Spice Xpress Privacy Policy

Effective: 21 Aug 2026 • Serving Abuja, FCT only

1Introduction

Spice Xpress Technologies Ltd ("we", "us") operates the Spice Xpress mobile app and https://spicexpress.ng — Abuja's fastest hot street food and authentic Northern grill delivery service. This Privacy Policy explains how we collect, use, and protect your personal data when you order Suya, Masa, BBQ Chicken, Shawarma, Burgers and Loaded Fries across Abuja, FCT. By using the app or landing you agree to this policy.

2Information We Collect

• Account: name, email, phone, password hash, avatar • Delivery: street, city (Abuja), estate/hall, phone, instructions • Orders: items, spice level, add-ons, amounts, payment method • Payments: Paystack reference, channel, status — we never store full card numbers; Paystack handles card data • Device: model, OS, push token, analytics events • Support: messages and ratings

3How We Use Your Data

To process, dispatch and track orders in under 30 minutes; to verify Paystack payments (initialize → verify → HMAC-SHA512 webhook) and confirm orders; to message order status and rider arrival; to improve menu, delivery zones (Gwarinpa, Maitama, Wuse 2, Jabi, Utako, Garki, Apo, Life Camp) and stability; and to comply with NDPA 2023.

4Paystack & Payments

All card/bank/USSD payments are processed by Paystack (paystack.com). We send only email, amount in kobo (NGN×100), and order metadata. Paystack returns an access_code and reference which we verify server-side via https://api.paystack.co/transaction/verify and via HMAC-SHA512 webhooks. We store only reference, status, and gateway response.

5Sharing & Disclosure

We share only with: (1) riders (name, phone, address for delivery); (2) Paystack for payments; (3) cloud providers (MongoDB Atlas, AWS) under DPAs; (4) law enforcement when required by Nigerian law. We never sell your data.

6Retention & Security

Orders/payment logs retained 7 years for accounting. Account data kept until deletion. We use TLS, bcrypt, JWT, HMAC-SHA512. No system is 100% secure — protect your login.

7Your Rights (NDPA)

You can access, correct, or delete your data; withdraw consent; request portability via dpo@spicexpress.ng within 30 days. You may complain to the Nigeria Data Protection Commission (NDPC).

8Cookies & Tracking

Landing uses essential cookies and anonymous analytics (Next.js). App uses push tokens and in-app events only — no third-party ads.

9Children

Not directed to children under 13. If we hold such data we delete it.

10Changes & Contact

We may update this policy and notify in-app and on the landing. Last updated: 21 Aug 2026. Controller: Spice Xpress Technologies Ltd, Abuja, FCT Email: privacy@spicexpress.ng / dpo@spicexpress.ng Support: support@spicexpress.ng | +234 800 SPICE XP