Legal Grid

Àjàlá Platform Privacy Policy

This Privacy Notice for ÀJÀLÁ APP('we', 'us', or 'our') describes how and why we might access, collect, store, use, and/or share ('process') your personal information when you use our services ('Services'), including when you:

• Visit our website at https://www.ajala.live or any website of ours that links to this Privacy Notice
• Download and use our mobile application (ÀJÀLÁ – The Lagos Co-Pilot), or any other application of ours that links to this Privacy Notice
• Use ÀJÀLÁ – The Lagos Co-Pilot. ÀJÀLÁ is a real-time transit navigation platform designed for Lagos, Nigeria. It provides a graph-based navigation engine for informal public transit (Danfo buses, Keke Napep, and BRT), community-sourced routes, estimated fares, 'Conductor Shouts' (local boarding phrases), live traffic updates, and a safety-focused 'Guardian Mode' that allows users to share their live trip progress with trusted emergency contacts.
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at admin@ajala.live.

Table of Contents

1. WHAT INFORMATION DO WE COLLECT?
2. HOW DO WE PROCESS YOUR INFORMATION?
3. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
4. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?
5. HOW DO WE HANDLE YOUR SOCIAL LOGINS?
6. HOW LONG DO WE KEEP YOUR INFORMATION?
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
8. WHAT ARE YOUR PRIVACY RIGHTS?
9. AGE RESTRICTIONS
10. CROWDSOURCED INTELLIGENCE & PROHIBITED CONDUCT
11. LIMITATION OF LIABILITY — THE LAGOS FACTOR
12. CONTROLS FOR DO-NOT-TRACK FEATURES
13. DO WE MAKE UPDATES TO THIS NOTICE?
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?

1. What Information Do We Collect?

In Short: We collect personal information that you provide to us.

We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products and Services, when you participate in activities on the Services, or otherwise when you contact us.

Personal Information Provided by You. The personal information we collect may include:

• Names
• Email addresses
• Usernames and passwords
• Phone numbers
• Contact or authentication data
• Unique Àjàlá ID and emergency contact preferences (for Guardian Mode)

Sensitive Information.

We do not process sensitive personal information such as racial or ethnic origins, sexual orientation, or religious beliefs.

Application Data. If you use our application(s), we may also collect:

• Geolocation Information. We request access to your device location while you are actively using the app, to detect your starting point, find routes near you, and, when you turn on Guardian Mode, share your real-time trip progress with the Safe Contacts you designate. We do not track your location in the background when the app is closed or not in use. You may change our access or permissions in your device's settings at any time.
• Mobile Device Data. We automatically collect device information such as your mobile device ID, model, manufacturer, operating system version, hardware model, mobile carrier, and IP address.
• Crowdsourced Transit Data. If you submit road condition reports (e.g., Traffic/Slow or Clear), we collect your submission, associated timestamp, and approximate location to populate our live traffic feed.
• Push Notifications. We may request to send you push notifications regarding your account or features of the application. You may opt out at any time in your device's settings.

Information Automatically Collected.

We automatically collect certain information when you visit, use, or navigate the Services, including your IP address, browser and device characteristics, operating system, language preferences, referring URLs, and other technical information. We also collect information through cookies and similar technologies.

Google API.

Our use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

• Account creation and authentication. To facilitate account creation, login, and account management.
• Service delivery. To provide you with the requested navigation, routing, and transit information services.
• Guardian Mode. To share your real-time trip progress and precise geolocation with your user-designated 'Safe Contacts' (Guardians) for safety monitoring and emergency assistance. This processing occurs only upon your explicit opt-in.
• User support. To respond to your inquiries and resolve issues.
• Administrative communications. To send you details about our products, services, terms, and policies.
• Marketing communications. To send you marketing and promotional communications in accordance with your preferences. You may opt out at any time.
• Platform safety. To monitor for fraud, fake crowdsourced reports, and abuse, and to keep our Services secure.
• Analytics and improvement. To identify usage trends and improve our Services, products, and user experience.
• Legal compliance. To comply with our legal obligations and respond to legal requests.

3. When and With Whom Do We Share Your Personal Information?

In Short: We may share information in specific situations and with the following third parties.

We may share your data with third-party vendors, service providers, contractors, or agents who perform services on our behalf. We have contracts in place with our third parties designed to safeguard your personal information.

The third parties we may share personal information with include:

• Authentication & Database: Supabase (Auth + Database)
• Map & Navigation: Google Maps Platform
• Error & Performance Monitoring: Sentry, including session-replay diagnostics that record on-screen interactions (with text and inputs masked) to help us reproduce and fix bugs
• Product Analytics: PostHog (anonymous, consent-based, off by default until you opt in)
• Push Notifications: Expo push notification service
• Website Hosting & Infrastructure: Vercel
• Social Login: Google Sign-In
• App Distribution: Google Play Console, Apple TestFlight

Guardian Mode — Safe Contact Sharing.

