Privacy Policy

WhatsChow Technologies Ltd. (“WhatsChow”, “we”, “us”) is a Nigerian company based in Yaba, Lagos. We run the website at whatschow.com and the WhatsApp number customers order food through.

Under the Nigeria Data Protection Regulation 2019 (NDPR) and the Nigeria Data Protection Act 2023 (NDPA) we are the data controller for the information described here — meaning we decide what is collected and why, and we are accountable for it. Questions about any of it go to privacy@whatschow.com.

Ordering food on WhatsChow needs no account, no password and no app install. You message our WhatsApp number and the order happens in that thread. Because of how WhatsApp works, we receive:

• Your WhatsApp phone number, and the profile name WhatsApp shows for you. This is the only identifier we hold for you — there is no separate customer login.
• The messages you send — text, voice notes and photos — plus the replies our assistant sends back, kept as the history of that conversation.
• Your delivery address, as you type it, and the map coordinates of the location pin if you choose to share one.
• The order itself — the dishes, quantities, prices, delivery fee, total, any notes you add for the kitchen, and its status from payment through to delivery.
• A rating, if you leave one after delivery.
• If you order for someone else, the recipient’s name, delivery address and phone number, because the kitchen and the rider need them.

We use all of this for one thing: taking, paying for, cooking and delivering the order, and answering you if something goes wrong. Your order history is also what makes “repeat my last order” work.

We do not read your other WhatsApp chats — we only ever see the thread with our own number. WhatsApp is operated by a third party under its own privacy terms, which we do not control.

Vendors do have accounts, because they sign in to a dashboard. When a kitchen registers we collect:

• Account details — name, email address, phone number and a password. Passwords are stored only as a one-way hash; nobody at WhatsChow can read yours.
• If you sign in with Google instead, your Google account identifier, name and email — never your Google password.
• Business details — business name, owner name, description, address and map coordinates, food category, opening hours, delivery radius, average preparation time, and Instagram or Facebook handles if you give them.
• Photographs of the kitchen and of the food, plus your menu items and their prices. These are shown to customers — that is their whole purpose.
• Order and payout records — the orders you receive, their totals, and what has been settled to you.

To be listed, a kitchen must upload one identity document — a National Identity Number (NIN) slip, a BVN, a driver’s licence or an international passport — and give a bank name, ten-digit account number and account name.

Why we ask. Money moves before a pot goes on: customers pay up front, and we settle to the kitchen afterwards. We will not put an anonymous account in front of customers’ money. The document lets a person at WhatsChow confirm that the kitchen is run by a real, identifiable individual before it goes live, and the bank details are how that kitchen gets paid.

What we do with it. Identity documents are used for verification and nothing else. They are never shown to customers, never displayed on your public listing, never used for marketing, and never sold or rented to anyone. Bank details are used only to pay you and to satisfy our own accounting obligations. Access is limited to the WhatsChow staff who review applications and process settlements.

The assistant on the other end of the WhatsApp thread is automated. To take your order it processes what you send:

• Your messages are read by an automated language system so it can work out what you want, find kitchens near you, build the order and answer questions.
• Voice notes are transcribed to text automatically, and that text is processed the same way.
• If you send a photo of a dish, it is analysed automatically to guess what the dish is so we can match it to a menu.
• Recent turns of the conversation are held in memory during the chat so the assistant does not forget what you already said.

To do this, message content is sent to a specialist processing provider that works on our instructions and is contractually barred from using it for its own purposes. Conversations can also be escalated to a human — if you ask for support, or if the assistant cannot help — and a member of our support team will then read that thread.

No automated decision is made about you that has a legal or similarly significant effect. The automation takes food orders; that is all it decides.

Your card details never touch WhatsChow servers. When it is time to pay, we send you a link to a checkout page hosted by a licensed third-party payment processor. You enter your card, bank or transfer details there, on their systems, under their security standards.

We never see, receive or store your full card number, expiry date, CVV, card PIN or bank password, and we could not retrieve them if we wanted to. What comes back to us and is stored against your order is only:

• The amount and currency.
• A payment reference and the status — pending, successful, failed or refunded.
• Which processor handled it, and when it was paid.
• The email address and phone number used at checkout, so the payment can be matched to the right order.

