Privacy Policy

01Who we are

Hiveari is a marketplace for stays, experiences, services and community plans, operated by Hiveari Limited from Lagos, Nigeria. This policy explains what personal data the Hiveari mobile app and this website collect, why we collect it, who we share it with, and the control you have over it.

For the purposes of the Nigeria Data Protection Act 2023, Hiveari Limited is the data controller for the personal data described here.

02The short version

The full detail is below, but these are the commitments that matter most, and each one reflects how the app is actually built today.

• ✓We never track your location. The Hiveari app does not request location permission on Android or iOS, and it contains no location tracking code. The map opens on a fixed view of Lagos. When you pin a meeting point for a plan, that is a place you chose, not a reading from your device.
• ✓We never see your card details. Payments open Paystack's own secure checkout. Your card number, CVV and OTP go to Paystack directly. They never reach our app, our servers or our database, and we do not store saved cards.
• ✓We do not ask for identity documents. No date of birth, no gender, no NIN, no BVN, no passport or government ID, and no home address.
• ✓We do not sell your personal data, and we do not share it with advertising networks or data brokers. There is no advertising SDK in the app.
• ✓You can sign up with just a phone number. No password, and no email address required.

There are also things we want you to understand clearly rather than discover later, including which parts of your profile other people can see. Those are set out in what other people can see.

03Information you give us

You can browse Hiveari without an account. We ask for information only when you do something that needs it.

Creating an account

You sign in with a one-time code sent to either your mobile number or your email address. You choose which. We do not use passwords, and we do not currently offer social sign-in. We store whichever identifier you used so we can recognise you next time.

Your profile

A display name is created for you automatically when you first sign in, taken from your sign-in details. Everything else on your profile is optional, and you can edit or clear it at any time:

• Display name, and an optional unique username
• A short bio, up to 160 characters
• A general area you select from a fixed list of Lagos and Nigerian neighbourhoods. This is a label you pick, not a location reading, and there is a "None" option
• Up to eight interests chosen from a fixed list
• A profile photo, taken with your camera or chosen from your photo library. We resize it before upload

A profile photo is required before you can create or join a plan, post in a plan group chat, become a provider or list a space. It is not required to sign up, browse, search, save listings or report a safety concern.

If you host or provide services

• A provider or business display name, and an optional short bio
• Payout details: the bank name, account number and account holder name we will use to pay you. These are visible to you and to our finance staff, and are never shown on your public provider page
• Details of the space, experience or service you are listing, including its address

Things you create and send

• Direct messages, and messages in plan group chats
• Plans you create, including the title, description, category, date and time, price and the meeting point you place on the map
• Reviews and star ratings
• Booking notes and service requests
• Safety reports you file about a plan
• Listings you save

If you save listings before creating an account, they are kept on your device and added to your account the first time you sign in.

04Information collected automatically

Analytics

On Android only, we use PostHog to understand how the app is used. It receives your account identifier and email address, the screens you open, and events such as viewing a listing, saving a favourite, joining a plan or completing a booking, including the order total. It also receives the words you type into search. PostHog records standard device information and your IP address, which it uses to infer an approximate city. The iOS app does not send analytics at all.

Analytics never receives the contents of your messages or your review text.

Crash reports

On both platforms, we use Sentry to record errors so we can fix them. Sentry receives the technical details of the fault and the connection IP address. We do not attach your name, email or account identifier to crash reports.

Maps and images

Map tiles are served by Mapbox, which necessarily sees your IP address and the map area you are viewing. It never receives your position, because the app never reads it. Some placeholder images are loaded from Unsplash and Wikimedia, which likewise see your IP address when those images load.

Push notifications

If you allow notifications, we store a device token so we can reach your device. Notifications are currently delivered on Android through Google Firebase Cloud Messaging.

05What we do not collect

We think it is as useful to tell you what we do not touch. None of the following is collected by the Hiveari app:

• Your location. The app holds no location permission on either platform and contains no location tracking code
• Card numbers, CVV codes or saved cards. These go to Paystack and never to us
• Identity documents of any kind, including NIN, BVN, passport and driver's licence
• Date of birth, age, gender or your home address
• Your contacts, microphone or advertising identifier
• Passwords, because we do not use them

The app requests exactly two device permissions: notifications, and camera access for taking a profile photo. On iOS it also asks for photo library access when you choose an existing picture.