When you activate Guardian Mode, your real-time GPS location and trip progress data will be shared with the specific contacts you have designated by their Àjàlá ID. By activating this feature, you explicitly consent to this sharing. You may deactivate Guardian Mode at any time within the app.

Google Maps Platform APIs.

We use Google Maps Platform APIs to retrieve location-specific information including precise geolocation (latitude and longitude), IP address, and transit landmark search queries. Google Maps uses GPS, Wi-Fi, and cell towers to estimate your location. You may revoke your consent at any time by contacting us at the details provided at the end of this document.

Business Transfers.

We may share or transfer your information in connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business.

4. Do We Use Cookies and Other Tracking Technologies?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. We also permit third parties and service providers to use online tracking technologies on our Services for analytics and advertising. Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Notice.

In the mobile app, product analytics are off by default and only run if you opt in to anonymous usage analytics; you can withdraw that consent at any time in the app. On the website, you can refuse non-essential cookies via the cookie banner.

5. How Do We Handle Your Social Logins?

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (such as Google). Where you choose to do this, we will receive certain profile information from your social media provider, which may include your name, email address, and profile picture. We will use this information only for the purposes described in this Privacy Notice. We are not responsible for other uses of your personal information by your third-party social media provider and recommend that you review their privacy policies.

6. How Long Do We Keep Your Information?

In Short: We keep your information while your account is active. When you delete your account, we delete it — we do not keep a copy in case someone asks for it later.

We only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required by law. When we have no ongoing legitimate business need to process your personal information, we delete or anonymise it.

What happens when you delete your account

Deletion is immediate and permanent. The following are erased from our systems at the moment you confirm:

• Your profile: name, age, email and your Àjàlá ID
• Your safe contacts, both the people you added and anyone who added you
• Any pending safety alerts
• Your saved routes and live trip history
• Your login credentials, which signs you out everywhere

Contributions that other users depend on stay on the platform: road reports, fare reports and any routes you submitted. A report that a road is blocked does not stop being true because its author left. Your name and your account reference are stripped from them, so they remain as anonymous community data and cannot be traced back to you.

Feedback and support messages you sent us are deleted with your account. They were addressed to us, not to other users, so nothing is lost by removing them.

Retention required by Nigerian law

Where Nigerian law obliges us to retain particular records for a defined period, we comply with that obligation. In that case we keep only the specific records the law requires, for only as long as it requires, held separately from our active systems, and we delete them at the end of that period. We do not use a legal retention obligation as a reason to keep anything beyond it.

The obligation people most often ask us about is section 38 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, which requires a "service provider" to keep traffic data and subscriber information. That duty is defined by what the authority responsible for regulating communication services in Nigeria prescribes, and it is aimed at licensed communications providers. Àjàlá is not one, and no such retention has been prescribed for us, so we do not keep a standing archive of deleted accounts under that section. Section 38 also requires anyone acting under it to respect the constitutional right to privacy, and the 2024 amendment to the Act requires retention practices to align with the Nigeria Data Protection Act 2023 — under which holding personal data we are not obliged to hold would itself be unlawful.

What section 38 does require of us is preservation on request. If a law enforcement agency serves a valid request before your account is deleted, we must preserve what that request specifies, and we will. That is covered under the next heading.

Beyond what the law requires, we do not keep a copy of a deleted account in anticipation of a possible future request from any third party. Retaining personal data with no lawful basis would defeat your right to erasure under the Nigeria Data Protection Act 2023, and information we do not hold cannot be breached, leaked or misused.

Requests from law enforcement and government agencies

If we receive a valid, legally binding request from a competent authority, we will disclose the information we hold at the time of that request, and no more. Where the law obliges us to preserve specific information — for example under a lawful preservation order served before an account is deleted — we will preserve exactly what that order requires, for exactly as long as it requires, stored separately from our active systems and deleted at the end of that period. We will notify you of such a request unless we are legally prohibited from doing so.

We require valid legal process. We do not hand over personal information on an informal request.

7. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through a system of organisational and technical security measures.

We have implemented appropriate and reasonable technical and organisational security measures designed to protect the security of any personal information we process, including using Supabase for encrypted database storage and Sentry for real-time error and anomaly monitoring. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. What Are Your Privacy Rights?

In Short: You may review, change, or terminate your account at any time.

Withdrawing your consent: You have the right to withdraw your consent at any time by contacting us using the details in Section 14. This will not affect the lawfulness of the processing before its withdrawal.

Opting out of marketing: You can unsubscribe from our marketing communications at any time by clicking the unsubscribe link in our emails or by contacting us. We may still send you service-related messages necessary for the operation of your account.

Account Information: You may review or change information in your account settings at any time.

