Privacy Policy

CHO Africa Limited ("CHO", "we", "us", or "our") operates a platform for discovering, planning, and creating outings. CHO is responsible for deciding how personal data collected through these services is used.

You can contact us about this policy or your personal data at hello@joincho.com.

When you use the app, we process information such as:

• account details, including your name, username, email address, profile photo, bio, and authentication identifiers;
• saved events, community plans and messages, organizer information, support requests, and app preferences;
• payment, order, ticket, and admission records needed for purchases, refunds, disputes, and fraud prevention;
• your selected city and locations you provide for events, spaces, plans, maps, or directions; and
• technical and security information, including notification delivery tokens where used and service logs.

When you join the waitlist, we collect:

• your name and email address;
• whether you are interested in attending, hosting, or both;
• your browser or device user-agent information; and
• any information you choose to send when contacting us.

We also process your IP address and verification information to help prevent abusive submissions, including through Cloudflare Turnstile. Our hosting providers may generate standard security and access logs when you use the website.

We use personal data to:

• operate accounts, profiles, discovery, community planning, tickets, payments, admission, and organizer tools;
• respond to support requests and send service messages, ticket updates, and enabled notifications;
• provide Taste discovery and improve service reliability and accessibility;
• add you to and administer the CHO early-access waitlist;
• send your confirmation and updates about your waitlist status, early access, or CHO's launch availability;
• understand who is interested in CHO and plan the product;
• prevent spam, fraud, abuse, and security incidents; and
• meet legal, regulatory, and record-keeping obligations.

Under the Nigeria Data Protection Act 2023, the legal basis depends on why we use your information:

• Providing a service you request: we use account and profile details to operate your account, community information to support your plans, order and ticket details to process bookings and admission, and your discovery requests to provide Taste results. This includes steps you ask us to take before entering a contract.
• Consent: where we ask for your consent, including when you opt into waitlist updates or optional promotional marketing, we use the information for the stated purpose. You can withdraw consent by contacting hello@joincho.com. Device permissions can also be changed in your settings.
• Legitimate interests: we use relevant technical, security, and support information to prevent fraud and abuse, investigate problems, and maintain service reliability, where these interests are not overridden by your rights and interests.
• Legal obligations: we retain or disclose information where necessary to comply with applicable tax, accounting, regulatory, or other legal requirements.

Accepting our Terms is not blanket consent to every use of your data. Withdrawing consent does not affect processing that was lawful before withdrawal, or processing that remains necessary on another lawful basis. You can contact us to ask which basis applies to a particular use or to object to processing based on legitimate interests. We will not use your waitlist details for unrelated marketing unless you separately choose it.

We share information for the purposes described in this policy, limiting it to what is relevant to the service or request:

• Service providers: Supabase for database services, authentication, and storage; Resend for email delivery; Cloudflare for website delivery and abuse prevention; and hosting, maps, and notification providers where those features are used.
• Payment providers: Paystack or BACHS, depending on the checkout option, receive information such as your checkout email, amount, currency, and transaction reference to process and verify payment. Their own privacy notices also apply to processing they control.
• AI processing: OpenAI receives the discovery information described in “Taste and AI processing” below when you use Taste.
• Organizers and admission staff: limited attendee, ticket, and order details may be available where needed to run an event, validate admission, handle refunds, or provide support.
• Legal and professional recipients: relevant information may be disclosed to authorities when legally required, or to advisers where necessary to handle legal claims, fraud, or disputes.

Content you publish, such as listings and uploaded profile photos, may be publicly accessible. Signed-in members can find your name, username, and avatar through community search. Plan room members can see information and messages shared in their room; invitees can see the room title and who invited them. Saved events are private to your account. Other people may retain copies of content you share with them.

We do not sell or rent your personal data. Some providers process data outside Nigeria. International transfers must have a lawful basis and appropriate protection under applicable law, such as an adequate level of protection or appropriate contractual safeguards. Contact hello@joincho.com for information about transfers affecting your data.