We do not sell personal data. We share only what a job requires:

• The kitchen you ordered from sees your name, phone number, delivery address, the items you ordered and any notes. It cannot cook and deliver without them.
• The rider or delivery service handling your order sees the delivery address and a contact number.
• Our payment processor receives the amount, an order reference and your contact details in order to take payment and pay the kitchen.
• Service providers acting for us — messaging, transactional email, hosting and the automated language processing described above. They act on our instructions only.
• Authorities, where we are required by Nigerian law to disclose, or where it is necessary to investigate fraud or a threat to someone’s safety.
• If WhatsChow is ever acquired or merged, data may transfer to the acquirer, who would remain bound by a policy no weaker than this one.

Orders, payment records and conversation history are kept while your relationship with us is live and afterwards for as long as we need them to answer disputes, process refunds and meet Nigerian tax and accounting requirements. Vendor identity documents are kept for as long as the kitchen is listed, and for a period afterwards to evidence that verification was carried out.

Being straight with you: we do not yet run an automatic deletion schedule. Records stay in our systems until you ask us to remove them, or until we no longer have a reason to hold them and clear them during a review. Defining fixed retention periods per record type is work we have not finished, and we would rather say so here than imply a schedule that does not exist.

To have your data deleted, email privacy@whatschow.com from the email address on your vendor account, or message us from the WhatsApp number you ordered with, and say what you want removed. We will confirm it is really you, delete what we are not legally required to keep, tell you what we had to keep and why, and finish within 30 days.

The NDPR and the NDPA 2023 give you rights over your own data, and they apply whether you are a customer who has never signed in or a vendor with a dashboard. You may:

• Ask what we hold about you, and get a copy of it.
• Have anything inaccurate corrected.
• Ask us to delete it, subject to records we are legally obliged to retain.
• Object to a particular use, or ask us to restrict it while a dispute is resolved.
• Receive your data in a portable, machine-readable form.
• Withdraw consent where we relied on consent — that does not undo processing already carried out.

Exercising any of these is free and costs you nothing but an email to privacy@whatschow.com. We answer within 30 days.

If you are not satisfied with how we handled it, you can complain to the Nigeria Data Protection Commission (NDPC), the regulator that supervises data protection in Nigeria. You do not need our permission to do that, and we would rather you did than stayed unhappy.

Practical measures rather than promises:

• Vendor passwords are stored as one-way hashes, never in a readable form.
• The vendor and admin dashboards sit behind authentication, and each role can only reach its own data.
• Traffic to our website and API is encrypted in transit.
• Incoming WhatsApp webhook requests are signature-checked, so a stranger cannot impersonate the messaging platform and inject messages.
• Card data is never handled by us at all — see section 06.

No system is perfectly secure. If a breach ever affects your data, we will notify you and the NDPC as the NDPA requires.

Some of the providers we rely on — hosting, messaging, email and the automated language processing that reads orders — operate servers outside Nigeria. That means your data may be processed abroad.

Where that happens we rely on the transfer conditions in the NDPA 2023 and require those providers, by contract, to protect the data to a standard comparable to Nigerian law and to use it only for the service they provide us.

WhatsChow is for adults. We do not knowingly collect data from anyone under 18, and vendor accounts require an adult identity document. If you believe a child has given us personal data, write to privacy@whatschow.com and we will remove it.

The public pages you are reading now do not need you to sign in and do not set advertising or tracking cookies.

Signing in to the vendor or admin dashboard sets a session cookie so that you stay signed in between pages. It is necessary for the dashboard to function — block it and you cannot log in. Photographs on the marketing site are served from a third-party image host, which will see the request your browser makes for the image.

We will update this page when what we do changes — and the review by a Nigerian lawyer noted at the top will itself produce changes. The “Last updated” date above always reflects the current version. If a change materially affects how we use data you have already given us, we will tell you directly rather than quietly editing this page.

Privacy questions, access requests and deletion requests: privacy@whatschow.com.

Anything else: support@whatschow.com — or WhatsChow Technologies Ltd., Yaba, Lagos, Nigeria.