") collects, uses, stores, shares, and protects personal data when you use the Munchspace mobile applications, vendor and administrative dashboards, websites, and related services (together, the "Service").

Munchspace operates a food ordering and delivery marketplace. That means we handle personal data belonging to several different kinds of people — customers who place orders, vendors and their staff who run businesses on the platform, riders who complete deliveries, and our own administrators. This Policy covers all of them, and Section 5 sets out separately what we collect for each.

Data controller:

Munch Space Limited
RC 9051132
1 Ayo Adeleye Drive Ilassan ,ikate Lagos state
Email: privacy@munchspace.io

Data Protection Officer: the Data Protection Officer, reachable at dpo@munchspace.io.

We are committed to handling personal data transparently, lawfully, and securely, in line with the Nigeria Data Protection Act 2023 ("NDPA") and, where it applies to you, the EU/UK General Data Protection Regulation ("GDPR").

1.1 Scope

This Policy applies to the Service. It does not apply to:

The independent practices of vendors, riders, payment providers, or other third parties, even where you reach them through the Service.
Any website or application we link to but do not operate.

1.2 Our role: controller and processor

For most processing described here we are a data controller — we decide why and how personal data is used.

In one respect we act as a data processor on a vendor's behalf: where a vendor uses the Service to manage their own menu, orders, staff accounts, and customer interactions, the vendor is the controller of that business's own operational records and we process them under our agreement with that vendor. Where a vendor and Munchspace are joint controllers of the same order data, each of us is responsible for the obligations set out in this Policy for the part we control.

2. Definitions

Term	Meaning
Account	A unique account created to access the Service, in any role.
Admin	A Munchspace staff member with access to administrative tools.
Application	The Munchspace mobile or web applications.
Business	A vendor's storefront on the platform, with its own menu, hours and location.
Customer	A person who browses or places orders through the Service.
Device	Any device capable of accessing the Service.
Personal Data	Any information relating to an identified or identifiable individual.
Processing	Any operation performed on personal data, including collection, storage, use, disclosure and deletion.
Rider	A delivery partner who accepts and completes deliveries through the Service.
Service Provider	A third party that processes personal data on our behalf and on our instructions.
Usage Data	Data collected automatically through your use of the Service.
Vendor	A business owner or operator who sells through the Service, including their authorised staff users.
You	The individual or legal entity using the Service.

3. Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. Under the NDPA and the GDPR, our bases are:

Basis	When we rely on it
Contract	Creating and operating your account; taking, routing, and fulfilling orders; processing payments and payouts; providing support.
Legal obligation	Tax and financial record-keeping; identity and business verification (KYC); anti-fraud and anti-money-laundering duties; responding to lawful requests from authorities.
Legitimate interests	Securing the platform; preventing fraud and abuse; debugging and improving the Service; analytics on aggregate usage; recovering debts; defending legal claims. Where we rely on legitimate interests we have assessed that they are not overridden by your rights, and you may object (Section 15).
Consent	Precise device location; marketing communications; access to your camera or media library; optional profile details. Consent can be withdrawn at any time, without affecting processing already carried out.
Vital interests	Rare cases involving a threat to someone's life or safety, such as a serious incident during a delivery.

4. How We Collect Data

We collect personal data:

Directly from you — when you register, complete a profile, upload documents, place or fulfil an order, contact support, or respond to a survey.
Automatically — through your use of the Service, as described in Section 5.7.
From other users — a customer's delivery address and phone number reach the vendor and rider assigned to that order; a vendor's staff details are entered by the vendor.
From third parties — payment and payout providers confirm transaction outcomes and bank account names; mapping providers return routes and distances.

