Privacy policy

Effective 7 October 2026

Rovaa is delivery management software for businesses that run their own riders and vehicles. This policy explains what personal data we collect, why, who we share it with and the rights you have under the Nigeria Data Protection Act 2023 (NDPA).

It covers:

our website, getrovaa.com;
the Rovaa dashboard at dashboard.getrovaa.com;
the Rovaa Operator and Rovaa Rider mobile apps;
delivery tracking, invoice, statement and review links we send.

Who we are

Rovaa is based at Plot 479, Agu-Awka Layout, Awka, Anambra State, Nigeria. For any privacy question or request, email [email protected]. This address also reaches the person responsible for data protection at Rovaa.

Our role

We decide how data is used (we are the data controller) for:

business owner, manager, staff and rider accounts;
visitors to our website;
how our apps and website are used.

We process data on a business's behalf (we are a data processor) for what a business adds to Rovaa about its own customers, delivery recipients and deliveries. That business decides how the data is used and is responsible for it. If you were a sender or recipient of a delivery, contact the business that handled it first; we will help them answer you.

What we collect

Account details: name, email address, phone number, password (stored only as a secure hash), profile photo, and your role in a business.
Business details: business name, phone, address, city and state, logo and cover image, social links, opening hours, plan and trial status.
Rider details: name, phone number and photo, assigned vehicle, ratings, and the payout percentage the business sets.
Deliveries: pickup and delivery addresses and landmarks, sender and recipient names and phone numbers, item descriptions, notes, prices, amounts collected, expenses and dates.
Customer records: names, phone numbers and addresses of a business's customers, and their statements and invoices.
Money records: cash a rider collects and hands over, rider payouts, invoice payments, fuel and maintenance costs.
Reviews: ratings and comments left through review links, with the reviewer's phone number.
Device details: push notification token, device name and operating system, app version, and crash reports.
Usage data: pages and screens viewed, clicks, sign-up steps, approximate location from IP address, and browser type.
Messages to us: what you send our support team by email or WhatsApp.

Location

Rider app: when a rider starts, picks up or completes a delivery, the app records the phone's location at that moment. It only does this while the app is open. It does not track riders in the background.
Operator app: reads your location once during sign-up to fill in your city.
Vehicle GPS trackers: if a business connects GPS trackers to its vehicles, we receive each vehicle's position, speed and ignition status and show it live on that business's dashboard. We keep the latest position for each vehicle.

App permissions

The apps ask for location, camera and photos (to add a logo or profile photo), notifications, and Bluetooth (to print receipts from the Operator app). You can refuse or withdraw any permission in your phone's settings; some features will stop working.

Why we use it and our legal basis

To provide Rovaa (performing our contract with you): run your account, record deliveries, calculate earnings and costs, send notifications, receipts, invoices and tracking links.
To keep Rovaa secure and working (our legitimate interests): verify accounts, prevent misuse, fix crashes and errors.
To improve Rovaa and measure our marketing (our legitimate interests): understand how the website and apps are used and which adverts bring sign-ups.
To meet legal duties (legal obligation): keep records the law requires and answer lawful requests from authorities.

Where we rely on your consent, you can withdraw it at any time. We do not sell personal data, and we do not make decisions about you using only automated processing that have legal or similarly significant effects.

Links anyone can open

Rovaa sends delivery tracking, invoice, statement and review links by WhatsApp or SMS. Anyone with a tracking link can see the delivery's status, the rider's name, photo and phone number, and the sender's and recipient's names, phone numbers and addresses. Anyone with an invoice or statement link can see that document. Only share these links with the people they are meant for.

Who we share it with

Within a business: owners, managers and staff can see the business's riders, deliveries, customers and money records. Riders see the deliveries assigned to them.

Service providers who work for us under contract and only use the data to provide their service:

cloud hosting and storage providers;
crash reporting and push notification providers;
map and address search providers;
SMS, WhatsApp and email delivery providers;
analytics providers that show us how our website and apps are used;
advertising platforms that measure our adverts.

To get the current list of these providers, email [email protected].

We may also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business, in which case this policy continues to apply.

Data sent outside Nigeria

Several of these providers store or process data in other countries, including the United States and the European Union. When that happens we rely on the grounds allowed under the NDPA, such as the provider's contractual commitments to protect the data to a standard the NDPA accepts.

Cookies and similar technologies

Needed to work: a sign-in cookie that keeps you logged in for up to 30 days, and short-lived cookies that remember your progress through sign-up. The apps keep your sign-in token in your phone's secure storage.
Analytics and advertising: our analytics and advertising providers set cookies or similar identifiers to measure visits and adverts.

You can block or delete cookies in your browser settings. Blocking the sign-in cookie will log you out.

How long we keep it

We keep account and business data for as long as the account is open.
Delivery, customer and money records belong to the business that created them and stay part of its records while its account is open.
When an account is deleted we close it straight away and it can no longer be used. We keep records only as long as we need them to settle disputes, prevent fraud or meet legal duties, then delete them. To ask for your data to be erased in full, email us.
Crash reports are kept for 90 days.

Deleting your account

Operator app: go to Settings and choose Delete account.
On the web (owners, staff and riders): visit getrovaa.com/delete-account, sign in with your email and password, and confirm.
Riders without a password: ask the business you ride for to remove you, or email [email protected].

Your rights

Under the NDPA you have the right to:

be told how your data is used, which is what this policy does;
get a copy of your data;
have wrong or incomplete data corrected;
have your data erased;
ask us to limit how we use your data;
object to how we use your data, including for marketing;
receive your data in a format you can move to another service;
withdraw consent at any time;
not be subject to decisions made only by automated processing.

To use any of these rights, email [email protected]. We may ask you to confirm who you are. We will not charge you, and we will reply without undue delay.

If you are unhappy with how we handled your data, you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng. We would appreciate the chance to fix it first.

Security

We encrypt data in transit, store passwords only as secure hashes, and limit each person's access to what their role needs. No system is perfectly secure. If a breach puts your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours and tell you without delay.

Age

Rovaa is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us their data, contact us and we will delete it.

Changes to this policy

We will update this page when our practices change and change the effective date at the top. If a change is significant, we will tell account holders by email or in the app before it takes effect.