Privacy Policy
How Shortmile collects, uses, and protects your personal data across the Shortmile app, website forms, rider onboarding, surveys, and related Shortmile services.
1. Who we are
Shortmile Technologies Ltd is a company registered in Nigeria (RC 9477000, TIN 2622755466520) with its registered address at 12, Okitikan, Ota, Ogun State, Nigeria. We operate Shortmile Mobility, a lease-to-own electric cargo bike platform for delivery riders in Lagos and Ibadan.
We are registered with the Nigeria Data Protection Commission (NDPC) as a Data Controller and Data Processor of Major Importance, Registration ID NDPC/DCP/12093, valid from 22 April 2026 to 21 April 2028. This Privacy Policy explains how we handle the personal data of riders, applicants, partners, and visitors who interact with our products and services.
Data Protection Officer (DPO)
Olalekan Makanjuola serves as Shortmile's designated Data Protection Officer. The DPO is responsible for overseeing our data protection practices and is your first point of contact for any questions, concerns, or formal requests about your personal data.
Contact: olalekan@shortmile.io
2. What data we collect
We collect only the data we need to operate our products and serve our riders. The exact data depends on which product you are using.
Website forms and waitlists
When you use our website forms, contact forms, shop enquiries, or waitlist forms, we collect only the details you submit, such as name, phone number, email address, city, preferred platform, message content, and the enquiry category.
Shortmile app (app.shortmile.io)
When you sign up as a rider on the Shortmile app, we collect:
- Identity and contact: full name, phone number, email address, date of birth, residential address, next-of-kin details, government ID for verification.
- Operational: lease and payment records, GPS and IoT tracker data from your assigned bike, maintenance records, daily checklist responses, delivery platform records you submit.
- Financial: bank account or wallet details for payment collection, lease balance, payment history.
Survey and research participation
If you take part in a Shortmile survey or research interview, we collect only the answers you provide and basic identifiers (phone or email) you choose to share. Survey responses are aggregated and anonymised before being used in any public material. We never publish a respondent's name or contact details without separate explicit written consent.
3. Why we use your data, and on what lawful basis
Under the Nigeria Data Protection Act 2023, we must have a lawful basis for every use of personal data. The table below sets out, plainly, why we use your data and which basis applies.
| What we do with your data | Lawful basis under NDPA 2023 |
|---|---|
| Respond to website enquiries, rider applications, shop enquiries, and Flex waitlist submissions. | Consent and legitimate interests (responding to a request you submitted). |
| Manage your lease, take payments, and process maintenance under the Shortmile app. | Performance of a contract (your signed lease agreement). |
| Process GPS and IoT data from your assigned bike for safety, anti-theft, lease compliance, maintenance, misuse detection, and asset recovery. | Contract performance, legitimate interests, and explicit informed consent for supplier-platform processing where required. |
| Send you operational SMS or WhatsApp messages about lease, payment, or maintenance. | Performance of a contract. |
| Anonymised aggregate analytics, for example, average rider earnings by city. | Legitimate interests (improving our products and rider outcomes). |
| Measure aggregate website visits and the pages people view. | Legitimate interests (understanding and improving the website). |
| Comply with Nigerian tax, financial, and regulatory reporting obligations. | Legal obligation. |
4. Who we share your data with
We do not sell your data to anyone, ever. We do not share your data with third parties for marketing purposes. We share data only when strictly necessary to operate our service or comply with law.
| Who | What we share | Why |
|---|---|---|
| Supabase (database and backend services) | App and operational records, protected by access controls and encryption controls | They host backend infrastructure under a contractual data processing arrangement. The active project region and transfer controls are documented internally. |
| Cloudflare (web hosting) | Browser-level technical data only | They serve our websites and protect against attacks. |
| Web3Forms (website form processor) | Contact form and waitlist submissions | They deliver website enquiries to our email inbox. |
| Metricool (website analytics) | Page viewed and country inferred from the visitor's IP address | To measure aggregate website visits and improve the website experience. It is not used for advertising or cross-site behavioural profiling. |
| GPS/IoT tracker supplier platforms | Bike location, tracker events, device identifiers, and operational alerts | To support anti-theft protection, asset recovery, maintenance, misuse detection, lease compliance, and dispute resolution. Some supplier systems may be operated outside Nigeria, including China. |
| Bluetooth lock and smart-access suppliers | Lock interaction records, device identifiers, and access events | To manage bike access, asset protection, rider accountability, and support investigations where required. Some supplier systems may be operated outside Nigeria, including China. |
| WhatsApp/Meta and business email providers | Messages, phone numbers, email addresses, and support content you send to us | To communicate with riders, applicants, partners, and customers about Shortmile services. |
| Termii or similar SMS providers (planned) | Phone numbers and operational message text | To send operational messages you have opted into or messages required for your lease operations. |
| Payment processors (e.g. Moniepoint, banks) | Payment instruction details only | To collect lease payments per your contract. |
| Insurance partners (planned) | Bike, rider, and incident data, where relevant | To enable rider and asset insurance. |
| NDPC, courts, regulators | Whatever is lawfully required | When compelled by valid legal process. |
All third-party service providers we use are bound by written agreements requiring them to handle your data with at least the same standards we apply ourselves.
