1. Who we are
GioBiz is run by Henmack Integrated Technologies Ltd (RC 9537539), Lagos, Nigeria. In this policy, "we" means that company.
- General contact: support@giobiz.com
- Data Protection contact: [Data Protection Officer — name to be added by GioBiz], reachable at support@giobiz.com (put "Data Protection" in the subject)
2. What we collect
Your account
- Email address, phone number, WhatsApp number (optional) and your password (we store it in a protected form, never as plain text)
- Your name or business name, business address, state and city, and your role (for example owner, staff, rider, logistics company, warehouse)
- If you sign in with Google: your Google account email and name, which Google sends us
- Staff names, roles, staff ID and staff PIN (the PIN is stored only in a scrambled, salted form)
Your business records
- Products, prices, stock, photos and logos
- Sales and orders: items, amounts, order source, payment status and times
- Your customers' names, phone numbers and delivery addresses, and credit (owe-me) records
- Activity logs: which staff member did what, and when
- Payout bank account details you enter (account number and bank — never card details)
People who order from a shop link
If you order from a shop's GioBiz link without an account, we receive the name, phone number and delivery address you type, and the order itself. We hold these for the shop (see section 6.3, "Shops and their customers").
Identity checks
Some roles and paid features need an identity check (for example riders, verified sellers and some business accounts).
- Automatic check (Dojah). You give your NIN and take a selfie. We send the NIN and the selfie to our identity provider, Dojah, which checks the NIN and whether the face matches. We keep the result: the verified name and date of birth Dojah returns, a face-match score, a masked ID number (not the full number) and Dojah's reference.
- Check by a person. Where an ID or driver's licence is checked by our team instead, we keep the photo of the document and your selfie in private storage that only our review team can open.
- Riders may also tell us their ID type and the last 4 digits of the ID number when they sign up.
- Workers checked by an employer. Before a business checks a worker's identity, the worker is sent a code by email and must agree first.
A selfie and face-match score are sensitive personal data under the NDPA. We only process them with your clear agreement at the moment you start the check. You can refuse, but then the role or feature that needs the check will not be available.
Location
- Riders on a delivery: the rider's live GPS position is shared from their phone while they are working on deliveries (roughly every 30 seconds). For live tracking we keep the rider's latest position, with their name, phone, status and the shipment they are carrying; each new position replaces the last. A location saved as proof of pickup or delivery may stay with that shipment. The business that the delivery belongs to can see it on its map.
- Addresses and map points: pickup and delivery addresses, and the map coordinates for them, are stored with each shipment.
- Address search: when you type an address, what you type is sent to our map providers to suggest matches and work out routes — Photon (run by komoot, Germany) and Mapbox (USA).
We only ask a phone for its location where it is needed for a delivery, never on first open.
Messages and chat
- We store the messages you send in GioBiz chat and Messages, and any files you attach (attachments are kept in private storage).
- Business owners can read their own staff's chats. An owner can open, read-only, a chat that involves one of their own staff, after entering their PIN. Every time an owner opens a staff chat it is recorded in a log that cannot be edited. If you are staff, treat your work chats as visible to your employer.
- Hidden copies. An owner or manager can add a person to a message as a hidden copy (like "BCC" in email). Other people in the conversation do not see that person. Every hidden copy is recorded, with who added it and when.
Jobs and Talent
If you use Jobs or Talent as a job seeker: your profile, work experience, languages, job preferences, the CV documents you upload, your answers to job questions and whether you agree to be contacted. If you are an employer: your job posts and, where you use payroll, your workers' pay records.
Property, Services and Maride Rider Pool deliveries
- Property: listings, photos, requests and offers you make.
- Services: service requests and offers you make.
- Maride Rider Pool deliveries: sender and receiver names, phone numbers and addresses for each booking.
Telegram, co-owners and credit transfers
We hold your Telegram bot token sealed, use it only to post to the channel you connected, and never read messages in your channel. Co-owners you invite can see your shop's records while they have access. Credit transfers record the sender and receiver GioBiz IDs.
Records of what you agreed to
When you accept our terms, a policy, a booking condition or a consent, we record what you accepted, the version, the time, your IP address and your browser/device details (user agent). We keep this as proof of what you agreed to.
Technical and security data
- IP address and device/browser type, used to slow down repeated sign-in attempts and to fight fraud
- One-time codes (OTP) and where they were sent — deleted when used or after at most 10 minutes
- Error reports when something breaks. We try to keep personal details out of them, but an error report can include the page address, your browser details and your IP address.
- Browser push subscriptions, if you turn on notifications (see section 6)
3. What we use it for
- To create your account, sign you in and keep it secure
- To run the app: products, sales, orders, staff, credit, deliveries, messages, jobs, property and services
- To show your shop to customers through your shop link
- To check identity where a role or feature needs it
- To arrange and track deliveries
- To take payment for GioBiz plans and credits
- To send you emails, texts and notifications about your account
- To run the AI features described in section 6.1
- To stop fraud, abuse and break-ins, and to keep the records the law requires
- To find and fix faults
We do not sell your data. We do not use it to build advertising profiles. We share it only as described in section 6.