5. Data We Collect

5.1 Account and identity data (all roles)

First and last name
Email address
Phone number
Password, stored only as a cryptographic hash — never in readable form
Verification status for your email and phone
Birth month and day, where you choose to provide them
The type of client you signed up from (customer app, vendor dashboard, rider app)
Account status, including whether an account is active, blocked, suspended or scheduled for deletion, and the reason and time it was recorded

5.2 Customer data

Delivery addresses, including street, city, state, local government area and postal code, and the coordinates of each saved address
Order history, cart contents, and favourite businesses
Reviews and ratings you leave for orders, businesses and riders
Preferences, including preferred payment method, dietary preferences, and your notification and marketing choices
Loyalty balances and promotion redemptions

5.3 Vendor and business data

Business legal name, display name, description, and date established
Business contact email and phone number
Business address and its geographic coordinates
Business logo and cover images, and menu item photographs
Opening hours, service operations, delivery settings and charges
Tax identification number
Bank account details for settlement (see Section 5.6)
Staff user accounts created by the vendor, and the role assigned to each
Corporate and identity documents uploaded for verification (see Section 7)
An audit log of significant changes made to the business

5.4 Rider data

The account and identity data in Section 5.1
A second phone line, date of birth, and emergency contact name and phone number
Home or base address
Vehicle details, vehicle photographs, and vehicle documents
Identity and compliance documents (see Section 7)
Onboarding, approval, suspension and availability status, and the reason recorded for any suspension
Online sessions — when you go online and offline
Location data while working — see Section 6.2
Delivery history, earnings, and ratings received

5.5 Order and fulfilment data

For every order we record the items, quantities, prices, discounts, taxes and fees; the business it was placed with; the delivery or pickup address; the assigned rider; timestamps for each stage; and any messages exchanged about it. This record necessarily links a customer, a vendor and a rider together.

5.6 Payment and payout data

We do not collect or store full card numbers. Card details are entered with, and held by, our payment providers, who are certified to the relevant security standards. We receive and store:

A payment reference, amount, currency, channel, status and timestamp
The last four digits of a card or account, and the card brand, where the provider returns them
For vendors and riders: bank name, account name, account number, the last four digits of the account, and the provider's recipient code, so that settlements and payouts can be made
Refunds, disputes, wallet balances, earnings and ledger entries

5.7 Technical and usage data

IP address
Device type, operating system, and application version
User agent string
Access times and interaction logs
Push notification device tokens
Authentication events — sign-in, sign-out, password reset, OTP verification and their outcome, together with the IP address and user agent used, whether the attempt succeeded or failed, and the reason for failure

5.8 Search and browsing data

We log search queries, the number of results returned, and which result was clicked or ordered, associated either with your account or with a temporary guest identifier. Signed-in users also have a personal search history, which you can clear.

5.9 Communications and support

Support tickets, including your name, email, subject, message content and any replies
The IP address and user agent used to submit a ticket, kept to detect and limit abuse
Notifications we have sent you and your notification preferences
Messages exchanged between administrators and users

5.10 Device permissions

With your consent, the Application may request access to:

Location — see Section 6
Camera and media library — to take or select photographs for profile pictures, menu items, vehicles or documents
Notifications — to deliver order updates

You can withdraw any of these permissions in your device settings. Parts of the Service will stop working when you do: a rider cannot receive job assignments without location access, for example.

6. Location Data

Location is the most sensitive category of data we handle, and it works differently for each role.

6.1 Customers

With your permission, we collect your device's location to suggest nearby businesses, estimate delivery times, and prefill delivery addresses. You may decline, and enter an address manually instead. We also store the coordinates of addresses you save.

6.2 Riders

While you are online and available for work, the Application records your location continuously. Each ping stores latitude, longitude, and — where the device reports them — accuracy, heading and speed, with a timestamp, and is linked to the delivery you are on if you are on one.

We use this to:

Match you with nearby orders
Show customers and vendors the progress of a delivery
Calculate distances, delivery fees and your earnings
Reconstruct a delivery route where there is a dispute, incident or safety concern

We do not track a rider's location while offline. Going offline in the Application stops the collection.

How long we keep it. Location trails are deleted automatically on a schedule, and the two windows differ because the reasons for keeping them differ:

Pings recorded during a delivery are kept for 90 days, so a route can be reconstructed if a drop-off, a distance or an incident is disputed.
Pings recorded while you were online but on no job are kept for 7 days. They exist only to match you with nearby orders, and serve no purpose once the shift ends.

