Privacy Policy

1. Introduction

Drevva ("Drevva", "we", "us", "our") respects your privacy. This Privacy Policy explains what personal information we collect through the Drevva app and related services (the "Service"), why we collect it, how we use and share it, and the choices and rights you have.

This Policy applies to Customers and Mechanics/Merchants using the Drevva mobile app, and to administrators using Drevva's internal web dashboard. By using the Service, you consent to the practices described in this Policy, to the extent permitted by applicable law.

We process personal data in accordance with the Nigeria Data Protection Act, 2023 ("NDPA") and its implementing regulations.

2. Information We Collect

We collect the following categories of information:

Account information — your name, email address, phone number, and password (we never store your password in plain text; authentication is handled by Firebase Authentication, which stores only a cryptographic hash).

Identity verification information (Mechanics only) — to reach Green tier and become eligible to receive jobs, we collect your National Identification Number (NIN), a photograph of your workshop and its address, your years of experience and service specialisations, and the full name and phone number of two professional references you provide. Your NIN is verified against Nigeria's national identity database through a licensed third-party identity verification provider, which returns the name, date of birth, and photograph held on record so that we can confirm the NIN belongs to you. We use this information only to verify your identity for the Service.

Financial/payout information (Mechanics only) — at Green-tier verification, your bank name, account number, and account name, collected so we can pay you for completed jobs. This information is stored in an access-restricted location that only you and Drevva administrators can read — it is never shown to Customers or other Mechanics.

Location information — your device's precise (GPS) location. For Customers, this is used to find nearby Mechanics and to route a Mechanic to you. For Mechanics, your location is shared with Drevva while you are marked "online" and available to receive jobs — including in the background while the app is not actively open, so that dispatch remains accurate and job alerts reach you promptly. You can disable location access at any time in your device settings, but doing so will prevent you from requesting or receiving jobs.

Vehicle information (Customers) — the make, model, and year of your vehicle and a description of the issue you are experiencing, provided when you request service.

Communications — messages you send through Drevva's in-app chat with a Customer or Mechanic assigned to your job.

Payment and transaction information — your Drevva wallet balance, transaction history (top-ups, job payments, earnings, refunds), and, once live payment processing is enabled, information exchanged with our payment processor, Paystack, to complete a transaction. Drevva does not itself store your full card or bank login details — those are handled directly by Paystack under its own security and privacy practices.

Ratings and reviews — star ratings and written reviews submitted about a Mechanic after a completed job.

Device and technical information — push-notification tokens (so we can alert you to a new job or job update), device model and operating system, app version, IP address, and device-integrity signals (via Google Play Integrity on Android and Apple App Attest on iOS) used to confirm the app you're using is a genuine, unmodified copy obtained through the Google Play Store or Apple App Store, as an anti-fraud measure.

Information from third-party sign-in — if you sign up or sign in with Google, we receive your name, email address, and profile photo (if available) from your Google account, as permitted by your Google account settings.

3. How We Use Your Information

We use the information above to:

• Create and manage your account, and verify your identity and (for Mechanics) qualifications.
• Match Customers with nearby, available Mechanics and route jobs.
• Process wallet top-ups, hold and release escrowed payments, and pay Mechanics for completed jobs.
• Send push notifications for job alerts, status updates, and account-related communications.
• Enable in-app chat between a Customer and the Mechanic assigned to their job.
• Investigate and resolve disputes between Customers and Mechanics.
• Detect, prevent, and investigate fraud, phantom or duplicate accounts, and abuse of the Service.
• Maintain the security and integrity of the Service, including verifying that requests come from a genuine copy of the app (see Section 2, device-integrity signals).
• Comply with applicable law, respond to lawful requests from public authorities, and enforce our Terms of Service.
• Improve and develop the Service.

4. Legal Basis for Processing

Under the NDPA, we rely on one or more of the following legal bases depending on the specific processing activity: your consent (for example, when you grant location or notification permissions); the necessity of processing to perform our contract with you (for example, processing a job request or payout); our legitimate interests, balanced against your rights (for example, fraud prevention and service improvement); and compliance with a legal obligation (for example, retaining financial transaction records as required by applicable Nigerian financial regulation).

