Privacy Policy

Account information. Name, email address, phone number, username (tag), password (stored hashed), and profile photo.

Identity verification (KYC). To open a wallet we collect, through our verification partners, your BVN and/or NIN, date of birth, government-issued ID, and a selfie/liveness check. Riders additionally provide a driver's licence, vehicle details, a photo and short video, and next-of-kin contact details.

Transactions and orders. Wallet balances, payments, held-funds and payout records, payment links you create (including item photos and descriptions), orders, delivery addresses and receiver contact details, delivery codes, inspection photos and videos, disputes, and ratings.

Location. For riders on an active delivery, we collect live location (with speed and heading) to enable order tracking. Buyers and sellers may optionally attach coordinates to addresses to help delivery.

Device and usage data. IP address, device and browser type, app version, access logs, and security events (such as login attempts).

Messages to us. Contact-form submissions, support conversations, and waitlist or rider-application details.

• to create and secure your account and wallet, and to process protected payments, deliveries, and payouts;
• to verify your identity and comply with know-your-customer, anti-money-laundering, and other financial regulations;
• to connect buyers, sellers, and riders on an order and let them track it;
• to prevent, detect, and investigate fraud and abuse, and to resolve disputes using order evidence;
• to respond to your messages and provide support;
• to send service communications (receipts, delivery updates, security alerts) and — only with your consent — marketing you can opt out of at any time;
• to understand usage and improve the Service.

We process your data where it is necessary to perform our contract with you (running your account, payments, and deliveries), to comply with legal obligations (KYC/AML, tax, regulatory requests), for our legitimate interests (security, fraud prevention, service improvement) balanced against your rights, or with your consent (marketing, optional location for addresses), which you may withdraw at any time.

Other parties to your order. When you buy, the seller and assigned rider see the delivery name, phone number, and address you provide. When you sell, buyers see your listing content. Riders on a delivery share their live location with the buyer and seller.

Financial partners. Our licensed banking partner (currently VFD Microfinance Bank) provides wallets and virtual accounts and receives the data needed to operate them, as required by CBN regulations.

Verification partners. Identity-verification providers (currently Dojah) process your KYC data on our behalf.

Service providers. Hosting, email delivery, analytics, and customer-support tools that process data under contract with us.

Authorities. Courts, regulators, and law enforcement where the law requires or permits — for example, suspicious-transaction reporting.

We do not sell your personal data.

We keep your data for as long as your account is active and, after closure, for as long as the law requires — financial and KYC records are retained for at least five years under Nigerian AML regulations. Order evidence (photos, tracking) is kept for as long as needed to resolve disputes. We delete or anonymise data that we no longer need.

Wallet credentials and sessions are protected with encryption in transit, hashed passwords, transaction PINs, and optional two-factor authentication. Access to personal data inside Techrific is limited to staff who need it. No system is perfectly secure — protect your password, PIN, OTPs, and delivery codes, and tell us immediately at support@carty.ng if you suspect unauthorised access.

Under the NDPA you may:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data (much of this you can do in the app);
• delete your account and data, subject to records we must keep by law;
• object to or restrict certain processing, and withdraw consent where processing is based on it;
• receive your data in a portable format;
• complain to the Nigeria Data Protection Commission (NDPC) if you believe we have mishandled your data.

To exercise any of these rights, email support@carty.ng. We respond within 30 days.

The website uses strictly necessary cookies to keep you logged in (httpOnly session cookies) and local storage for preferences such as your theme choice. We do not use third-party advertising cookies. You can clear cookies in your browser, but you will be logged out.

Carty is for adults. We do not knowingly collect data from anyone under 18; if we learn that we have, we will delete it and close the account.

Your data is processed primarily in Nigeria. Where a service provider processes data outside Nigeria, we transfer it only under safeguards recognised by the NDPA, such as contracts requiring an adequate level of protection.

We will post any changes here and update the date at the top. For material changes we will also notify you in the app or by email before they take effect.

Data controller: Techrific Limited (Carty) · Lagos, Nigeria. Privacy questions: support@carty.ng · General: hello@carty.ng · or use the contact page.