Deletion runs nightly and is permanent.

Because this is precise, continuous location data about an identifiable person, we treat it as sensitive: access is restricted to staff who need it for the purposes above, and it is disclosed outside Munchspace only as described in Section 9.

6.3 Vendors

We store the geographic coordinates of a business's premises, which the vendor sets when creating or editing the business. This is business location data, not personal tracking.

7. Identity and Compliance Documents

Vendors and riders must provide documents so we can verify who they are and that they are entitled to operate. Depending on role these may include government-issued identity documents, driver's licences, vehicle registration and insurance, proof of address, and corporate registration documents such as a CAC certificate.

We record the document type, the file itself, any reference number, its issue and expiry dates, its review status, and — where a document is rejected — the reason.

These documents are held to a stricter standard than other files:

They are stored separately from public content such as menu photographs.
They are never served from a public URL. Access is only ever through a short-lived signed link, valid for fifteen minutes, generated for a specific authorised viewer.
They are visible only to the person who uploaded them and to Munchspace staff performing verification, compliance or dispute functions.

We keep them for as long as the account is active and for the period afterwards required by law (Section 13).

8. How We Use Your Data

Purpose	Legal basis
Create, authenticate and manage your account	Contract
Display businesses, menus and prices	Contract
Take, route, fulfil and track orders	Contract
Assign deliveries to riders and calculate distance, fees and earnings	Contract; legitimate interests
Process payments, refunds, settlements and payouts	Contract; legal obligation
Verify vendor and rider identity and eligibility	Legal obligation
Send transactional messages — order status, receipts, security alerts	Contract
Send marketing messages	Consent
Provide customer and vendor support	Contract; legitimate interests
Detect, investigate and prevent fraud, abuse and security incidents	Legitimate interests; legal obligation
Flag, suspend or block accounts that breach our terms	Legitimate interests; contract
Monitor, debug and improve the Service	Legitimate interests
Produce aggregate analytics and business reporting	Legitimate interests
Comply with tax, accounting and regulatory obligations	Legal obligation
Establish, exercise or defend legal claims	Legitimate interests; legal obligation

We do not use your personal data to train machine learning models that are made available outside Munchspace.

9. Sharing and Disclosure

We do not sell your personal data.

We share personal data only as set out below.

9.1 Between users of the platform

Completing an order requires it:

Vendors receive the customer's name, phone number, order contents, and — for delivery orders — the delivery address.
Riders receive the pickup business's name and address, and the customer's name, phone number, delivery address and delivery coordinates, for the order they are assigned to.
Customers receive the business's name and location, and the assigned rider's first name and live delivery location.

We share the minimum needed to complete the order. Contact details shared for one order may not be used for any other purpose, and doing so breaches our terms.

9.2 Service providers

We use the following categories of provider, who process data on our instructions under written terms:

Category	Providers currently used	What they receive
Payment processing	Paystack, Flutterwave	Payment and card data entered by you; transaction metadata
Payouts and settlements	Paystack	Bank account details of vendors and riders; payout amounts
Cloud hosting and storage	Cloudflare R2; our hosting provider	All data stored by the Service
Email delivery	Amazon Web Services (SES)	Recipient email address and message content
Push notifications	Google Firebase Cloud Messaging	Device tokens and notification content
Mapping, routing and geocoding	Google Maps Platform	Coordinates and addresses used to calculate routes and distances

This list reflects our providers as at the date of this Policy and may change; we will update it when it does.

9.3 Other disclosures

Legal authorities, where required by law, court order, or lawful request, or where necessary to establish or defend legal claims.
Professional advisers — lawyers, auditors, accountants and insurers — bound by duties of confidentiality.
A successor entity, in connection with a merger, acquisition, financing or sale of assets. We will notify you before your data becomes subject to a different privacy policy.
With your consent, for any other purpose we describe to you at the time.

