1 Who we are #
Cargorun 9ja ("Cargorun", "we", "us") is a cargo and package delivery app. Customers use it to book deliveries, pay for them and track them live. Riders use it to receive delivery offers, navigate to pickups and drop-offs, and get paid.
This policy covers the Cargorun 9ja mobile app on Android and iOS, and the Cargorun services the app connects to. We process personal data in line with the Nigeria Data Protection Act 2023 and other laws that apply to you.
2 Data we collect #
We collect only the data needed to run deliveries, verify riders and handle payments. The app does not access your contacts, call log, SMS messages or files.
| Category | What we collect | From | Why |
|---|---|---|---|
| Account & profile | Full name, email address, phone number, password, profile photo (optional), email and phone verification status, saved and recent addresses, ratings and reviews | All users | Create your account, sign you in, contact you and build trust between users |
| Identity verification | National Identification Number (NIN); government ID type, number and photo (driver's licence, voter's card or international passport); a selfie taken in the app | Riders | Confirm a rider's identity before they can accept jobs |
| Vehicle | Vehicle type, plate number and a photo of the vehicle papers | Riders | Confirm the vehicle is roadworthy and registered, and show it to customers |
| Precise location | GPS position, speed and compass heading while online or on a delivery, including in the background | Riders | Offer nearby jobs and show customers live tracking (see section 3) |
| Current location | Your location at the moment you ask the app to fill in an address | Customers Optional | Fill in a pickup or drop-off address for you. There is no background tracking. |
| Orders | Pickup, drop-off and stop addresses, route, vehicle type, package details, price, status and timeline | All users | Quote, book, dispatch and complete deliveries |
| Messages & calls | In-app chat messages, plus photos and videos sent in chat. For calls, only who called whom, when, and for which order. Call audio is never recorded. | All users | Let customers and riders coordinate a delivery, and resolve disputes |
| Wallet & payments | Wallet balance and transactions, bank account details for withdrawals, and virtual account details for top-ups. Card details are entered on Paystack's checkout, so we never see your full card number. | All users | Process top-ups, order payments, rider earnings and withdrawals |
| Device & technical | Push notification token, operating system and app version, IP address and server logs. Sign-in tokens are stored only on your device, in encrypted secure storage. | All users | Send notifications, keep accounts secure and fix problems |
3 Device permissions #
The app asks for each permission when it is first needed. You can change any of them later in your device settings. If you refuse a permission, only the feature that needs it stops working.
Location, including background Riders
Used only while a rider is online or on an active delivery. While online, it lets us offer you nearby jobs. During a delivery, the customer sees your live location.
Riders often switch to a navigation app or lock the screen, so tracking runs as a foreground service with a persistent notification. Your location is sent every few seconds, and tracking stops when you go offline. The app explains all this before asking for permission.
Android permissions
ACCESS_FINE_LOCATIONACCESS_BACKGROUND_LOCATIONFOREGROUND_SERVICE_LOCATION
Microphone & calls Customers and riders
The microphone is used only during an in-app call you start or answer, so you can coordinate a pickup or drop-off without sharing phone numbers. Audio is streamed live through Agora and is never recorded.
Incoming calls show a full-screen ringing screen so you can answer on a locked phone. A foreground service keeps the call connected if you leave the app.
Android permissions
RECORD_AUDIOFOREGROUND_SERVICE_PHONE_CALLFOREGROUND_SERVICE_MICROPHONEMANAGE_OWN_CALLSUSE_FULL_SCREEN_INTENT
Camera Riders, and anyone sending a chat photo
Used to take the identity selfie during rider sign-up, and to take a photo or short video to send in an order chat, such as the package or the delivery spot. The camera is active only on those screens.
Android permissions
CAMERA
Photos & media All users
Used to upload a profile photo, rider ID and vehicle documents, or chat photos and videos. The app uses your device's photo picker, so it only receives the files you choose. It cannot browse your gallery.
Android permissions
None. The system photo picker needs no permission.
Notifications All users
Used to alert riders to new delivery offers, ring for incoming calls, and tell customers about order updates, chat messages and service announcements.
Android permissions
POST_NOTIFICATIONSVIBRATEWAKE_LOCK
Network & Bluetooth audio All users
Used to connect to our servers, and to play call audio through your speaker, earpiece or a Bluetooth headset.
