Privacy Policy
Last updated: October 15, 2026
RideArrivo is operated by RICHATHAOIR LIMITED (CAC RC 1654710), which is the data controller for the personal data described here. This policy covers ridearrivo.com and the RideArrivo rider and driver apps. It sets out what we collect, why we collect it, the lawful basis we rely on, who else sees it, how long we keep it and what you can ask us to do about it, under the Nigeria Data Protection Act 2023 (NDPA) and the transport rules we operate under in Lagos State.
1. Who we are and how to reach us
- Data controller: RICHATHAOIR LIMITED, registered with the Corporate Affairs Commission under RC 1654710.
- Registered office: Babajide Sanwo-Olu International Market, Ikosi, Lagos, Nigeria
- Data Protection Officer: privacy@ridearrivo.com
- General enquiries: info@ridearrivo.com
2. Information we collect
- Account information: name, email address, phone number, WhatsApp number, preferred language, country of residence, date of birth, and a hashed password. We never store plain-text passwords.
- Identity documents: a photograph of a government ID or a passport number where we need to confirm who you are. For drivers, this also covers driver's licence number, LASDRI number, insurance details, vehicle documents and photographs, and the vehicle owner's name and contact details.
- Trip and booking data: pickup and drop-off addresses and coordinates, additional stops, flight number if you give one, luggage details, vehicle preferences and accessibility choices, trip history, fares and payment references.
- Location data: precise GPS location from riders and drivers during an active trip, and from drivers whenever they are online and available for work. We do not collect a driver's location while they are offline.
- In-vehicle dash-cam footage: video from a dash camera in the vehicle, recorded during a ride only if you agree to it when you book. We keep it for 30 days and then it is deleted automatically. We review it earlier only to look into a safety incident, a complaint or a dispute, or where the law requires us to share it.
- Safety data: the emergency contact name and number you choose to add, Emergency Button alerts you raise, route-deviation events generated during a trip, and, only after the Emergency Button has been pressed, audio from the in-vehicle listening device (see section 12).
- Communications: messages and calls between rider and driver placed through the app, support tickets you open, and the operational emails and WhatsApp messages we send you.
- Device and technical data: device type and operating system, app version, a push notification token, and the IP address your requests arrive from, which our servers process in order to deliver responses and to block abuse.
Optional website marketing data. On the main website, Meta Pixel is enabled only after you accept marketing cookies. It records visits to approved public pages and may receive your IP address, browser and device information, event time, page URL, referring URL and advertising-cookie identifiers. Our implementation does not send the answers you enter into forms, account details, trip locations or payment details as advertising-event parameters. See section 7 for the controls and exclusions.
Optional website analytics and advertising measurement. On the main website, Google Tag Manager and Google Analytics are loaded only after you accept optional cookies. Google Analytics records one visit event for each approved public page, using your browser and device information, event time, page URL and referring URL. Google receives your IP address as with any web request, but Google Analytics 4 does not log or store individual IP addresses. When you accept optional cookies, the same visit information can also be used by advertising tags that we run through Tag Manager (for example Google advertising and TikTok) to measure and personalise our advertising. Our implementation does not send the answers you enter into forms, account details, trip locations or payment details. See section 7 for the controls and exclusions.
3. How we use your information, and our lawful basis
Section 27 of the NDPA requires us to give the purpose and the lawful basis for each activity, not just the purpose. This is the full list.