Account Deletion: In compliance with Apple App Store and Google Play Store requirements, you may delete your account and all associated personal data at any time, either in the Àjàlá app (Settings → Account → Delete Account) or on this website (Your account → Danger zone → Permanently delete account). Upon deletion, your account and data will be permanently removed from our active databases. Road and fare reports you contributed remain on the platform, as other users rely on them; they are no longer linked to you. We may retain minimal information in our files only where required to prevent fraud or comply with legal obligations.

If you have questions about your privacy rights, please email us at admin@ajala.live.

9. Age Restrictions

You must be at least 13 to use Àjàlá, which matches the age requirement in our Terms. The Nigeria Data Protection Act 2023 treats anyone under 18 as a child, so if you are between 13 and 17 you need the consent of a parent or legal guardian before you use the Service, and we rely on that consent as our lawful basis for processing your information.

We do not knowingly collect personal information from anyone under 13, and we do not knowingly process a child's information where the required parental consent has not been given. If we learn that we have, we will delete it as quickly as possible. A parent or guardian may contact us at admin@ajala.live to review, correct or delete their child's information, or to withdraw consent.

10. Crowdsourced Intelligence & Prohibited Conduct

Àjàlá operates on the integrity of its community-sourced transit data. All transit information on our platform — including prices, 'Conductor Shouts', route data, and road condition reports — represents estimates based on real-world, crowdsourced intelligence and is subject to change without notice. We do not own or operate any vehicles.

Prohibited Conduct — Crowdsourced Feed Integrity.

You agree that you will not:

• Submit false, misleading, or fabricated road condition reports (e.g., reporting a road as 'Clear' when it is gridlocked, or vice versa);
• Manipulate, spam, or flood the crowdsourced intel feed with inaccurate data;
• Use the reporting feature for any purpose other than providing genuine, good-faith transit intelligence;
• Abuse Guardian Mode to share a location that is not your own, or to deceive your designated Safe Contacts.

Violations of these rules may result in the immediate suspension or permanent termination of your account at our sole discretion.

11. Limitation of Liability — The Lagos Factor

ÀJÀLÁ IS A NAVIGATION GUIDE, NOT A GUARANTEE. Our platform provides estimates and intelligence based on crowdsourced, real-world data. Lagos is a dynamic city, and transit conditions can change instantly.

We are expressly not liable for:

• Sudden or unannounced fare increases by vehicle operators;
• Road closures, traffic diversions, or route cancellations;
• Transit delays, missed connections, or extended journey times;
• Any physical incident, loss, injury, or harm occurring during your commute;
• Inaccuracies in crowdsourced data submitted by other users;
• The unavailability of any particular route or transit mode.

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL LIABILITY TO YOU FOR ANY CLAIM ARISING FROM OR RELATING TO YOUR USE OF THE SERVICES SHALL NOT EXCEED TEN THOUSAND NAIRA (₦10,000), REGARDLESS OF THE FORM OF THE ACTION OR THE BASIS OF THE CLAIM.

NOTHING IN THIS SECTION LIMITS LIABILITY FOR FRAUD, GROSS NEGLIGENCE, OR ANY LIABILITY THAT CANNOT BE EXCLUDED UNDER APPLICABLE NIGERIAN LAW.

12. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ('DNT') feature you can activate to signal your privacy preference. At this stage, no uniform technology standard for recognising and implementing DNT signals has been finalised. As such, we do not currently respond to DNT browser signals. If a standard for online tracking is adopted that we must follow in the future, we will inform you in a revised version of this Privacy Notice.

13. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated 'Revised' date at the top of this Privacy Notice. If we make material changes, we may notify you by posting a prominent notice or by sending you a direct notification. We encourage you to review this Privacy Notice frequently.

14. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at admin@ajala.live or contact us by post at:

15. How Can You Review, Update, or Delete the Data We Collect From You?

You have the right to request access to the personal information we collect from you, correct inaccuracies, or request deletion of your personal information. These rights may be limited in some circumstances by applicable law.

Self-service deletion:You can delete your account and all associated data at any time, either in the Àjàlá app (Settings → Account → Delete Account) or on this website (Your account → Danger zone → Permanently delete account).

Data Subject Access Request: To request to review, update, or delete your personal information, you may also submit a request by emailing us at admin@ajala.live. We will respond in accordance with applicable data protection laws.

Governing Law & Dispute Resolution

This Privacy Notice and any disputes arising from it shall be governed by and construed in accordance with the laws of the Federal Republic of Nigeria, without regard to conflict of law principles.

In the event of a dispute, both parties agree to first attempt resolution through good-faith informal negotiations for a period of thirty (30) days from the date notice of the dispute is given. If the dispute is not resolved within this period, it shall be submitted to final and binding arbitration in Lagos, Nigeria, in accordance with applicable Nigerian arbitration law.