Data privacy

NaijaTaste data retention windows, the third-party services used (Google Places, OAuth), your NDPR rights, cookies, encryption, and how to delete your account.

Data retention

Data type	Retention period
Session data	30 days from last activity
Taste profile and review history	Until account deletion
Restaurant cache (Google Places)	24 hours per query, then re-fetched
Anonymous search logs	90 days, then aggregated and anonymised

Third-party services

NaijaTaste uses the following external services:

Service	What it does	Data shared
Google Places API	Provides restaurant data	Your search query and location (city or GPS)
Google OAuth	Handles sign-in	Your Google account email and profile name

Neither service receives your taste profile, review history, or persona data.

What Google Places receives

When you search for a restaurant, your search query and city (or GPS coordinates if you’ve granted access) are sent to Google Places. Google’s own privacy policy governs how they handle that data.

If you do not grant GPS access, only your city name is sent.

Your rights

Under the NDPR and as a matter of platform principle:

• Right of access. You can request a copy of all data we hold about you.
• Right of correction. You can correct inaccurate profile data.
• Right of deletion. You can delete your account and all associated data at any time.
• Right to object. You can opt out of any use of your data beyond what is necessary to operate the platform.

To exercise any of these rights, use the account settings page or contact us through the platform.

Cookies

We use session cookies to maintain your login state. We do not use tracking cookies or third-party advertising cookies.

Security

• All data in transit is encrypted with TLS.
• We do not store passwords (Google OAuth and OTP are the only sign-in methods).
• Restaurant cache data contains no personally identifiable information.

Security overview

Back to the security overview.