| What we do | Lawful basis |
|---|---|
| Create and run your account, take bookings, connect you with a driver, calculate the fare, take payment and send receipts and trip updates | Performance of a contract with you |
| Show live trip location to you, to your driver, and to anyone you send a tracking link to | Performance of a contract with you |
| Verify driver identity, driver's licence, LASDRI registration, insurance and vehicle documents before a driver can accept rides | Legal obligation under Lagos State transport rules, and performance of our contract with the driver |
| Keep transaction, invoicing and tax records | Legal obligation |
| Respond to a valid order from a court, the police or a regulator | Legal obligation |
| Safety monitoring during a trip: Emergency Button alerts, route-deviation checks, and contacting your emergency contact during an incident | Protection of your vital interests or those of another person, together with our legitimate interest in keeping trips safe |
| Activate the in-vehicle listening device after the Emergency Button is pressed, and listen to and keep that audio to respond to the emergency | Protection of the vital interests of the people in the vehicle, together with our legitimate interest in keeping people safe. The person pressing the button is told this before the alert is sent. |
| Record the ride on an in-vehicle dash camera | Your consent, given by ticking the dash-cam box when you book. You can decline it, and footage is deleted automatically after 30 days. |
| Prevent fraud, secure accounts, apply rate limits and investigate abuse of the service | Our legitimate interest in protecting the platform and the people using it |
| Diagnose faults and keep the service reliable using operational records | Our legitimate interest in running a working service |
| Send optional marketing, waitlist or product-update email | Your consent, which you can withdraw at any time |
| Measure visits to approved public website pages using Meta Pixel, assess advertising performance and support relevant advertising on Meta services | Your separate optional-cookie consent, which you can reject or withdraw through Cookie preferences |
| Count visits to approved public website pages using Google Analytics, so we can see which pages people use and improve them | Your separate optional-cookie consent, which you can reject or withdraw through Cookie preferences |
4. Automated processing and automated decisions
Some parts of the service run automatically. We think it is clearer to say exactly which, and what each one does:
- Rides are not allocated to you by an algorithm. A booking is offered to drivers who are online, and a human driver decides whether to accept it.
- Fares are calculated automatically from vehicle class, booking type, distance and duration. The price is shown to you before you confirm.
- Vehicle class is suggested automatically from the luggage you enter. You can override the suggestion.
- Route deviation is monitored automatically during a trip by comparing the vehicle's position and direction against the expected route. If something looks wrong it raises an alert for a person to review. The check does not by itself penalise a driver or a rider.
- Identity and driver verification is decided by a person on our team reviewing the documents. It is not automated, and we do not use an external background-check or credit-scoring provider.
We do not make decisions that produce legal effects concerning you, or similarly significant effects, by solely automated means. When you accept optional cookies, Meta may use website event information together with information it already holds to measure advertising, create or improve advertising audiences and personalise advertising under its own policies. Rejecting optional cookies does not affect your ability to book or ride.
5. Who we share your data with
We share information for the operational purposes below. In addition, with your separate optional-cookie consent, approved public-page visit information is shared with Google (analytics and advertising), TikTok and Meta (advertising) as described in sections 5 and 7.
Other people using the service
- A matched rider and driver see each other's name, a way to contact each other through the app, and the trip's pickup and drop-off locations, for that trip.
- Anyone you choose to send a live tracking link to can see that trip's progress while it is running.
Service providers
These companies process personal data on our instructions in order to provide a specific part of the service. Each is engaged under a contract that allows them to use the data only for that purpose. This is the complete list of providers that actually receive personal data.
| Provider | What they do for us | Where they process it |
|---|---|---|
| Neon | Hosts our main database | United States |
| Render | Runs our backend servers | United States |
| Cloudflare | Serves this website and protects it from attack | Global edge network |
| Paystack | Takes card and transfer payments. Your card details go to Paystack and are never held by us. | Nigeria |
| Google Maps Platform | Address search, geocoding, and distance and travel-time estimates | United States |
| Mapbox | Recalculating a driver's route during a trip | United States |
| Stream | In-app chat and voice or video calls between rider and driver | United States |
| Resend | Sends account and trip emails | United States |
| Twilio | Sends WhatsApp messages about your booking | United States |
| Expo, with Apple Push Notification service and Firebase Cloud Messaging | Delivers push notifications to your device | United States |
| AviationStack | Looks up flight status when you enter a flight number | European Union |
| Google and Apple | Confirm your identity to us if you choose Sign in with Google or Sign in with Apple | United States |
| Supabase | Stores what you submit through our public enquiry, charter, membership and booking forms: your name, email address, phone number, message and trip details | European Union (Ireland) |
| Google Tag Manager and Google Analytics (main website) | Tag Manager loads our analytics tag, and Google Analytics counts visits to approved public pages of www.ridearrivo.com, only if you accept optional cookies. With the same consent, advertising tags that we run through Tag Manager (for example Google advertising and TikTok) can measure and personalise our advertising. We do not send the answers you type. Google receives your IP address and device details, as with any web request. | United States |
| Google Tag Manager and Google Analytics (public forms) | Count visits to our public forms and how far people get through them, only if you accept analytics on those forms. We do not send the answers you type, such as your name, email address or phone number. Google receives your IP address and device details, as with any web request. | United States |
| Google Fonts | Serves the typefaces on this website, which means Google receives your IP address when a page loads | United States |
Advertising partner: Meta
When optional cookies are accepted, Meta receives the website-event information described in sections 2 and 7 through Meta Pixel. Meta is an advertising partner, not simply a hosting provider acting only on our instructions. It may combine this information with other information it holds and process it internationally, including in the United States, under its applicable terms and Privacy Policy. Its Cookies Policy explains Meta's use of cookies. You can withdraw future website marketing tracking using Cookie preferences.
