What we collect, why, and what we never do with it.

Tag Along Ltd operates TagRides — a Lagos-first route-share platform for riders and drivers. We collect only the information we need to match riders with drivers, process payments, support accountable trips, and comply with Nigerian law. We never sell your data. We never share it with advertisers. We delete it when you ask us to — through the app or by email.

Different information for different roles. Here's the full list.

From everyone (riders and drivers)

• Account identifiers. First and last name, email address, phone number. Used to identify you inside the app and communicate with you about your rides.
• Verification signals. Email verification tokens, one-time codes (OTPs) delivered by SMS or WhatsApp. Used to confirm you own the phone number or inbox you registered with.
• Location data. Your device's GPS coordinates while the app is open during a ride — pickup, drop-off, and any intermediate stops. Location is used only to route the ride; we don't build background location profiles or track you between rides.
• Trip history. The rides you've taken or given: origin, destination, timestamp, fare, driver or rider you were paired with, ratings you exchanged. Kept because you may need receipts and because the marketplace's future price + match quality depend on aggregate history.
• Payment activity. Wallet balance, top-ups, withdrawals, per-ride charges. Card details themselves never touch our servers — see the "Who processes what" section below.
• Device + connection. Push notification token (for ride updates), IP address, device model, operating system version, app version, coarse language + region setting. Used for delivery, debugging, and abuse prevention.
• Optional profile photo. If you set one, it's shown to your ride counterpart so they can recognise you at pickup. Deleted with your account.

From drivers specifically

• Driver verification documents. Government-issued ID, driver's licence, vehicle registration, and insurance certificate. Reviewed once for eligibility; encrypted at rest afterward.
• Vehicle details. Make, model, colour, year, licence plate, seat count. Shown to riders so they can confirm the right vehicle at pickup.
• Payout account information. Bank name and account number for driver earnings withdrawal. Held by our payment processor (Paystack); we hold only the last four digits for reference.

From landing-page visitors

• Waitlist email address (if you submit one). Stored only to email you when we launch in your city.
• Trip-fare research submissions (if you contribute one). Origin, destination, fare paid, time of day, mode. Used only to calibrate the in-app price-suggestion model. Never linked to your identity.
• Standard server logs (IP, user agent, request path) — for spam prevention. Rotated every 90 days.

• Card numbers, PINs, or CVVs — those go direct to our payment processor.
• Background location when the app isn't open for a ride.
• Your contact list, calendar, photos, or any device data outside what's listed above.
• Advertising identifiers or third-party tracking cookies.
• Anything from data brokers or purchased datasets.

Running a ride-sharing platform means we rely on specialist providers for a handful of functions. Each one sees only the specific data they need for their piece, and each one is bound by contract to protect it. Here's the whole list, so you know exactly where your data flows.

• Firebase (Google Cloud). Authentication, session management, and push notification delivery. Sees your phone number, email, and device push token.
• Google Maps Platform. Address autocomplete, geocoding, and the map tiles you see. Sees the addresses you search + your approximate location while the map is open.
• MailerSend. Transactional email delivery (verification links, receipts, security alerts). Sees your email address and the message content we generate.
• KudiSMS. SMS OTP delivery for phone verification. Sees your phone number and the OTP message body.
• Meta (WhatsApp Business API). Once enabled, we send OTPs and ride updates through WhatsApp as a preferred channel for Nigerian users. Meta sees your phone number and the message we send. We only use it as a delivery channel — we don't share ride history or profile data with Meta.
• Paystack. Payment processing (card top-ups, wallet holds, driver payouts). Sees the transaction amount, your name, your email, and card details you enter into their secure form. Paystack is PCI-DSS certified and NDPR-registered.
• Cloudinary. Storage + delivery of profile photos and vehicle images. Sees the images you upload.
• Amazon Web Services (AWS EC2, Lagos region where available). Where the TagRides servers run. AWS sees encrypted data at rest and encrypted traffic in transit — they never process it.
• Vercel. Hosts the marketing site (tagrider.com) — the landing page you're reading right now. Vercel sees only anonymised request logs typical of any static host.

