1. Who we are
Zubio is a booking, payments and business-management platform for service businesses in Nigeria. For the purposes of the Nigeria Data Protection Act 2023 (NDPA), the data controller is ZUBIO TECHNOLOGIES ENTERPRISE LTD (RC 9824321), contactable at support@zubioapp.com.
This policy covers the Zubio customer mobile app, bookings made through a business’s public booking link, Zubio for Business (the business web app and the Zubio Business mobile app), and this website. It applies to you whether you book appointments (a customer) or run a business on Zubio (a business, including its owners and staff). Where a section applies to only one of them, it says so.
The rules for using Zubio are in the customer terms and the business terms.
2. Information we collect
Information you give us
- Account details — your name, email address, phone number and password.
- If you’re a business — the business name, category, branch addresses, opening hours, services and prices; the names, roles and contact details of the staff you invite; and the sales, expense and commission records you enter.
- If you’re a customer — booking details — the service booked, the attendant, the time, and any note you add to a booking.
- Guest booking details — where you book through a business’s public booking link without creating an account, we collect the name, email address and phone number you enter in order to make and confirm that booking.
- Messages — the content of in-app chat between you and a business.
- Reviews and ratings — what you write about a business after an appointment.
- Photos — images a business uploads of its premises, services or work.
Information we collect automatically
- Approximate location — used to sort businesses by distance from you. This is collected only if you grant location permission, and you can withdraw that permission in your device settings at any time. Declining it means results are not distance-sorted; everything else keeps working.
- Device push token — an anonymous identifier that lets us deliver a notification to your device. It is not an advertising identifier.
- Usage and diagnostic data — app version, device type, and error logs, used to find and fix faults.
Payment information
We never see or store your card details. Card data is collected and processed entirely by our payment processor, on their PCI-DSS compliant systems. What we store is the outcome of a transaction: the amount, the currency, the status, and a reference we can use to reconcile it.
Business payout accounts. A business that collects deposits gives us the bank account its deposits should be paid out to. We send the bank, account number and account name to our payment processor to verify the account and register it to receive payouts. We keep only the bank's name, the name on the account and the last four digits of the account number; the full number is held by our payment processor.
3. How we use your information
- To create and run your account, and to authenticate you when you sign in.
- To take, confirm, change and cancel bookings, and to show businesses who is on their calendar.
- To take deposits and payments on behalf of the business you book with, hold deposits until 48 hours after the appointment and then pay them to that business, apply them at checkout, and refund them when the business cancels or when we uphold a problem you report.
- To look into a problem you report with a paid booking. We read what you tell us, the booking and payment record, and anything the business tells us, so we can decide whether to refund the deposit.
- To show businesses near you, sorted by distance and rating.
- To send you service messages about your bookings — confirmations, changes, reminders and receipts.
- If you’re a business: to bill your subscription, verify your payout account, and provide your own sales, commission, expense and profit reporting.
- To detect and prevent fraud, abuse and no-show policy circumvention.
- To act on reports of objectionable content. When you report a review or message, or someone reports yours, Zubio staff read the reported content, the reason given and, for a message, the earlier messages in that conversation, so they can decide whether to remove it. Nobody is told who reported them.
- To meet our legal, tax and accounting obligations.
Data a business holds about its own customers
Businesses use Zubio to keep their own client records — for example walk-in sales, guest bookings, client notes and booking history. For those records the business is the data controller and Zubio processes the data on its behalf, under the data processing annex in our business terms. If you want to access, correct or delete what a business holds about you, contact the business first; we will help them respond, and you can always write to us.
4. How we contact you
Booking updates reach you as push notifications and in-app messages, plus email for things like receipts and account security. We do not send booking reminders by SMS or WhatsApp, and we do not sell your phone number to anyone who does.
5. Who we share it with
We do not sell personal data. We share it only with the service providers that make the platform work, and only with what they need:
- The business you book with — your name, contact details, the service booked and any note you attached. They need it to serve you.
- Our payment processor — payment processing for deposits, checkouts and subscriptions, and, for businesses, verifying the payout bank account and sending payouts and refunds.
- Amazon Web Services — hosting, databases and file storage, in the EU (Ireland) region.
- Amazon Simple Email Service — delivery of transactional email.
- Expo — delivery of push notifications to your device.
- Google Maps Platform — addresses, geocoding and distance.
- Law enforcement or regulators — where we are legally required to, and no further than required.
6. Where your data is stored
Our infrastructure runs in Amazon Web Services' EU (Ireland) region, so personal data is processed outside Nigeria. Transfers are made under the safeguards permitted by the NDPA, to a jurisdiction with an equivalent data-protection regime, and are limited to the purposes described above.
7. How long we keep it
- Account data — while your account is open. When you delete your account, your name, email and password are erased straight away, and your favourites, notifications and messages go with them.
- Booking and transaction records — for up to 7 years, to meet Nigerian tax and accounting requirements. If you delete your account, these records are kept under “Deleted customer” and no longer identify you.
- Chat messages — for 24 months after the conversation ends, or until you delete your account, whichever comes first.
- Reviews and ratings — for as long as the business is listed. If you delete your account, your reviews stay up but are shown under “Deleted customer” instead of your name.
- Problems reported with a booking — the report and our decision, for as long as we keep the booking and payment records.
- Reports of objectionable content — the report, a copy of the reported text and our decision, for 2 years, so we can spot repeated abuse and answer disputes.
- Diagnostic logs — for 90 days.
8. Your rights
Under the NDPA you have the right to ask us to: confirm what personal data we hold about you and give you a copy; correct anything inaccurate; delete your data where we have no lawful reason to keep it; restrict or object to how we use it; and give you your data in a portable form. You may also withdraw consent — for location or notifications, for example — at any time, without affecting anything done before you withdrew it.
As a customer, you can delete your account yourself in the app at any time; business owners and staff can ask us to delete theirs — here is how. To exercise any of the other rights, email support@zubioapp.com. We will respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission.
9. Security
Passwords are stored hashed, never in plain text. Traffic between your device and our servers is encrypted with TLS. Data at rest is encrypted, secrets are held in a managed secret store rather than in code, and access to production systems is limited to the people who need it. No system is perfectly secure, but we treat a breach that risks your rights as something to be reported to the Commission and to you promptly.
10. Children
Zubio is not directed at children under 18, and we do not knowingly collect their personal data. If you believe a child has given us personal data, email us and we will delete it.
11. Changes to this policy
If we change this policy we will update the date at the top, and for a material change we will tell you in the app or by email before it takes effect.
12. Contact
Questions about this policy, or about how we handle your data: support@zubioapp.com.