10. Access to Accounts by Munchspace Staff

Our administrators can access account and order records to provide support, investigate fraud and disputes, and meet compliance obligations. Access is limited by role-based permissions and is recorded in an activity log that captures who acted, what they did, and the IP address and user agent used.

Vendor account impersonation. To diagnose a problem a vendor reports, an authorised administrator can open the vendor dashboard as that vendor. This is:

Restricted to administrators holding the specific permission
Started through a single-use code, never a shareable link
Time-limited, expiring after a short period (thirty minutes by default)
Recorded in the activity log, identifying the administrator who did it

An impersonating administrator sees what the vendor sees. They cannot see the vendor's password, which we do not hold in readable form.

11. Automated Processing

We use automated logic to:

Assign deliveries to riders, based on proximity, availability and current workload
Calculate delivery fees, distances and estimated arrival times
Rank search results and recommendations
Flag unusual account or transaction activity for human review

Fraud flags and suspensions that materially affect you are reviewed by a person before they take permanent effect, and you may contest a decision under Section 15. We do not carry out solely automated decision-making producing legal or similarly significant effects without human involvement.

12. International Data Transfers

Munchspace operates primarily in Nigeria, but several of our service providers process data outside Nigeria, including in the United States and the European Union.

Where we transfer personal data out of Nigeria, we do so under the NDPA's provisions for cross-border transfer — relying on an adequacy determination by the Nigeria Data Protection Commission where one exists, and otherwise on contractual safeguards with the recipient, on your explicit consent, or on the necessity of the transfer for performing our contract with you.

Where the GDPR applies, we rely on adequacy decisions or Standard Contractual Clauses, together with supplementary measures where required.

You may request details of the safeguards applied to a specific transfer at the contact address in Section 22.

13. Data Retention

We retain personal data for as long as it is needed for the purpose it was collected, and then delete or irreversibly anonymise it.

Data	Retention
Account profile data	For the life of the account; removed on deletion, subject to the exceptions below
Order and transaction records	Seven years from the transaction, for tax and accounting compliance
Payment, payout and ledger records	Seven years from the transaction
Identity and compliance (KYC) documents	For the life of the account, afterwards as required by anti-money-laundering rules
Rider location pings — recorded during a delivery	90 days from the ping, then deleted automatically
Rider location pings — recorded between deliveries	7 days from the ping, then deleted automatically
Authentication and activity logs	12 months
Support tickets	24 months after resolution
Marketing consents and preferences	Until withdrawn, plus a record of the withdrawal
Backups	Deleted data persists in encrypted backups for up to 6 months before being overwritten

Where data must be kept after account deletion for legal reasons, it is restricted to that purpose and not used to contact or profile you.

14. Security

We apply administrative, technical and physical safeguards to protect personal data, including:

Passwords stored only as cryptographic hashes
Encryption of data in transit
Access to identity documents only through short-lived signed URLs, never public links
Role-based access control for administrative functions, with permissions granted individually
Time-bounded sessions, with refresh limited so that a session cannot be renewed indefinitely
Logging of authentication events and administrative actions
Segregation of private documents from publicly served content

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission and, where the risk is high, you directly, within the timeframes the NDPA requires.

Please help us by using a strong, unique password, keeping your credentials confidential, and telling us promptly at the address in Section 22 if you believe your account has been compromised.

15. Your Rights

Subject to the conditions and exemptions in applicable law, you have the right to:

Be informed about how your personal data is used — this Policy
Access the personal data we hold about you, and receive a copy
Rectify inaccurate or incomplete data
Erase your data ("right to be forgotten") where we no longer have a lawful reason to keep it
Restrict processing while a dispute about accuracy or lawfulness is resolved
Object to processing based on legitimate interests, and to direct marketing at any time
Data portability — receive data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible
Withdraw consent at any time, where processing is based on consent
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
Lodge a complaint with a supervisory authority (Section 22)

How to exercise your rights

Write to us at the address in Section 22, or use the in-app controls where they are available. We will:

Acknowledge your request and may ask for information to verify your identity, so that we do not disclose your data to someone else
Respond within thirty (30) days, and tell you if we need longer because the request is complex
Act free of charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline, and will explain why

If we cannot act on your request, we will tell you the reason and how to challenge it.