4. Our legal reason for each use
The NDPA says we must have a lawful reason for each thing we do with personal data. Ours are:
| What we do | Our legal reason |
|---|---|
| Run your account, the app, deliveries, messages, payments for plans and credits | Contract — we need it to give you the service you signed up for |
| Selfie and face-match identity checks | Your explicit consent, given when you start the check |
| Other identity checks (NIN, licence, business registration) | Consent, and the contract for the role that needs it |
| Rider live location during deliveries | Contract — the delivery cannot be tracked without it |
| Address search sent to map providers | Contract — to find the address you asked for |
| AI features (Ask Gio, photo help) | Contract — they run only when you use them |
| Automatic listing safety checks, fraud and abuse prevention, security logs, IP records, error reports, internal staff alerts | Legitimate interest — keeping the platform safe and working |
| Keeping sales, payment and tax records | Legal obligation — Nigerian tax and accounting law |
| Optional marketing emails, browser push notifications | Consent — you can turn them off at any time |
5. What other people can see
When you publish products, anyone with your shop link can see your shop name, published products, descriptions, prices and photos, and the contact number you choose to show.
The order tracking page is open to anyone who has the tracking link. It shows the shop name, the items and total, the order status history (including the name of the staff member who updated it) and the name of the rider carrying it. It does not show the customer's phone number. Share a tracking link only with the person it is meant for.
6. Outside services that receive data
We use the companies below to run GioBiz. Each one receives only what it needs for its job. Some of them are outside Nigeria (see section 6.2).
| Company | What it does for us | What it receives | Where |
|---|---|---|---|
| Supabase | Main database and sign-in | Everything stored in your account | Outside Nigeria |
| Cloudflare | Runs the website and our server code, security, and storage of photos and files (R2) | All traffic to GioBiz; photos, documents, ID photos (private), message attachments (private), backups | Global |
| Monnify (Moniepoint) | Payments for GioBiz plans and credits | Your payment and the amount; your card or bank details go straight to them | Nigeria |
| Paystack | May be used for payments for plans and credits | As Monnify | Nigeria |
| Dojah | Identity checks | Your NIN (or other ID number) and your selfie | Nigeria |
| Brevo | Emails (codes, receipts, notices) | Your email address and the email content | EU |
| SmartSMS, BestBulkSMS, Africa's Talking | Text messages (for example account recovery and admin notices) | Your phone number and the text | Africa |
| "Sign in with Google" (and Firebase sign-in, which we are phasing out) | Your Google sign-in details | USA | |
| Photon (komoot) | Address search | The address text you type | Germany |
| Mapbox | Address search, map points and routes (including Maride Rider Pool) | Address text and map coordinates | USA |
| OpenAI | AI — see 6.1 | Your question and business records needed for the answer; product photos; listing text and photos; Maride Rider Pool application details | USA |
| Anthropic | AI — Ask Gio | Your question and business records needed for the answer | USA |
| Segmind | AI white-background product photos | The product photo | Outside Nigeria |
| Cloudflare Workers AI | Helps match similar Ask Gio questions | The question text | Global |
| Upstash | Saves recent Ask Gio answers so the same question is answered faster | The question, the answer (which can include your business records) and your business ID | Outside Nigeria |
| Sentry | Error reports | Error details, page address, browser details, IP address | Outside Nigeria |
| Telegram | Private alerts to the GioBiz team (new sign-ups, deliveries, requests) | Alerts can include names, emails and phone numbers of the people involved | Outside Nigeria |
| Browser push services (Google, Apple, Mozilla) | Delivering notifications you turned on | A device address and the notification text | Outside Nigeria |
| MaRide | Delivery partner for Maride Rider Pool bookings | Sender and receiver names, phones and addresses for that booking | Nigeria |
| Backblaze | May hold an extra, encrypted backup copy | An encrypted copy of the database backup | Outside Nigeria |
Card details never reach GioBiz. When you pay for a plan or credits, you pay on the payment company's own page. We receive only a confirmation and a reference.
Riders and delivery companies you book receive the pickup and delivery details they need to do the job.
We update this list when we add or remove a company.
6.1 How we use AI
AI is used in these places, and only these:
- Ask Gio (the assistant). Your question and the records from your business needed to answer it are sent to OpenAI or Anthropic. Those records can include your customers' names, phone numbers and addresses. Recent questions and answers are saved with Upstash so a repeat question is answered faster.
- Product photo help. A product photo you upload can be sent to OpenAI to suggest the product name and details, and to Segmind to make a white background.
