Privacy Policy

At BYBATA, we believe that “You Are Not Alone” — and that includes your privacy. This policy explains how we collect, use, and protect your information when you trade without cash, give gifts, fund dreams, and build your KARMA inside our community-powered sharing economy.

1. Who We Are & Our Promise

BYBATA Inc. (referred to as “BYBATA”, “we”, “us”, or “our”) operates the BYBATA mobile app, website bybata.com, and all related services. Our registered office is in Lagos, Nigeria, but we serve a global community. We are committed to transparency — your data fuels trust (KARMA) and helps us create a safe space for swapping, gifting, and crowdfunding.

2. Information We Collect

To enable core features — Trade, Gift, Donate, KARMA reputation, BYC wallet, and referrals — we collect the following categories of personal data:

Category	Examples & purpose
Account & Profile	Full name, email address, phone number, profile photo, username, location (city/neighbourhood). Used to create your identity, enable KARMA, and facilitate local exchanges.
Verification / KYC	Government ID (optional but encouraged), selfie verification, proof of address. Builds “Verified” badge, increases KARMA, unlocks higher trust tiers (Bronze → Legend).
Transactional & Behavioral	Trades completed, gifts given, donations made, campaigns created, KARMA score changes, BYC wallet transactions (purchases, transfers, boosts). Helps calculate reputation, prevent fraud, and distribute rewards.
Listings & Content	Photos, descriptions, categories of items (trade/gift), campaign titles and stories, chat messages with other users. Enables marketplace functionality and community interaction.
Device & Usage	IP address, device ID, app version, crash logs, referral source, session duration. Used for analytics, security, and personalized onboarding (guest vs member).
Payment Information	We do not store full card details; our payment partners (Paystack, Stripe, Flutterwave, PayPal) handle fiat transactions. We collect transaction IDs, amount, and currency for BYC purchases or campaign donations.

Guest browsing: You can browse trades, gifts, and campaigns without an account. We collect only anonymized usage stats (no personal identifiers) until you sign up.

3. How We Use Your Information

• Operate the ecosystem: Create listings, match trades, process gifts, display campaigns, transfer BYC, and update KARMA scores.
• Trust & safety: Detect fake accounts, prohibited items, suspicious donation patterns; enforce community guidelines; compute KARMA tiers (Newcomer → Legend).
• Personalization: Show relevant listings based on location, suggest “trade challenge” or “kindness chain”, and adapt home screen prompts (“Will you Trade, Donate or Gift, {name}?”).
• Rewards & referrals: Track referral codes, award KARMA and BYC bonuses, manage leaderboards and achievements.
• Communication: Send service updates, trade reminders, donation milestone notifications, and KARMA summaries (you can opt out of marketing).
• Legal compliance: Respond to lawful requests, prevent financial crimes, enforce our Terms of Service.

4. Legal Bases (GDPR / NDPR)

We process your data based on: (i) performance of contract (providing BYBATA services), (ii) legitimate interests (fraud prevention, platform improvement), (iii) your consent (optional verification, marketing), and (iv) legal obligations (tax, anti‑money laundering).

5. Sharing & Disclosure

We never sell your personal data. However, to make BYBATA work, we share limited data with:

• Other users: Your public profile name, KARMA tier, listing details, and chat messages are visible to people you interact with. For donations, campaign creators see your supporter name (unless you choose anonymous).
• Service providers: Cloud hosting (AWS, Google Cloud), analytics (Mixpanel, Firebase), payment processors (Paystack, Stripe, Flutterwave, PayPal), and verification partners (Smile Identity, Youverify).
• Law enforcement: If required by law or to protect rights and safety of BYBATA community.
• Corporate transaction: In case of merger or acquisition, we will notify you before data transfer.

6. International Transfers

BYBATA operates globally; your data may be stored on servers in Africa, Europe, or the US. We use Standard Contractual Clauses (SCCs) or equivalent safeguards to protect cross-border transfers.

7. Data Retention

We keep your account data as long as your account is active + 2 years after deletion for legal, fraud prevention, and dispute resolution purposes. Chat logs, trade records, and KARMA logs are retained for 3 years. You may request deletion of specific information where permitted by law.

8. Your Privacy Rights

Depending on your location (Nigeria NDPR, GDPR, or similar), you have the right to:

• Access & portability: Receive a copy of your data.
• Rectification: Correct inaccurate profile or KARMA information.
• Deletion: Request account deletion (note: your public trade history may be anonymized).
• Restrict processing: Object to KARMA-based automated decisions (human review available).
• Withdraw consent: For optional processing like marketing emails.

To exercise rights, contact privacy@bybata.com. We will respond within 30 days.

9. KARMA & Automated Decisions

Your KARMA score is automatically calculated based on completed trades (+50), gifts (+30), donations (+40), verification (+100), and positive reviews. This affects your trust tier and visibility. If you believe an error occurred, you can request manual review through in-app support.

10. Children's Privacy

BYBATA is intended for users 18 years and older. We do not knowingly collect data from minors. If we learn a user under 18 has registered, we will delete the account.

11. Cookies & Similar Tech

We use essential cookies for authentication and security, plus analytics cookies to improve performance. You can manage preferences via your browser settings, but some features may be impacted.

12. Changes to This Policy

We will notify you of material changes via in-app notification or email at least 14 days in advance. The “Last updated” date at the top will always reflect the latest version.

13. Contact Our Data Protection Officer

For privacy inquiries, complaints, or data requests:
Email: privacy@bybata.com
Address: BYBATA Inc., 27 Community Road, Ikeja, Lagos, Nigeria.
You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.