Our Privacy Promise
At TapChow, we believe your food choices and location details are personal. We only collect the information necessary to fulfill your orders, process payments securely, and deliver your meals on time. We never sell your personal data.
1. Introduction & Scope
TapChow ("we", "us", or "our") is operated by Tapchow Technologies Limited. This Privacy Policy explains how we collect, use, disclose, and protect personal information belonging to customers, restaurant owners, branch staff, and delivery partners who interact with the TapChow application, website, and related operations.
We process information only where we have an applicable lawful basis, including performance of a contract, compliance with law, legitimate interests assessed against your rights, or consent where consent is appropriate. This policy is governed by the Nigeria Data Protection Act 2023 and applicable NDPC guidance. Using TapChow does not amount to blanket consent for every type of processing described here.
2. Information We Collect
Depending on how you use our platform, we collect different types of personal and operational information:
Account & Profile Details
Your name, email address, phone number, and account password. For restaurant partners, we also collect legal business documentation, bank details, and KYC credentials.
Delivery & Location Data
Physical delivery addresses, saved coordinates, and precise GPS location mapping to coordinate orders from restaurants to your door.
Payment Information: Financial transactions are processed via our PCI-DSS compliant partner Paystack. TapChow does not store or keep raw credit card numbers or banking passwords on our local servers.
3. How We Use Your Information
We process personal data to provide a seamless local meal ordering experience:
- Fulfillment: Sending orders to kitchen branches, coordinating riders, and tracking delivery status.
- Communication: Sharing receipt emails, order status changes, and critical product alerts.
- Security: Detecting fraud, resolving payment anomalies, and verifying branch accounts.
- Improvement: Analysing location usage, traffic bottlenecks, and popular food categories to optimize our platform.
- Partner reserve administration: Calculating disclosed reserve contributions, investigating a specific documented incident, providing human review, and administering responses and appeals.
5. Security & Data Retention
We use secure industry practices, including Transport Layer Security (TLS/HTTPS) for all data transfers and server-side encryption for databases, to protect your details.
We maintain a documented retention schedule by data category. Precise live rider location is collected only while the rider is online or fulfilling an order and routine location events are deleted or de-identified after 30 days. If an event is attached to an active fraud, safety, reserve, payment, or legal case, the relevant extract may be restricted and retained until the case and applicable legal period end. Support messages are normally retained for 12 months after closure unless needed for an active dispute. Financial, KYC, tax, anti-fraud, and corporate records may be retained for longer periods required by applicable law. Account deletion does not erase records that TapChow must lawfully retain, but those records are restricted from ordinary product use.
6. Your Rights & Choices
Under the Nigeria Data Protection Act and NDPR guidelines, you hold the following rights:
7. Partner Monitoring, KYC & Security Reserves
TapChow applies privacy-by-design controls to higher-risk partner operations:
- Live tracking: precise rider location is collected only while online or fulfilling an assigned order. Tracking must stop after delivery or when the rider goes offline.
- Rider and vendor KYC: identity, NIN-related, selfie, business, vehicle, and bank-verification records are limited to what is necessary, encrypted, access-controlled, and must not be exposed through public file URLs.
- Wallets and payouts: TapChow uses licensed payment providers where required, tokenises payment credentials where supported, and restricts employee access to bank and transaction records.
- Chats and support: messages can contain address, payment, or health-related information. Access is role-limited and governed by the retention schedule.
- Marketing and waitlists: service registration does not automatically enrol a person in unrelated marketing. Marketing preferences and opt-out controls are maintained separately.
- Cloud and international services: where hosting, analytics, maps, messaging, or media processors handle data outside Nigeria, TapChow maintains processor terms, transfer records, security review, and an applicable cross-border transfer basis.
Security-reserve decisions
The disclosed movement of a percentage into a refundable reserve may be performed to administer the partner contract. A complaint, rating change, unusual route, fraud flag, or cancellation score can only flag an incident for investigation; it cannot by itself confiscate funds.
- TapChow records the possible incident without deducting the reserve.
- An investigator gathers only relevant order, chat, location, payment, and support evidence.
- The partner receives the allegation, evidence summary, proposed amount, and at least 72 hours to respond.
- An authorised person reviews the evidence and the partner’s response.
- Only a direct, documented and proven loss may be deducted, with a recorded reason.
- The partner can appeal, obtain further human review, and receive a reversal where the decision is overturned.
9. Contact Us & Support
For any privacy questions, data requests, or policy feedback, please contact the Tapchow Data Officer directly: