Privacy Policy
Last updated: 14 October 2026 · Version 2026-10-14
This policy is being finalised with legal advisers. Items shown like [THIS] will be completed once TROOV's company registration is finished.
1. Who we are
TROOV ("TROOV", "we", "us") is a mobile app that helps people discover vendors and service providers, see their work, message them and record bookings. The data controller is [COMPANY NAME], [REGISTERED ADDRESS], Nigeria (CAC registration number [RC NUMBER]).
Contact for anything about your data: trouveworld@gmail.com. Data Protection Officer: [DPO NAME], [DPO EMAIL].
2. The data we collect
| Data | Examples | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a secure hash), date-of-birth confirmation (we keep only that you are 18 or older, not your birth date), sign-in method (email, Google or Apple) | You |
| Phone number | Your number and whether it is verified | You, verified by a text message code |
| Profile | Username, photo, bio, city/area, interests | You |
| Business profile | Business name, category, services and prices, area, working hours, contact details you choose to show | You |
| Content | Posts, photos, videos, stories, comments, reviews, portfolio items | You |
| Messages | Messages and photos you send in chats | You and the people you talk to |
| Bookings | What was agreed, date, place, price, status | You and the other party |
| Verification (optional) | Identity documents and a selfie, or business documents, if you request verification | You |
| Location (optional) | Your device location, only if you allow it, to show businesses near you | Your device |
| Safety records | Reports you make or receive, blocks, moderation decisions | You, other users, our team |
| Device and usage | Push notification token, app version, crash reports; usage statistics only if you agree | Your device |
3. Why we use your data, and our lawful basis
Under the Nigeria Data Protection Act 2023 (NDPA) we only process personal data where we have a lawful basis:
- To provide TROOV (your account, profile, posts, messages, bookings, notifications) — performance of our contract with you.
- To keep TROOV safe (preventing fraud, spam and abuse, phone verification for bookings, reviewing reports, enforcing our Terms) — our legitimate interests and yours in a safe service.
- Verification of identity or business, when you ask for it — your consent; you can withdraw it before review.
- Location to show nearby businesses — your consent through your phone's permission, which you can turn off at any time.
- Usage statistics to improve the app — your consent only; the app asks you and works fully if you say no.
- Legal obligations — responding to lawful requests from authorities and keeping records the law requires.
We do not sell your personal data and we do not use it for third-party advertising.
4. Who can see your data
- Other TROOV users can see your public profile, posts, comments, reviews and business details.
- Messages are visible only to the people in the conversation (and to our safety team when a message is reported).
- Your phone number, email and verification documents are never shown publicly. A business may choose to show a business phone or email on its profile.
- Our staff see what they need to review reports and verification requests. Staff access is protected with two-factor authentication and logged.
5. Service providers we use
We share data only with providers that help us run TROOV, under contracts that require them to protect it:
| Provider | What for | Location |
|---|---|---|
| Supabase | Database, sign-in, file storage | European Union (Frankfurt, Germany) |
| Resend | Account emails (confirmation codes, password reset) | United States |
| Termii | Text message codes for phone verification | Nigeria |
| Mux | Video processing and streaming | United States |
| Expo | Delivering push notifications | United States |
| Sentry | Crash and error reports (no message content) | United States |
| PostHog | Usage statistics — only if you agree | European Union / United States |
| Google, Apple | Sign in with Google / Apple, if you choose them | United States |
6. Transfers outside Nigeria
Some providers store or process data outside Nigeria (see above). Where we transfer personal data abroad we rely on the safeguards the NDPA allows, such as contractual clauses with the provider and the recipient country's level of protection, and we keep a record of these transfers.
7. How long we keep data
- Your account and content: while your account exists. When you delete your account, your profile, posts, comments, messages you sent, photos and other personal data are permanently deleted.
- Bookings: a booking is a record shared by two people. After you delete your account the other party keeps their copy, showing only the name you had at the time.
- Verification documents: deleted after staff review, and in any case within 7 days of a decision. Unsubmitted uploads are deleted within 24 hours.
- Deletion and data requests: a short record that the request was made and completed, kept as evidence of compliance.
- Backups: deleted data may remain in encrypted backups for up to [BACKUP DAYS] days before it is overwritten.
- Safety records: reports and moderation decisions may be kept for up to [SAFETY RETENTION] to prevent repeat abuse, unless the law requires otherwise.
8. Your rights
Under the NDPA you have the right to:
- be informed about how we use your data (this policy);
- access your data and receive a copy — use Settings → Download my data in the app;
- correct inaccurate data — edit your profile in the app, or contact us;
- delete your data — use Settings → Delete account, or request deletion here;
- restrict or object to processing based on legitimate interests;
- withdraw consent at any time (for example usage statistics in Settings, or location in your phone settings), without affecting earlier processing;
- data portability — the download is in a common machine-readable format (JSON);
- not be subject to decisions based solely on automated processing that significantly affect you — moderation and verification decisions are made by people.
To use a right that is not available in the app, email trouveworld@gmail.com from the address on your account. We reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).
9. Security
Data is encrypted in transit and at rest by our providers. Access to data is restricted by database rules so people can only reach what they are allowed to see; private files (verification documents, chat photos) are never public. Staff tools require two-factor authentication. If a personal data breach is likely to put your rights at risk, we will notify the NDPC within 72 hours of becoming aware of it and tell affected users without undue delay.
10. Age
TROOV is only for people aged 18 or older. We do not knowingly collect data from anyone younger. If you believe someone under 18 is using TROOV, contact us and we will remove the account.
11. Changes to this policy
If we make important changes, we will tell you in the app and ask you to review them before you continue. The date at the top shows the latest version.
12. Contact
[COMPANY NAME], [REGISTERED ADDRESS], Nigeria · trouveworld@gmail.com