1. Who we are
AuntyNow ("we", "us", "our") is the operator of the AuntyNow platform, an online service that connects parents and legal guardians ("Parents") with independent childcare providers ("Caregivers") in Lagos and Abuja, Nigeria.
For the purposes of the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act 2023, AuntyNow acts as the Data Controller for personal data collected through the platform.
Contact: hello@auntynow.ng (general) or privacy@auntynow.ng (data protection questions and data subject requests).
2. Data we collect and why
We collect only personal data that is necessary, adequate and relevant for the specific purposes set out below. We do not sell personal data.
| Category | Fields | Purpose | Legal basis |
|---|---|---|---|
| Account | Full name, email address, phone number, city, role, password salt and hash | Account creation, authentication, service delivery and communication | Performance of contract; legitimate interest in platform security |
| Parent identity and home verification | NIN, date of birth, residential address, recent utility bill or bank statement, emergency contact name and phone, relationship to children, household safety disclosures | Identity verification, address review, caregiver safety briefing and regulatory due diligence | Legal obligation; consent; performance of contract; vital interests of children |
| Caregiver public profile | Profile photo, first name, age range, bio, city, area, experience summary, hourly rate, availability, verification badge, completed-job count and rating | Allow Parents to discover and select Caregivers | Performance of contract; consent |
| Caregiver private verification | NIN, BVN, date of birth, next-of-kin name and phone, bank name and code, account number, resolved account name, submission and review records | Identity and payout verification, safety review, fraud prevention and emergency contact | Legal obligation; consent; performance of contract |
| Booking data | Parent identity, requested or assigned Caregiver, care address, verified-address match flag, different-location explanation, area, child count and ages, care notes, schedule, price fields and booking status | Create, assign, operate and audit bookings | Performance of contract; legitimate interest in dispute resolution |
| Payment and wallet | Paystack reference, amount, currency, status, channel, provider transaction ID, wallet balances, booking escrow and ledger entries | Collect, verify, hold, release and audit prepaid funds | Performance of contract; legal obligation |
| Status and location events | Assignment, en-route, arrival and completion timestamps; limited Caregiver location events during the en-route state | Maintain an audit trail, verify arrival and support dispute resolution | Performance of contract; legitimate interest |
| Address search | Search text entered to look up an address | Return OpenStreetMap address suggestions | Performance of contract |
3. How we use your data
We use personal data to:
- Provide, operate and improve the AuntyNow platform;
- Verify the identity of Parents and Caregivers through Youverify and government-issued identifiers;
- Process wallet top-ups and booking escrow through Paystack;
- Facilitate communication between a Parent and the assigned Caregiver regarding an active booking;
- Maintain safety records, audit logs and dispute evidence;
- Comply with applicable laws, regulations and lawful requests; and
- Send service-related notices such as booking confirmations, status updates and policy changes.
We do not use personal data for automated decision-making that produces legal or similarly significant effects without human review. Administrative approval decisions involve a trained reviewer.
4. Legal basis for processing (NDPR/NDPA)
Under the NDPR and Nigeria Data Protection Act 2023, we rely on one or more of the following lawful bases:
- Consent: Where you expressly agree, for example by ticking a consent box before identity verification or before optional marketing communications.
- Performance of a contract: Processing necessary to create your account, match bookings, hold escrow and complete payments.
- Legal obligation: Processing required to comply with applicable Nigerian laws, tax obligations, regulatory requests or court orders.
- Vital interests: Processing necessary to protect the life, health or safety of a child or another person in an emergency.
- Legitimate interests: Processing necessary for fraud prevention, network security, dispute resolution and service improvement, balanced against your privacy rights.
Where consent is the basis, you may withdraw it at any time by contacting privacy@auntynow.ng. Withdrawal does not affect the lawfulness of processing before withdrawal.
5. Data protection principles
We process personal data in accordance with the NDPR principles of:
- Lawfulness, fairness and transparency: We tell you what we collect and why before or at the point of collection.