5. International data transfers
Shortmile uses international technology providers to operate the website, app, communications, and rider support systems. Some operational data may be processed outside Nigeria, including by backend, hosting, communications, GPS/IoT tracker, and Bluetooth lock service providers.
In particular, GPS tracker data and Bluetooth lock interaction data may be transmitted to supplier-operated platforms outside Nigeria, including China, where this is required for asset protection, anti-theft recovery, maintenance, misuse detection, lease compliance, and dispute resolution. We disclose this during onboarding, obtain explicit informed consent where required, limit access internally, and review these processing activities through our data-protection controls.
Shortmile uses Supabase for app and operational records. The active project region and transfer mechanism are documented internally and reviewed as part of our data-protection controls. We monitor regulatory developments and may adjust hosting arrangements if Nigerian data-protection requirements change.
6. How long we keep your data
We do not keep your data forever. Different categories have different retention periods based on what they are used for and what we are legally required to keep.
| Data category | How long we keep it |
|---|---|
| Website enquiry and waitlist submissions | Up to 24 months from your last interaction, unless a legal or operational reason requires longer retention. |
| Shortmile app rider records (active lease) | For the duration of your lease, plus 7 years to comply with Nigerian financial record-keeping rules. |
| Granular GPS/IoT event data | Normally held on a rolling operational basis, with detailed tracker data reduced or deleted when no longer required for security, recovery, maintenance, dispute, or legal purposes. Internal controls may use a 90-day rolling retention model for granular GPS review data, subject to operational and legal exceptions. |
| Shortmile app rider records (lease ended) | 7 years from lease end date, then deleted. |
| Survey responses | Anonymised survey data is retained indefinitely. Identifiable contact details are deleted within 12 months. |
| Payment and tax records | 7 years, as required by Nigerian law. |
| Marketing communications opt-in records | Until you withdraw consent, plus a small audit log so we can prove you opted in. |
7. Your rights
Under the Nigeria Data Protection Act 2023, you have clear rights over your personal data. We respect all of these rights and provide simple ways to exercise them.
- Right to access: You can ask us for a copy of every piece of data we hold about you. We provide it within 30 days, in plain language.
- Right to correct: If anything we hold is wrong or out of date, tell us and we will fix it.
- Right to delete: You can ask us to delete your data. We will do so within 30 days, except where we are legally required to keep it (such as financial records under tax law).
- Right to export: You can request a copy of your data in a common, machine-readable format so you can take it elsewhere.
- Right to object: You can object to specific uses of your data, for example, using your data for analytics. We will stop unless we have a compelling legal reason to continue.
- Right to withdraw consent: Where we rely on your consent, such as marketing contact or waitlist communication, you can withdraw it anytime, and we will delete the affected data unless we have a legal reason to keep it.
- Right to lodge a complaint: If you feel we have handled your data incorrectly and are not satisfied with our response, you can complain directly to the NDPC at info@ndpc.gov.ng or ndpc.gov.ng.
How to exercise these rights
8. Cookies and similar technologies
Our website uses essential browser storage and technical logs needed for site delivery, security, form operation, and user experience. We also use Metricool to measure website visits and pages viewed. Metricool states that its tracking code does not set cookies; it derives the visitor's country from the IP address. We do not use third-party advertising cookies, Google Analytics, Facebook Pixel, or cross-site behavioural advertising trackers on the public website.
9. How we keep your data secure
We take data security seriously. The technical and organisational measures we have in place include:
- Encryption: all data at rest is encrypted using AES-256. All data in transit is encrypted with TLS 1.2 or higher.
- Access control: database access is restricted by Row Level Security policies. Admin access requires multi-factor authentication.
- Network protection: Cloudflare provides web application firewall, DDoS protection, and bot mitigation across our domains.
- Audit logging: all administrative actions are logged and reviewable by the DPO.
- Data minimisation: we collect only what we need, and only when we need it.
In the event of a data breach that creates a real risk of harm to you, we will notify the NDPC within 72 hours and notify you directly without undue delay, as required under the NDPA 2023.
10. Children
Our services are intended for adults aged 18 and above. We do not knowingly collect data from children. If you become aware that a child has provided data through our services, please email info@shortmile.io and we will delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time, for example when we add new services or in response to changes in the law. When we make a meaningful change, we will increment the document version (SM-PRIV-v2, SM-PRIV-v3, etc.) and post the updated version on shortmile.io. Active riders will be notified through the Shortmile app. The effective date at the top of the document tells you when the current version came into force.
12. How to contact us
For any data protection question, request, or complaint:
- Email: info@shortmile.io (general) or olalekan@shortmile.io (DPO direct)
- Post: Shortmile Technologies Ltd, 12 Okitikan, Ota, Ogun State, Nigeria.
- NDPC (independent regulator): info@ndpc.gov.ng or ndpc.gov.ng if you are not satisfied with our response.