Where we rely on your consent, you may withdraw it at any time, though this may limit or disable parts of the Service that depend on that data (for example, disabling location access will prevent job dispatch).

5. How We Share Your Information

We share information in the following circumstances:

Between Customers and Mechanics — when a job is dispatched, the assigned Mechanic and Customer can see each other's name, phone number, and the location relevant to the job, so the job can actually be carried out. This is the core purpose of the Service and cannot be disabled while using it.

Service providers who process data on our behalf — Google Firebase and Google Cloud Platform (hosting, authentication, database, file storage, push notifications, app-integrity checks), Google Maps Platform (maps, geocoding, routing), Google Sign-In, Termii (SMS delivery for phone verification), Prembly (identity/NIN verification), and Paystack (payment processing). These providers only receive the information necessary to perform their function for us and are contractually restricted from using it for their own purposes.

Legal and safety reasons — we may disclose information if required by law, court order, or governmental request, or where we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Drevva, our users, or the public.

Business transfers — if Drevva is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this Policy or a successor policy that provides equivalent protection.

We do not sell your personal information to third parties, and we do not share your data with third parties for their own independent marketing purposes.

6. International Data Transfers

Our infrastructure providers, including Google Firebase/Google Cloud and Google Maps, may process and store data on servers located outside Nigeria. Where personal data is transferred outside Nigeria, we take steps intended to ensure it receives a level of protection consistent with the NDPA, including relying on providers with recognised international security and compliance certifications.

7. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. Specific retention rules currently in effect:

• If you sign up with an email and password and do not verify that email within 7 days, your account and associated profile data are automatically deleted.
• Financial and transaction records (wallet transactions, payouts) are retained for as long as required by applicable Nigerian financial recordkeeping regulations, which may extend beyond account closure. [Note: the precise statutory retention period should be confirmed with qualified counsel/regulatory guidance before public launch — this Policy will be updated once confirmed.]
• If you delete your account, we delete or anonymise your personal information within a reasonable period, except where we are required or permitted to retain it (for example, for fraud investigation, dispute records, or the financial-recordkeeping requirement above).

8. Data Security

We use industry-standard safeguards to protect your information, including encryption of data in transit, Firebase security rules that restrict who can read or write specific data (for example, your bank/payout details are stored in a location only you and Drevva administrators can access — not visible to other Customers or Mechanics), server-side verification of sensitive actions like email/phone verification status, and device-integrity checks (Play Integrity / App Attest) that help block requests from tampered or unofficial copies of the app.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you and the relevant regulator as required by the NDPA.

9. Your Rights

Subject to applicable law, including the NDPA, you have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion of your information (subject to Section 7's retention exceptions); restrict or object to certain processing; request a copy of your information in a portable format; and withdraw consent where processing is based on consent.

To exercise any of these rights, contact us at support@drevva.com. We will respond within the timeframe required by the NDPA.

10. Location Services

The Service uses precise location data to power its core dispatch functionality. As a Customer, your location is used to find nearby Mechanics and calculate distance-based pricing. As a Mechanic, your location is shared with Drevva while you are online and available to receive jobs — including via a background location service so that job alerts reach you and your position stays current even when the app isn't in the foreground. You can manage location permissions in your device settings at any time; disabling location access will limit or disable your ability to request or receive jobs.

11. Push Notifications

We send push notifications for job alerts, job status changes, and important account or service updates. You can disable push notifications in your device settings, though doing so may cause you to miss time-sensitive job alerts.

12. Children's Privacy

The Service is not directed to, and is not intended for use by, anyone under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from someone under 18, we will delete it.

13. Third-Party Links and Services

The Service may link to or integrate with third-party services (for example, opening a map application, or Paystack's payment page). This Policy does not apply to those third parties' own collection and use of your information — please review their respective privacy policies.

14. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will notify you in the app or by email before the change takes effect. The "Effective date" at the top of this Policy indicates when it was last revised.

15. Contact Us

Questions, requests, or complaints about this Privacy Policy or how we handle your information can be sent to support@drevva.com.