16. Account Deletion

You may delete your Munchspace account at any time.

How to delete your account

Open the Munchspace application.
Go to Profile.
Select Delete Account.
Confirm your request.

Once confirmed, your account is scheduled for permanent deletion.

If you cannot access your account, request deletion by writing to support@munchspace.io from the email address registered to the account, or by contacting us at the address in Section 22.

Before you delete

Deletion cannot be reversed once it completes. Please note:

Vendors should settle outstanding orders and withdraw any wallet balance first. Deleting a vendor account may remove the business's storefront and menu from the platform.
Riders should complete any active delivery and withdraw any outstanding earnings.
Deleting your account does not by itself cancel orders already placed or refund payments already made.

What happens after deletion

Your profile information — name, email, phone number and addresses — is permanently removed.
Your login credentials are invalidated and your active sessions are terminated.
Your device tokens are removed and you stop receiving notifications.
Your reviews and ratings are anonymised rather than deleted, so that businesses and riders keep an accurate overall record.

Data retained after deletion

We retain certain information where the law requires it or where we have an overriding legitimate reason, including:

Transaction, payment and payout records, for tax and financial compliance
Identity and compliance documents, for the period anti-money-laundering rules require
Records needed to prevent fraud, resolve disputes, or establish and defend legal claims
A minimal record that an account was deleted, to honour the deletion if the same details are used again

Retained data is stored securely, restricted to those purposes, and deleted at the end of the periods in Section 13.

17. Children's Privacy

The Service is not directed at children. You must be at least eighteen (18) years old to hold a vendor or rider account, and at least thirteen (13) years old to hold a customer account. Where local law sets a higher minimum age for consent to data processing, that higher age applies.

We do not knowingly collect personal data from a child below these ages. If you believe a child has provided us with personal data, contact us at the address in Section 22 and we will delete it promptly.

18. Cookies, Local Storage and Similar Technologies

Our web applications use cookies and browser storage to:

Keep you signed in and maintain your session
Remember interface preferences
Secure forms against cross-site request forgery
Understand aggregate usage so we can improve the Service

Strictly necessary storage cannot be disabled without breaking the Service. You can clear or block other cookies in your browser settings; some features may then stop working.

Our mobile applications use the device's local storage for the equivalent purposes.

19. Marketing Communications

We send transactional messages — order updates, receipts, security alerts and service notices — as part of providing the Service. These are not marketing and you cannot opt out of them while you hold an account.

Marketing messages are sent only with your consent. You can withdraw it at any time using the unsubscribe link in any marketing email, through your notification preferences in the Application, or by contacting us. Withdrawing consent does not affect messages already sent.

20. Third-Party Links and Services

The Service may link to third-party websites and services we do not control, including payment provider pages. This Policy does not apply to them. We encourage you to read the privacy policy of any third party before providing them with personal data.

21. Changes to This Policy

We may update this Policy from time to time. When we do, we will change the "Last updated" date above and post the revised Policy within the Service.

Where a change materially affects how we use your personal data, we will give you notice — by email or an in-app notice — before it takes effect, and where the law requires it we will ask for your consent.

Previous versions are available on request.

22. Contact Us and Complaints

For any question about this Policy, or to exercise your rights:

Email: privacy@munchspace.io
Support: support@munchspace.io
Data Protection Officer: dpo@munchspace.io
Postal address: 1 Ayo Adeleye Drive Ilassan ,ikate Lagos state

Complaints

If you are not satisfied with our response, you may complain to a supervisory authority.

In Nigeria, that is the Nigeria Data Protection Commission (NDPC):

Nigeria Data Protection Commission
Website: https://ndpc.gov.ng
Email: info@ndpc.gov.ng

In the EU or UK, you may complain to the supervisory authority in your country of residence, place of work, or where the alleged infringement occurred.

We would appreciate the chance to address your concern before you approach a regulator, so please consider contacting us first.