1. Who we are
AuntyNow connects adult parents or legal guardians with childcare providers in Lagos and Abuja, Nigeria. This notice covers the website, related mobile services, account verification, bookings and support. The platform operator acts as controller for its own account, marketplace, payment-record and safety processing.
The registered operator name and business address must be confirmed before this draft is finalised; the AuntyNow brand name is not a substitute for those details. Contact hello@auntynow.com for general help or privacy@auntynow.com for privacy questions.
This notice uses the Nigeria Data Protection Act 2023 (NDPA) and the NDPC General Application and Implementation Directive 2025 (GAID) as its reference framework, not as a claim of regulatory approval.
2. Data we collect and why
Most records come from you. We also receive verification and payment results from providers, ratings and booking activity from the other party, and technical records generated by the service. Give emergency contacts and other adults this notice before providing their details.
| Category | Information and purpose | Basis for the purpose |
|---|---|---|
| Account | Name, email, phone, city, role, password hash and session records for account access and security. | Contract for the account; legitimate interests in preventing unauthorised access. |
| Identity and household review | NIN/BVN where requested, legal name, date of birth, address evidence, emergency contacts, household disclosures and review records for eligibility and safety checks. | Specific verification consent; proportionate legitimate interests for safety review. Sensitive information requires an additional applicable condition. |
| Caregiver listing | Display name, photo, age calculated from date of birth, city/area, bio, experience, rate, availability, verification badge, rating and completed-job count. | Contract to display the profile and offer the marketplace service. |
| Bookings | Schedule, care address/pin, child count/ages, notes, selected/assigned caregiver, status and price, to arrange the requested care. | Contract for the adult booking; parent/guardian consent for child information and any sensitive care details. |
| Payments and wallets | Payment reference, amount, status, provider transaction details and ledger entries; bank code, account number and resolved name for payout verification. | Contract for payment/verification; a specific legal obligation where applicable to financial records. |
| Service activity | Journey, arrival and completion times; limited en-route location events where shared through mobile features. | Contract for booking updates; permission for optional device access; proportionate legitimate interests for dispute evidence. |
| Support and technical records | Messages, reports, administrative review/audit records and security/request logs for support, safety and security. | Contract for support; legitimate interests for security and disputes; vital interests only in a genuine emergency. |
| Maps, notifications and browser choices | Address search text and map area for Mapbox through our server; mobile push tokens/payloads; cookie choices and optional device preferences. | Contract for requested tools and service notices; consent for optional browser features and device permissions. |
3. How we use your data
We use relevant information to provide accounts and bookings, review identity and eligibility, process payments, show booking updates, support users and review disputes or security incidents. Required fields may be necessary for the relevant service; optional chat and browser preferences are not a condition of booking.
Caregiver search can rank or filter profiles using location, availability, rating, experience, completed jobs and price. A preferred profile or recommendation is not an automatic assignment or a suitability guarantee. New requests receive staff review before a caregiver offer and parent confirmation. Identity, eligibility, scheduling and coverage rules can prevent a request or assignment from proceeding. Ask hello@auntynow.com for an explanation, correction or human review of an apparent error.
Request records also include the care type, short-notice selection, decision deadline, reviewed duty brief, offers, quoted charges, quote versions, acceptance times and workflow events. These support the requested arrangement, price agreement, support and dispute review. A quote acceptance is not blanket consent to unrelated processing.
4. Lawful bases and your choices
A lawful basis must be connected to a specific purpose. Contract supports the adult account, requested booking and payment functions. Proportionate security and fraud review may rely on legitimate interests, balanced against your rights. A legal-obligation basis requires a particular applicable law or lawful order, not a general claim that all verification is required by law.
Specific consent applies to identity checks and optional browser features. Additional conditions apply to sensitive data and information about children. A genuine emergency may justify necessary processing to protect someone’s vital interests; routine care is not automatically an emergency.
Withdraw consent through Cookie settings for browser features or privacy@auntynow.com for other consent-based processing. Withdrawal does not undo earlier lawful processing. Refusing optional chat or device preferences does not prevent account access or booking; missing necessary account or verification information may prevent the relevant service.