When optional cookies are accepted, Google Tag Manager and Google Analytics receive the visit information described in sections 2 and 7. Google acts for us as an analytics service provider and may process it internationally, including in the United States, under its applicable terms and Privacy Policy. You can withdraw future analytics tracking using Cookie preferences.
Advertising tags that we run through Tag Manager, such as Google advertising and TikTok, also load only after you accept optional cookies. Those providers act as advertising partners, not only as service providers acting on our instructions, and handle the information under their own policies. Withdrawing your choice stops these tags for future visits.
Law enforcement and legal requests
We will disclose user or GPS location data to police, government bodies, or legal authorities only when presented with a valid court order, subpoena, or legally binding mandate under Nigerian law, or in emergency situations involving immediate physical safety threats. This includes audio from the in-vehicle listening device, which we share only for those purposes (see section 12).
Business transfers
If the business is sold or reorganised, personal data may transfer to the buyer. We will tell you before that happens, and the data stays subject to this policy until you are told otherwise.
6. Storage, security and international transfers
- Security: data in transit is protected with HTTPS. Passwords are stored only as bcrypt hashes. Access to production data is limited to the people who need it for their work, sign-in tokens expire, and changes made through our internal tools are restricted to administrator accounts.
- Where your data is processed: we serve Nigeria, but the providers listed in section 5 operate mainly in the United States, with flight lookups and the storage of our public forms handled in the European Union. Your data is therefore transferred outside Nigeria.
- The basis for those transfers: under sections 41 to 43 of the NDPA we may send personal data outside Nigeria only on a recognised basis, and for each provider we check which basis applies and record that assessment. Where we rely on contractual clauses, we use them only after assessing that the safeguards they give are adequate for that provider and that transfer. Ordinary vendor terms are not treated as meeting the NDPA on their own. We rely on the transfer being necessary for a contract only where it is genuinely needed to deliver the trip you booked, for example a map lookup or a payment. If neither basis applies to a provider or a purpose, we will ask for your consent before transferring.
7. Cookies and similar technologies
Essential storage and preferences
The website uses browser storage and cookies to support sign-in, language and theme preferences, and operational features such as booking recovery. These are separate from optional marketing. Clearing site data can sign you out and remove saved preferences or unfinished booking state.
Optional analytics and Meta Pixel on the main website
On www.ridearrivo.com and ridearrivo.com, Google Tag Manager (which runs Google Analytics and our advertising tags) and Meta Pixel both stay off until you choose Accept optional cookies. Choosing Reject optional cookies leaves both off and does not prevent you from using the site. A recognised Global Privacy Control signal also keeps these integrations off.
Each integration sends one page-view event (PageView for Meta, page_view for Google Analytics) for an approved public page after consent. Neither adds purchase, lead, registration or form-submission events, and neither supplies advanced-matching identity fields such as email addresses or phone numbers. Account and sign-in flows, authenticated booking, driver pages, live trip tracking and payment callbacks are excluded. Visits with unrecognised or sensitive URL parameters are skipped, and embedded legal-policy frames do not generate separate page views.
Meta may set advertising identifiers such as _fbp and _fbc when this integration is permitted. As with other web requests, Meta also receives technical information such as IP address and browser details. Page URLs and referring URLs may be included; personal information should not be placed in campaign links.