06What other people can see

Hiveari is partly a social product, so some of what you provide is shown to other people by design. Please read this section before you fill in your profile.

If you change your display name, copies already saved on plans you created and on group chat messages you sent will keep the old name.

07Payments

Paid stay bookings are processed by Paystack. When you pay, Paystack opens its own secure checkout inside the app. You enter your card or bank details there, and they go straight to Paystack. We never receive them, never store them and cannot see them.

We send Paystack the information it needs to take the payment:

• Your email address
• The amount and a payment reference
• Booking context, being the booking, listing and account identifiers, the number of nights and the number of guests

We keep a record of the payment, being the amount, the reference, Paystack's transaction identifier, the status and the time it was paid, along with our own ledger of the booking total, our commission and the amount owed to the host. Hosts are currently paid out manually, using the payout details they provide.

08Why we use your information

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use of your personal data. Ours are as follows.

09Who we share information with

We do not sell your personal data. We share it with the service providers below, who process it on our behalf and only for the purposes we set.

We may also disclose personal data where we are required to by law, to a regulator or court, or where it is necessary to protect the safety of a person. If Hiveari is ever involved in a merger or acquisition, personal data may transfer as part of that transaction, and we will tell you before it does.

10Where your information is held

Hiveari operates from Nigeria, but several of the providers above store and process data outside Nigeria, principally in the United States and the European Union. This means your personal data is transferred internationally.

Where we make such a transfer, we do so on the basis permitted by section 41 of the Nigeria Data Protection Act 2023, relying on contractual protections with each provider that require them to safeguard your data to a standard comparable to Nigerian law. You can ask us for more detail about a specific provider at any time.

11How long we keep your information

We want to be straightforward here rather than quote a schedule we do not yet operate. Today, we keep the personal data described in this policy for as long as your account exists, and we do not automatically delete it after a fixed period.

• Financial and booking records are kept for at least seven years, because tax and accounting law requires it
• Messages, plans, reviews and participation records remain until you ask us to remove them, or until we delete your account
• Some content is copied when it is created, so a plan you published or a group chat message you sent keeps the display name you had at the time

If you ask us to delete your account, we will remove your personal data other than the financial records we are legally required to retain, and other than content that has been copied into shared spaces where removing it would damage other people's records of their own bookings and plans. We will tell you what we kept and why.

12Your rights

Under the Nigeria Data Protection Act 2023 you have the right to ask us to:

• Confirm whether we hold personal data about you, and give you a copy
• Correct anything inaccurate or incomplete
• Delete your personal data, subject to the limits described above
• Restrict or object to how we use it, including for analytics
• Provide your data in a portable form
• Withdraw consent, where our use rests on consent

You can edit most of your profile yourself in the app at any time. For anything else, including deletion, a copy of your data, or asking us to stop using your data for analytics, please email us at hello@hiveari.com and we will action it. There is no in-app button for these requests today, so email is the way to reach us, and we will respond within 30 days.

If you are unhappy with how we have handled your personal data, you can complain to the Nigeria Data Protection Commission. We would rather you told us first so we can put it right.

13How we protect your information

Traffic between the app and our services is encrypted in transit. Access to our database is governed by per-user rules so that, as a general matter, you can only read your own private records, and access to administrative tools is limited to named staff by role.

No service can promise perfect security. Please help by keeping access to your email account and phone number secure, since a one-time code sent to either is what signs you in. If you believe your account has been accessed by someone else, email us straight away.

If you are a security researcher and you have found a vulnerability, we would genuinely like to hear from you at hello@hiveari.com.

14Children

Hiveari is not intended for anyone under 18, and we do not knowingly collect personal data from children. Bookings, payments and meeting strangers through plans are all adult activities. If you believe a child has created an account, please contact us and we will remove it.

15This website

This marketing website is separate from the app. It carries no analytics or advertising trackers. It stores a single preference in your browser to remember that you dismissed the cookie notice, and nothing about you is sent to us when you browse it. Fonts and images are served from this site.

16Changes to this policy

We will update this page when the app changes what it collects. When a change is significant, we will tell you in the app or by email before it takes effect. The date at the top of this page always reflects the current version.