Android permissions
INTERNETACCESS_NETWORK_STATEBLUETOOTH_CONNECTMODIFY_AUDIO_SETTINGS
4 How we use your data #
- To provide the service: create your account, quote and book deliveries, match orders with nearby riders, show live tracking, and connect customers and riders by chat and call.
- To verify riders: confirm identity and vehicle before a rider can accept jobs, to keep customers and their goods safe.
- To process payments: wallet top-ups, order payments, rider earnings and withdrawals.
- To communicate with you: verification codes, receipts, order updates and important service notices.
- For safety and support: investigate disputes, lost items, fraud and misuse, and answer support requests.
- To meet legal obligations: keep financial records and respond to lawful requests.
Our legal bases are: performing our contract with you; your consent, which you can withdraw at any time (for example, for background location); our legitimate interest in running a safe service; and compliance with the law.
6 Third-party services #
The app and our servers use these providers. Each one receives only the data it needs to do its job.
| Provider | Purpose | Data involved |
|---|---|---|
| Agora | Real-time in-app voice calls | Live call audio (not recorded), call channel ID, temporary access token, IP address |
| Google Firebase | Push notifications for offers, order updates, chat messages and incoming calls | Push token, notification content, device identifiers |
| Mapbox | Address search, turning a location into an address, route and distance calculation, map display | Addresses and coordinates of pickups and drop-offs, and the map area being viewed |
| OpenStreetMap | Map display (map tiles) | The map area being viewed and your IP address |
| Device location services | Reading your GPS position (Google Play services on Android, Core Location on iOS) | Device location, handled by your phone's operating system |
| Paystack | Card payments, wallet top-ups by bank transfer, bank account checks, rider withdrawals | Name, email, amount, bank account details and transaction references. Card data is handled only by Paystack. |
| Cloudflare R2 | Private, encrypted storage for uploaded files | Profile photos, rider ID and vehicle documents, selfies, and chat photos and videos |
| Termii | SMS one-time verification codes | Phone number and the code |
| Resend | Verification and account emails | Email address and email content |
These providers have their own privacy policies and may process data outside Nigeria. When they do, we rely on safeguards permitted by the applicable law.
7 How long we keep data #
| Data | How long we keep it |
|---|---|
| Account, profile and rider verification data | While your account is active, then deleted as described in section 8 |
| Rider location history | Only as long as needed for active tracking, dispute resolution and safety investigations, then deleted with your account |
| Chat messages and media | With the order they belong to |
| Payment and wallet records | As long as tax, accounting and anti-fraud laws require, even after your account is deleted |
| Server logs | A limited period, for security |
8 User Account & Data Deletion Rights #
You can delete your Cargorun 9ja account and its personal data at any time, free of charge. This includes your profile, rider verification documents and location history. We process every deletion request within 30 days.
What happens next
- ImmediatelyYour account is deactivated. You are signed out, and other users can no longer see your profile.
- Up to 30 daysIf you change your mind, sign in again to restore your account.
- Within 30 daysWe permanently erase your name, email, phone number, profile photo, saved addresses, rider ID and vehicle documents, selfie, location history and push tokens.
- Legally required recordsWe keep payment and wallet transaction records only for the period required by tax, accounting and anti-fraud laws, then delete them.
Please withdraw any remaining wallet balance before you delete your account. To delete only some of your data while keeping your account, email us at the address above.
9 Your privacy rights #
Depending on where you live, you have these rights:
- AccessGet a copy of the personal data we hold about you.
- CorrectionFix inaccurate data. You can edit most profile details in the app.
- ObjectionObject to or restrict some processing.
- Withdraw consentTurn off location or notifications in your device settings. Riders need location access to go online.
- DeletionDelete your account and data (see section 8).
- ComplaintComplain to a regulator, such as the Nigeria Data Protection Commission.
To use any of these rights, email support@cargorun.com. We reply within 30 days.
10 Security #
- Data is encrypted in transit (HTTPS).
- Passwords are stored in hashed form.
- Sign-in tokens are kept in your device's encrypted secure storage.
- Uploaded files are kept in private storage. Only authorised staff can view rider verification documents.
- Calls use temporary, order-specific access tokens.
No system is perfectly secure. If a data breach affects you, we will notify you and the authorities as the law requires.
11 Children #
Cargorun 9ja is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
12 Changes to this policy #
We may update this policy as the app changes. When we do, we will update the "Last updated" date at the top. If a change is significant, we will also tell you in the app or by email before it takes effect.
13 Contact us #
Cargorun 9ja Support
Privacy questions, data requests and account deletion