We do not share your data with advertisers, data brokers, or any other third party for commercial gain — full stop. When Nigerian law requires disclosure (a valid court order, for example) we respond narrowly and log the request internally.

Under Nigeria's Data Protection Regulation (NDPR) and Data Protection Act 2023, we rely on the following bases:

• Contract performance. We can't match you with a ride without your account data + location. Signing up = agreeing to let us do exactly this.
• Legal obligation. Nigerian tax and consumer-protection law requires us to keep transaction records for a set period.
• Legitimate interest. Debugging crashes, preventing fraud and abuse, improving the matching model. We're careful to weigh these against your privacy expectations.
• Consent. Optional things — profile photo, marketing emails, WhatsApp opt-in for non-transactional messages. You can withdraw consent any time.

• Active account data (identity, contact, wallet): for the life of your account, deleted within 30 days of account deletion.
• Trip records: retained for 7 years (Nigerian tax + audit requirement), then automatically deleted.
• Driver verification documents: for the life of your driver account, or 5 years after account closure — whichever is longer — because we may need to demonstrate to regulators that someone was properly vetted at the time they carried passengers.
• Payment records: 7 years, same reason as trip records.
• Server logs: 90 days, then auto-rotated. Location data older than 30 days is aggregated into anonymous traffic patterns; individual GPS traces are deleted.
• Waitlist email: until you ask us to remove it, or 12 months after launch in your city.

Some of the processors above operate outside Nigeria (Google, Meta, AWS's global infrastructure). When your data leaves Nigerian soil, we rely on contractual safeguards — standard data-protection clauses — with each provider. We do not transfer data to jurisdictions the Nigeria Data Protection Commission has flagged as inadequate.

Under the NDPR + Data Protection Act 2023 you can ask us to do any of the following. Email privacy@tagrider.com and we'll respond within 5 business days.

• Access. Show me everything you have about me.
• Correction. Fix anything that's wrong.
• Deletion. Erase my account and everything tied to it. See the next section for the in-app path.
• Portability. Give me my data in a machine-readable format so I can take it elsewhere.
• Objection. Stop using my data for a specific purpose (e.g., product improvement model training). We'll comply unless we're legally required to keep it.
• Withdraw consent. For anything we do on a consent basis (marketing emails, WhatsApp opt-in).

If you're not happy with how we handled a request, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

You can delete your account — and every piece of data we hold about you — from inside the app:

1. Open the TagRides app
2. Tap the menu icon → Profile
3. Tap Delete Account at the bottom
4. Confirm when prompted

Deletion is complete within 30 days. We erase your identity, contact, wallet, location, and profile data. We keep the anonymised transaction records that Nigerian tax law requires us to hold (7 years) — those cannot be tied back to you.

Prefer not to use the app? Email privacy@tagrider.com with "Delete my account" in the subject line, and confirm your identity by replying from the email address on your TagRides account. We'll process the request within 5 business days and confirm when complete.

Everything we hold is encrypted in transit (HTTPS/TLS 1.3) and at rest (AES-256 on our databases). Access to production systems is restricted to a small on-call team, gated behind two-factor authentication + hardware keys, and logged. We run periodic security reviews and rehearse incident response.

If we ever discover a breach involving your data, we'll notify you and the Nigeria Data Protection Commission within 72 hours as required by law.

TagRides isn't designed for anyone under 18 (the driving-age threshold in Nigeria). We don't knowingly collect data from minors. If you believe a minor has signed up, email privacy@tagrider.com and we'll delete the account immediately.

We'll update the "Last updated" date at the top. For material changes (new processors, new data types collected, changed retention periods), we'll notify you inside the app and by email at least 14 days before the new policy takes effect. If you disagree with the change, you can delete your account before it applies to you.

TAG-ALONG LTD, a Nigerian limited company (RC pending) operating in Lagos State. Registered privacy contact: privacy@tagrider.com. Read about us on the About page.