Google Analytics sets the cookies _ga and _ga_CL4Y16M64E, which identify a browser so repeat visits can be counted. They are limited to this website's own address and are not shared with our subdomains. We keep Google Analytics event data for 14 months.
Your decision and its timestamp are stored in arrivo_marketing_consent_v1 in this website origin's local storage. This one decision covers Google Analytics, the advertising tags we run through Tag Manager, and Meta Pixel. A decision is valid for 180 days, after which we ask again on a public page. Choices saved before advertising tags were added to Tag Manager do not carry over, so we ask again. It does not grant consent on our other subdomains. When browser storage is unavailable, the choice applies to the current page only.
You can change or withdraw your decision at any time using Cookie preferences at the foot of the page, or open Cookie preferences here. Withdrawal tells both services to stop sending further events and removes the accessible first-party Meta and Google Analytics cookies set for this site. It does not remove unrelated sign-in cookies, erase information already received by Meta or Google, or change cookies on their own domains. Their policies explain their own retention and deletion controls.
Other websites and the apps
The separately deployed blog, workspace, ArrivoExpress and other service subdomains are not enabled for Google Analytics or Meta Pixel by this main-website installation. Our public forms (forms.ridearrivo.com and the booking, membership, move, boat, air and easybook subdomains) have their own analytics-consent controls. Their existing Google Tag Manager and Google Analytics choices are separate from this website's optional-cookie decision.
The apps store a sign-in token on the device and hold a push notification token so we can send you trip updates. This website change does not add advertising or analytics SDKs to the apps.
Operational integrations such as Google Fonts, Google Maps, sign-in providers and Paystack may also receive requests when the relevant website features load or are used. These services are described in section 5; the marketing choice does not disable the functionality needed to operate the service.
8. How long we keep things
When you delete your account we remove or anonymise your personal data and keep only the minimum record we are legally required to hold. The account cannot be signed into again, and your email address is released so that it can be used for a new account.
| What | How long | Why |
|---|---|---|
| Main-website optional-cookie decision | Valid for 180 days, or until replaced or cleared from browser storage | Remember and honour your optional-cookie choice |
| Meta advertising cookies and event information | Under Meta's cookie and privacy policies; accessible site-owned Meta cookies are removed on withdrawal | Optional advertising measurement and relevant advertising, following consent |
| Google Analytics cookies and event information | Event data kept for 14 months in our Google Analytics account; accessible site-owned cookies are removed on withdrawal | Count visits to public pages, following consent |
Google advertising and TikTok cookies (_gcl_au, _gcl_aw, _gcl_dc, _gcl_gb, _ttp) and event information | Under each provider's own policies; accessible site-owned cookies are removed on withdrawal | Optional advertising measurement and relevant advertising, following consent |
| Account profile: name, email, phone, preferences | While your account is open. Removed or anonymised when you delete it. | Needed to provide the service |
| Trip invoice record: fare, currency, dates, status, vehicle class, pickup and stop addresses | 7 years from the trip | Statutory tax, accounting and dispute-resolution obligations |
| Precise GPS coordinates of a trip | Removed when you delete your account, and not part of the 7 year record | Finer than an invoice needs |
| Flight number | Removed when you delete your account | Says where you travelled, and is not needed to bill for a completed trip |
| Emergency contact name and number | Deleted with your account | Belongs to someone who never had an account with us |
| Audio from the in-vehicle listening device (only exists if the Emergency Button was pressed) | Only as long as needed to respond to the emergency and to deal with any resulting investigation, insurance claim or legal proceeding, then deleted | Safety, and the establishment or defence of legal claims |
| Support tickets | The type, status and dates are kept for the dispute trail. The text you wrote is removed when you delete your account. | Dispute resolution, without keeping your words longer than needed |
| Driver documents and photos: licence, LASDRI, insurance, vehicle and owner details | Removed when the account is deleted | Only needed while the driver is active |
| Rating comments you wrote | Removed when you delete your account | An opinion, with no tax or accounting purpose |
| Dash-cam footage from a ride you agreed to have recorded | 30 days, then deleted automatically. Footage tied to an open safety incident, complaint or dispute is kept only until that matter is closed. | Safety and dispute resolution, without keeping video longer than needed |
| Payment records held by Paystack | Per Paystack's own retention policy and Nigerian financial regulation | Held by Paystack for that purpose |
Deleting an account is blocked in two situations, so that nothing is lost by accident: while you have a trip that has not finished, and while there is money left in your wallet. The app tells you which one applies.
