Privacy Policy

Point2 is operated by POINT2 DIGITAL LTD, a company registered in Nigeria under number RC2389271298 (“Point2”, “we”, “us”). We are the controller of the personal data described here. Contact us about privacy at:

• Email: support@point2.app
• Phone: 0811 233 6839
• In the app: Account → Help & Support (where you can also raise a ticket).
• Online: www.point2.app/support

Everyone with an account

• Name, phone number and/or email address, and a password if you set one.
• Sign-in and security data: one-time codes, session and device identifiers, IP address, device type and sign-in history.
• If you sign in with Google or Apple, the identifier, name and email those services share with us.
• Profile details you choose to add (for example a photo, date of birth or saved places).
• Emergency and trusted contacts you add. In the customer app you can pick a contact from your phone; the address book is read on your device and only the contact you choose is sent to us.
• Support requests, messages, reports and ratings.
• Push notification tokens.

Customers

• Bookings: pickup, stops and destination, service, price, payment method, delivery recipient name and phone, and delivery photos.
• Your location while you use the app (not in the background).
• If you use Pay Later or verify your identity: your NIN or BVN and a liveness selfie.
• Pay Later records: your limit, credit assessment and repayment history.

Operators

• Your NIN, a liveness selfie and identity data returned by our verification provider, including your NIN photo.
• Driver's licence, vehicle licence, vehicle photos, insurance and other required documents.
• BVN and bank account details for payouts.
• Your location whenever you are online in the operator app, including when the app is in the background. The app shows a “you're online” notice while this happens. Going offline stops it.
• Trip history, earnings, payouts and ratings.

Payments

Card details are entered with our payment provider, Paystack. We receive and keep a token for the card with its type, last four digits, expiry and issuing bank; we never receive or store your full card number.

Diagnostics

The apps and this website send crash and error reports (device type, app version, the error, and your account identifier in the apps) to Bugsnag, and the apps also use Firebase Crashlytics and Firebase Analytics. Shared-trip links are removed from error reports.

Website visitors

This website sets no cookies and runs no advertising or analytics trackers.

Waitlist members

• Your email address, and the name you'd like us to call you if you give one.
• Your country and, in Nigeria, your state; your city or town if you give it.
• How you're interested in Point2 (for example as a customer or a driver) and, if you choose, which services you would use.
• Whether you asked for optional product updates, and a record of what you agreed to and when.
• Whether you confirmed your email, and the emails we send you and whether they were delivered. To limit abuse, the website sends our servers a coded (hashed) form of your IP address instead of the address itself.

Your Pay Later limit and eligibility are set automatically from your verification status, account age, trip history, repayment history and cancellations. You can ask us to have a person review a Pay Later decision and to explain how it was made by contacting us.

• The other party to your trip. Customers see the operator's first name, photo, vehicle and plate, and live location. Operators see the customer's name, pickup and destination. If you call through the phone dialler instead of in-app messaging, your number is visible to the other person.
• People you share a trip with. A trip-share link shows the operator's first name and photo, the vehicle and plate, pickup and destination and the live location to anyone who has the link, until it closes.
• Your emergency contacts, by SMS, if you press SOS.
• Service providers who process data for us: Paystack (payments and payouts), Dojah (identity verification), DigitalOcean (hosting and storage), Vercel (website hosting), Amazon Web Services (delivering waitlist emails), Google (maps, sign-in, Firebase, and a Google Sheet we used for the waitlist before October 2026, which we are retiring), Mapbox (maps and routing), Expo, Apple and Google (push notifications), Bugsnag (error reports), and our email, SMS and WhatsApp delivery providers.
• Authorities, where the law requires it or to respond to a valid legal request.

We do not sell personal data and do not share it for advertising.

Some of the providers above store or process data outside Nigeria, including in the United Kingdom, the EuropeanUnion and the United States (for example our hosting and file storage, Amazon Web Services, Google, Apple, Bugsnag and Vercel). Where we transfer data abroad we do so as the Nigeria Data Protection Act 2023 permits. Contact us for details of the safeguards for a particular provider.

• One-time sign-in codes: 10 minutes. Sessions: until they expire or you sign out; expired sessions are removed hourly.
• Trip-share links: closed at most 12 hours after they are created, or 15 minutes after the trip ends.
• In-app chat: deleted 90 days after the trip ends, unless it is needed for a safety or legal case.
• Customer liveness selfies: deleted 90 days after the verification decision.
• Notifications: 30 to 90 days depending on type.
• Detailed trip location traces are summarised after the trip; archived traces are kept for up to 7 years.
• Trip, payment, wallet, Pay Later, payout, support and safety records are kept after an account is deleted, because we need them for accounting and tax, to resolve disputes and claims, and to prevent fraud.
• What happens when you delete your account is set out on our account deletion page.
• Waitlist: our systems are set to delete a sign-up whose email was never confirmed 90 days after it was made, and the details of a member who leaves 30 days after they leave. This automatic deletion is not switched on yet; until it is, details stay until you delete them. You can delete them at any time on the manage your waitlist details page. After a deletion we keep only a coded record of the email address so that we don't email it again.

Under the Nigeria Data Protection Act 2023 you can ask us to:

• give you a copy of your personal data and information about how we use it;
• correct data that is wrong or incomplete;
• delete your data (see Delete your account);
• restrict or object to how we use it, or move it to another service where that applies;
• withdraw consent you have given, without affecting what we did before; and
• have a person review a decision made automatically about you.

Waitlist members can change their details, stop product updates, leave the waitlist or delete their details themselves on the manage your waitlist details page, using a secure link we email to them. Every waitlist email also has a link to stop it.

Send other requests to us using the contact details above, from the email address or phone number on your account so we can confirm it is you. If you are not satisfied with our answer you can complain to the Nigeria Data Protection Commission (NDPC).

We use encrypted connections, role-based staff access with audit logs for sensitive data, and one-time codes for sign-in and sensitive actions. No system is perfectly secure; if a breach affects you we will tell you and the NDPC as the law requires.

We publish changes here with a new version number and effective date, and tell you in the app when a change affects you.