5. Data protection principles
Processing must be lawful, fair and transparent; limited to specified purposes; relevant and no more extensive than necessary; accurate; retained no longer than needed; and protected against unauthorised access or loss. Accountability requires evidence and operational controls, not just this notice.
Before confirmation, a caregiver receiving a reviewed offer sees limited details such as area/city, schedule, child count/ages, household indicators, a staff-prepared duty brief and proposed pay. Staff must keep exact addresses and contact details out of that brief. The precise address and original detailed care notes are reserved for the confirmed, assigned caregiver. Approved caregiver profile information is visible in listings. Do not put private identifiers in a public profile.
6. Sharing and processors
Provider integrations include Paystack for payments and bank-account resolution; Youverify for NIN/BVN verification; Mapbox for server-mediated address search and map tiles; Railway for deployed application/database/worker services; Expo for mobile push; and Vera Connect for optional website chat. Each receives information needed for its function, not every data category. See the provider register.
Youverify receives the submitted identity details and returns provider results; the application stores selected verification fields rather than a blanket promise that no other provider information is received. Providers may also have their own legal obligations and do not all act solely as processors.
Assigned booking parties receive relevant care and household information. Authorised administrators access records for review and support. Necessary, proportionate disclosures may be made for a valid legal requirement, an immediate safety risk or a legal claim. We do not sell personal data or operate advertising trackers through the current cookie choices.
7. International transfers
Provider infrastructure may process data outside Nigeria. The actual hosting countries, onward recipients and transfer safeguards depend on the deployed services and require verification before this draft is finalised. We do not claim all data remains in Nigeria or that a particular transfer agreement is already signed.
Transfers require a valid basis under the NDPA and applicable NDPC guidance, including specific consent where required. Contact privacy@auntynow.com for the locations, recipient details and safeguards applicable to your data.
8. Data security
The application hashes passwords with salted PBKDF2, uses HTTP-only session cookies with Secure enabled in production, restricts private-document routes by authentication/role, encrypts selected identity and financial fields, and records administrative actions. Administrator access uses a separate session cookie and access checks.
These controls do not mean that every free-text field or upload is individually encrypted. Approved caregiver profile photos are intentionally visible in listings; private verification documents are different. No system is guaranteed secure. Report suspected unauthorised access to privacy@auntynow.com without including passwords, identity numbers or sensitive attachments.
9. Your data protection rights
Subject to applicable conditions, you may request access and a copy, correction, erasure, restriction or portability; object to relevant processing; withdraw consent; and challenge significant automated decisions. You can complain directly to the Nigeria Data Protection Commission or seek a remedy in a competent court.
See Privacy Requests & Account Deletion for practical steps. Requests may require proportionate identity or authority checks. Contacting us first does not waive a regulatory or court remedy. A refusal or delay should be explained under the applicable legal requirements.
10. Data breach notification
Suspected personal-data incidents need assessment, containment and documentation. Applicable NDPA notification duties include notifying the NDPC within 72 hours of awareness when a breach is likely to risk individuals’ rights and freedoms, and notifying affected individuals where the statutory high-risk threshold applies. This draft does not certify that incident-response staffing or provider notification contracts have been completed.
11. Retention
Account, booking, payment, verification and support records require different retention decisions. The Data Retention Policy explains the criteria and the browser durations implemented in the app. A final category-by-category retention schedule, including backups and provider copies, still needs operational and legal approval.
There is no self-service account-deletion button or universal automated purge schedule in the current service. Email privacy@auntynow.com to request deletion; do not assume signing out removes your server records.
12. Children and sensitive notes
Only adults aged 18 or older may create an account. We do not knowingly collect data directly from children.
Parents should provide only the child information necessary for care (such as age, allergies, routine or special needs relevant to safe care). Do not enter a child's full legal name, school name, photographs, or unrelated sensitive personal information in booking notes.
13. Cookies and tracking
Essential authentication cookies are separate from optional city/view storage and Vera Connect chat. These optional features start off and require a saved choice. Consent is browser-specific, not an account-wide marketing permission. See the Cookie Policy for the inventory.
14. Changes to this policy
We may update this Privacy Policy to reflect changes in law, technology or our service. We will notify users of material changes through the platform or by email. The Last updated date at the top of the page shows the current version.