When you send a typed message to Taste, CHO sends the message, recent user messages and assistant replies in that conversation, selected city, and previous search filters through our backend to OpenAI to interpret your discovery request. Relevant permitted CHO listing information is also sent to help generate replies. Avoid including sensitive personal information in messages. You can use ordinary discovery without Taste.

Your Taste conversation stays in app memory during the session, including when you close its sheet or put the app in the background. New chat, a fresh app launch, sign-out, an account change, or a Home city change clears it. CHO does not save a persistent chat history through this feature. OpenAI may retain data under its applicable processing and security policies; clearing the app conversation does not itself erase provider records.

CHO asks for camera access when you use ticket scanning and photo-library access when you choose media to upload. We process the media you choose to share. You can refuse or revoke access in device settings, although the related feature may not work.

Discovery uses your selected city and locations supplied in listings or plans. Map and directions features may send the location you open to a map provider. The current beta does not continuously track your GPS location.

The app stores sign-in session information and preferences on your device. Where notifications are enabled, delivery may involve device tokens and notification providers. Website abuse checks use Cloudflare Turnstile and may process browser and device signals.

You can edit your profile in the app and manage permissions such as camera, photos, location, and notifications in your device settings. You can request account deletion, access, correction, or a data copy through Account & Data in the app or by emailing hello@joincho.com.

In the app, open Menu → Account & Data → Request account deletion. This opens an email request. You can also email us directly at hello@joincho.com with the subject “CHO account deletion request”, using the email linked to your account. You do not need to reinstall the app to make a request.

We verify the request before processing it. Tell us about active tickets, pending refunds, or organizer listings so we can explain how deletion affects them. Do not send passwords, sign-in codes, or full card details. Uninstalling CHO does not delete your account. Limited records may be retained for the reasons described below.

We keep personal data only for as long as needed for the purpose for which it was collected or for another lawful retention requirement. The relevant period depends on the type of record, your use of CHO, outstanding transactions, and applicable legal obligations.

• Account and community data: retained to operate your account and the features you use. Deletion requests are reviewed to identify data that can be removed and any limited records that must remain.
• Payments, tickets, and admission: records may remain after account closure where needed for refunds, disputes, fraud prevention, or legal and accounting obligations.
• Support and security records: retained for resolving the issue, investigating abuse, protecting the service, or handling related claims, according to the nature of the record.
• Waitlist information: retained to manage your interest and early-access communications. You can ask to leave the waitlist at any time.
• Taste conversations: the app keeps these in session memory as described above. Provider-side retention is separate from clearing the conversation in the app.

When data is no longer needed, we delete it or anonymise it so it no longer identifies you. A deletion request does not guarantee immediate removal from every backup or from records another provider must independently retain. Any retained personal data remains subject to applicable protection requirements. Contact hello@joincho.com to ask about a specific record, the reason for retaining it, or the status of a deletion request.

Subject to the Nigeria Data Protection Act 2023 and other applicable law, you may have the right to be informed, access your data, correct it, request deletion or restriction, object to processing, receive a portable copy, withdraw consent, and object to certain automated decisions.

Email us to make a request. We may need to verify your identity first. You may also complain to the Nigeria Data Protection Commission.

We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, and loss. Account authentication and access controls help restrict private account, community, ticket, and organizer information to authorised users.

Protect your email account and device, keep CHO updated, and do not share sign-in codes or ticket QR codes. Never send passwords, full card details, or payment credentials in community messages, Taste conversations, or support emails. If you suspect unauthorised access or a security issue, contact hello@joincho.com with enough information to identify the issue, without exposing credentials or another person's private data.

No system is completely secure. We cannot guarantee absolute security. Where a personal-data breach triggers a legal notification requirement, we will notify the relevant authority and affected people as required by applicable law.

The CHO beta is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account or provided personal information, contact hello@joincho.com so we can investigate and arrange appropriate removal.

We may update this policy as CHO develops or legal requirements change. The latest version will always appear on this page with its updated date. If a change materially affects how we use personal data, we will take reasonable steps to bring it to your attention.