- Purpose limitation: We collect data for specified, explicit and legitimate purposes and do not process it in ways incompatible with those purposes.
- Data minimisation: We limit collection to what is necessary.
- Accuracy: We take reasonable steps to ensure data is accurate and allow you to request correction.
- Storage limitation: We retain data only as long as necessary for the purposes stated or as required by law.
- Integrity and confidentiality: We apply technical and organisational security measures to protect personal data.
- Accountability: We maintain records of processing and respond to data subject requests.
6. Sharing and processors
We share personal data only with recipients who need it to provide the service or comply with the law:
- Paystack: Payment processing for wallet top-ups. Data shared includes email, amount, reference and transaction metadata. Paystack operates under its own privacy policy and PCI-DSS obligations.
- Youverify (YVOS): Identity verification using NIN, BVN, name and date of birth. Youverify returns a match result and verified name; we do not receive your raw BVN or NIN details back.
- OpenStreetMap / Nominatim geocoding: Address suggestions based on search text. No account identifiers are sent.
- Hosting and database providers: Application hosting, PostgreSQL database storage, backups and logs. Providers are bound by data-processing obligations.
- Law enforcement and regulators: We disclose data when required by law, court order or a valid regulatory request, or to protect vital interests.
We do not sell, rent or trade personal data to third parties for marketing.
7. International transfers
Our hosting and some subprocessors may store or process data outside Nigeria. Where this occurs, we rely on appropriate safeguards such as standard contractual clauses, adequacy decisions or the recipient's binding corporate rules, in line with the NDPR and Nigeria Data Protection Act 2023.
8. Data security
We apply the following technical and organisational measures:
- Passwords are stored as salted PBKDF2 hashes, not plaintext.
- Sessions use signed tokens in HTTP-only, Secure cookies.
- NIN, BVN, next-of-kin details, bank account numbers and emergency contacts are encrypted at rest.
- Profile images and documents are stored privately and served only through authenticated or administrator-only endpoints.
- Restricted APIs require a separate administrative key and reviewer identity.
- API routes enforce role-based and ownership checks before returning or changing records.
- Transport encryption is provided by the production hosting platform (TLS).
No system is completely secure. If you suspect a security issue, contact privacy@auntynow.ng immediately.
9. Your NDPR data subject rights
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your data, subject to legal or contractual retention requirements and open bookings.
- Restrict processing: Request that we limit how we use your data in certain circumstances.
- Object: Object to processing based on legitimate interests.
- Data portability: Receive your data in a structured, commonly used format where technically feasible.
- Withdraw consent: Withdraw consent for processing that relies on it.
- Lodge a complaint: Complain to the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.
To exercise any right, contact privacy@auntynow.ng. We may need to verify your identity before fulfilling the request. We aim to respond within the timeframes required by the NDPR.
10. Data breach notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission without undue delay and, where appropriate, notify affected users in accordance with the NDPR.
11. Retention
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including:
- Active accounts and open bookings: retained while the account or booking is active.
- Completed bookings and payment records: retained for at least six (6) years to satisfy tax, accounting and legal obligations.
- Identity verification records: retained for the period required by applicable law and our risk-management policies.
Automated self-service deletion is not currently enabled. To request deletion or a retention schedule, contact privacy@auntynow.ng.
12. Children and sensitive notes
Only adults aged 18 or older may create an account. We do not knowingly collect data directly from children.
Parents should provide only the child information necessary for care (such as age, allergies, routine or special needs relevant to safe care). Do not enter a child's full legal name, school name, photographs, or unrelated sensitive personal information in booking notes.
13. Cookies and tracking
The platform uses authentication cookies and similar tokens necessary for security and service operation. We do not currently use advertising or third-party analytics cookies. Any future use of non-essential cookies will be disclosed and, where required, consented to before deployment.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in law, technology or our service. We will notify users of material changes through the platform or by email. The Last updated date at the top of the page shows the current version.