9. Your rights
Under the NDPA you can ask us to do any of the following.
- Access: confirm whether we hold data about you, and give you a copy of it.
- Correct: fix anything inaccurate or incomplete.
- Erase: delete your data. You can delete your account yourself in the app under Profile, or by emailing us. Erasure is subject to the records we are legally required to keep, listed in section 8, including tax, accounting, fraud-prevention and dispute-resolution obligations. Anything we are not required to retain is deleted or anonymised.
- Restrict: pause our processing while a dispute about the accuracy of your data, or about the grounds we rely on, is being resolved.
- Object: object to processing we carry out on the basis of legitimate interest.
- Port: receive the data you gave us in a structured, commonly used, machine-readable format, and have us send it to another provider where that is technically feasible.
- Withdraw consent: for anything we do on the basis of consent, such as dash-cam recording or marketing email, withdraw it at any time. Withdrawing consent does not undo processing that already happened lawfully, and it does not affect anything we do on a different basis.
- Automated decisions: ask for a human to review any decision made about you by solely automated means, put your point of view, and contest the decision. As set out in section 4, we do not currently make decisions of that kind.
Email privacy@ridearrivo.com to use any of these. We will respond within 30 days, and there is no charge. We may need to confirm your identity first, so that we do not hand your data to somebody else.
If you are not satisfied with how we have handled it, you can lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
10. Minors
RideArrivo services are strictly intended for users aged 18 and older. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@ridearrivo.com and we will remove it.
11. Changes to this policy
We may update this policy. The date at the top always shows the version currently in force, and it changes whenever the policy does.
If a change materially affects you, we will tell you directly by email or in the app, before or when it takes effect. Where a change involves processing that requires your consent, we will ask for that consent separately. We do not treat continued use of the app or website as agreement to a revised policy.
12. Emergency Button and in-vehicle listening device
The vehicles used for RideArrivo trips carry a listening device that can pick up audio inside the vehicle. It is not running during ordinary trips. It is activated only as a result of someone pressing the Emergency Button, as explained here.
- Emergency use only. The Emergency Button, in the rider and driver apps and on this website, must only be used when an emergency occurs, meaning you or someone else in the vehicle faces a real threat to safety. It is not for complaints, disputes about fares or routes, or testing. Misuse can lead to suspension of your account.
- What happens when it is pressed. The button first asks you to confirm and tells you that the listening device may be activated. Once you confirm, an alert goes to the RideArrivo operations team with your ride details and location. The operations team then activate the listening device so they can hear what is happening and decide how to respond, which may include calling you, your emergency contact, or the emergency services.
- Purpose. The audio is used only to respond to the emergency and to investigate it afterwards. We do not use it for advertising, for profiling, or to monitor ordinary trips.
- Who can access it. Only authorised members of our operations team who need it to respond or investigate. Access is restricted by account permissions, and sign-in tokens expire.
- Who it is disclosed to. Not to other riders, drivers or vehicle owners. We share it with the police, the emergency services or another authority only where needed to deal with the emergency or where a valid court order, subpoena or legally binding mandate requires it (section 5). The providers that host our systems store it on our behalf and may not use it for their own purposes.
- How long we keep it. Only as long as needed to respond and to deal with any resulting investigation, insurance claim or legal proceeding, then it is deleted (section 8).
- Security. Audio and the alert records are protected in transit with HTTPS and covered by the access controls in section 6.
- Notice to everyone concerned. We tell riders, drivers and vehicle owners about the listening device in this policy, in the Terms of Service, in the driver agreement and in the vehicle owner agreement. Your rights in section 9 apply to this data.
13. Contact
For privacy questions, to use any of the rights in section 9, or to reach our Data Protection Officer, email privacy@ridearrivo.com. For anything else, email info@ridearrivo.com.
RICHATHAOIR LIMITED (CAC RC 1654710), Babajide Sanwo-Olu International Market, Ikosi, Lagos, Nigeria.