- Listing safety checks. Listing text and photos are checked automatically by OpenAI for banned or unsafe items. This check can reject a listing automatically. If you think it got it wrong, email support@giobiz.com and a person will look at it.
- Maride Rider Pool provider applications. Details in an application, such as the business name and director's name, are sent to OpenAI to help check them before a person decides.
We use these companies' business services, not their public chat apps. AI answers can be wrong — check anything important before you rely on it. If you do not want your data sent to AI, do not use Ask Gio or the photo help.
6.2 Data sent outside Nigeria
Many of the companies above store or process data outside Nigeria (marked in the table). We send data abroad only where the NDPA allows it — for example where the company is bound by contract terms that protect your data, or where the transfer is needed to give you the service you asked for.
6.3 Shops and their customers
For your own GioBiz account, we are the "data controller" — we decide how your data is used. For the records a business keeps about its own customers (names, phones, addresses, orders, credit), the business is the controller and GioBiz handles those records for the business, only to provide the service. If you are a shop's customer and want your details changed or removed, ask the shop first; you can also email us and we will help.
7. Cookies and storage on your device
GioBiz stores small pieces of information in your browser so the app works:
- Your sign-in session, so you stay logged in
- Your settings, such as the theme
- Progress through sign-up and some forms, so you do not lose what you typed
Our sign-in provider (Supabase) and Cloudflare may also set cookies needed for sign-in and security. Our pages load Sentry's error-report script, which reports errors only — session recording is switched off.
Counting Marketplace views. GioBiz counts how many times items on the Marketplace are viewed and tapped. These are totals only: the count carries no name, no phone number, no email and nothing that identifies you, and it stores nothing on your device. We do not use advertising trackers or analytics tools from other companies (no Google Analytics, no Facebook pixel). Clearing your browser's storage signs you out.
8. How long we keep data
- One-time codes: deleted when used, or after at most 10 minutes
- Your account and business records: while your account is open
- Sales, payment and tax records: for the period the law requires, even after the account is closed (up to 7 years)
- Records of what you agreed to (with IP and device details): while your account is open, and afterwards for as long as we may need to show what was agreed
The full list, including the items where we have not yet set a fixed number of days, is in our Data Retention Policy.
9. Deleting your account
Deleting an account is a request we complete within 30 days. It does not happen the moment you press the button.
- Business owners: in the app go to Settings → Delete my account and send the request.
- Everyone else (staff, riders, logistics and warehouse users, job seekers, shop customers), or if you cannot sign in: email support@giobiz.com.
We check that the request really comes from you, then delete your data. Some records the law requires us to keep — sales, payments and tax records — are kept for the legal period and then deleted. Copies in our backups disappear as old backups are replaced. Full details: Account Deletion.
10. Your rights
Under the NDPA 2023 you can ask us to:
- Access — give you a copy of the data we hold about you
- Correct — fix data that is wrong or incomplete
- Delete — erase your data (see section 9)
- Object — stop using your data for a purpose based on legitimate interest, or for marketing
- Restrict — pause using your data while a complaint is checked
- Portability — give you your data in a common file format
- Withdraw consent — where we rely on your consent (for example identity checks or marketing), you can withdraw it at any time. This does not undo what was done before.
- Human review — ask a person to look again at a decision made automatically, such as a rejected listing
Email support@giobiz.com with "Data Protection" in the subject. We will check it is you, reply within 7 days, and complete the request within 30 days. If we cannot do something, we will tell you why.
Complaints. If you are not happy with how we handled your data, you can complain to the Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng. We would like the chance to put it right first, but you do not have to come to us first.
11. Keeping data safe
- Sign-in with Google or email and password. A text message code may be used to help you recover an account.
- All connections use HTTPS encryption.
- Each business's data is kept separate from every other business's, by our server and our database rules.
- Repeated sign-in attempts are slowed down and blocked.
- Staff PINs and passwords are never stored as plain text.
- ID photos, selfies and message attachments are kept in private storage, not on public links.
- Location details are removed from photos you upload (photos can carry the GPS position of where they were taken).
12. If something goes wrong (data breach)
If personal data is lost, stolen or seen by someone who should not see it, we will act to contain it, report it to the NDPC within 72 hours of finding out where the NDPA requires, and tell the people affected without delay if it is likely to put them at risk — saying what happened, what data was involved and what they should do.
13. Age — adults only
GioBiz is for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a child has an account or has given us their details, email support@giobiz.com and we will delete it.
14. Changes to this policy
When we change this policy we update the version and date at the top of this page. For important changes, we will also tell you in the app.
15. Contact us
- Email: support@giobiz.com
- Data Protection contact: [Data Protection Officer — name to be added by GioBiz], via support@giobiz.com
- WhatsApp: WhatsApp support
- Henmack Integrated Technologies Ltd (RC 9537539), Lagos, Nigeria