Privacy policy

Basket is a better-eating service in Lagos. We turn your goals into recipes, meal plans and a basket of fresh produce delivered to your door. “Basket”, “we” and “us” mean the business that runs this service. We are the data controller for the personal data described here.

This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA). It applies to the Basket website and to everything you do with your account. Read it together with our terms.

What you give us.

• Account details: your name, email address or phone number, and a password. We store your password only in scrambled (hashed) form, so no one at Basket can read it.
• Delivery details: your address, delivery area and chosen delivery day.
• How you eat: your goal, household size, weekly budget, cooking time, meal formats, produce you like or avoid, favourite products, and any dietary notes you add.
• Your plans: saved recipes, weekly meal plans, produce plans, meals you add yourself, and the items you tick off as bought elsewhere.
• Your conversations with Kachi: the messages you send her and her replies. Our team only reads them if you turn on “Help improve Kachi” in your account, and you can turn it off at any time.
• Messages to us: anything you send us by email or WhatsApp, and your email if you join the waitlist for an area we don’t serve yet.

What we record as you use Basket.

• Orders and baskets: what you ordered, when, the price, delivery fee and delivery day, and whether you edited or skipped a week.
• Membership, invites and credit: your plan, when you joined, who invited you (or whom you invited), and any account credit.
• Payments: how you chose to pay each order and whether it has been paid. We don’t take or store card details.
• Technical data: your IP address, browser and device type, kept briefly in server logs and to block abuse, such as floods of automated requests.

Location. If you tap “use my location” to find your delivery area, your browser asks your permission first. We use your coordinates once to match you to an area, then discard them. Only the area is saved.

The NDPA requires a lawful reason for each use. Ours are:

• To provide the service you asked for (performing our contract with you): running your account, taking and delivering orders, managing your subscription and weekly basket, and sending order and password-reset emails.
• To personalise Basket (performing our contract, and your consent for dietary notes): building recipes, meal plans, starter baskets and Kachi’s suggestions around your goal, household and preferences.
• To keep Basket safe and working (our legitimate interests): preventing fraud and abuse, fixing bugs, and understanding which features and ingredients people want. For example, we count requests for ingredients we don’t stock yet, without linking them to you.
• To meet legal duties (legal obligation): keeping tax and accounting records, and responding to lawful requests from authorities.
• To tell you about new features, recipes or offers (consent): only if you opt in. You can opt out at any time.

We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. Kachi’s suggestions are ideas you can take or leave.

Some things you tell us, like dietary notes, allergies or a goal to manage your weight, can reveal information about your health. The NDPA treats this as sensitive personal data, so we only process it with your consent and only to tailor your food suggestions. You can remove it from your preferences at any time.

Kachi is a food guide, not a medical service. Please don’t send her medical records, test results, or details about health conditions she doesn’t need in order to suggest a meal.

We don’t sell your personal data, and we don’t share it with advertisers or data brokers. We share it only with companies that help us run Basket. Each one gets only what it needs and may use it only to provide its service to us:

• Hosting and database: Vercel, which runs the website, and Neon, which stores our database.
• Email: Resend, which sends account and order emails such as password resets.
• Kachi: Google, whose Gemini AI models power Kachi. When you chat with her, your messages and the context she needs to reply (such as your goal, preferences and basket) are sent to Google for processing.
• Delivery: our riders and delivery partners, who receive your name, address, phone number and order so they can deliver it.
• Payments: once live payments start, a licensed payment provider will process your card. We’ll update this policy to name it before then.

We may also disclose data if the law requires it, to protect someone’s safety, or as part of a sale or merger of the business. In a sale or merger, this policy would continue to protect your data.

Our hosting, database, email and AI providers run their services on servers outside Nigeria, mainly in the United States. When we transfer data abroad, we rely on safeguards the NDPA recognises, such as contractual commitments from those providers to protect it. Your data is encrypted in transit and stored with providers that meet recognised security standards.

Basket uses only the cookies it needs to work. We don’t use advertising, analytics or cross-site tracking cookies.

• Sign-in (ripe_session): keeps you signed in for up to 30 days.
• Cart (ripe_cart): remembers your cart for up to 30 days, even before you sign up.
• Delivery area (ripe_zone): remembers the area you picked for up to 180 days, so we show the right prices and days.
• Planner allowance (planner_uses_today): counts free planner uses for visitors who aren’t signed in. It resets daily.

We also keep a couple of small settings in your browser’s session storage, such as whether you closed the delivery-area prompt. These clear when you close the tab. Blocking cookies will sign you out and empty your cart.

• Account and preference data: for as long as your account is open.
• Kachi conversations, meal plans and saved recipes: until you delete them or close your account.
• Order and payment records: for six years after the order, to meet tax and accounting rules.
• Sign-in sessions: up to 30 days. Password-reset links expire 30 minutes after they’re sent.
• Waitlist emails: until we launch in your area and let you know, or until you ask us to remove you.
• Server logs: a short period, normally no more than 30 days.

We encrypt data in transit, store passwords only as hashes, keep sign-in tokens in secure cookies that scripts can’t read, limit repeated password-reset requests and automated traffic, and restrict internal access to the people who need it. No online service can promise perfect security. If a breach puts your rights at risk, we’ll notify the Nigeria Data Protection Commission within 72 hours, as the NDPA requires, and tell you without delay.

Under the NDPA you have the right to:

• know what personal data we hold about you and get a copy of it
• have inaccurate data corrected. You can edit most of it yourself in your account.
• have your data deleted, including by closing your account
• receive your data in a common, machine-readable format, or have it sent to another service
• object to processing based on our legitimate interests, or ask us to restrict it
• withdraw consent at any time, for example by removing dietary notes or opting out of updates

To use any of these rights, email hello@getbasket.ng from the email address or phone number on your account. We may ask you to confirm it’s you. We’ll reply within 30 days, free of charge.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission.

You need to be 18 or older to open a Basket account. We don’t knowingly collect personal data from children. Household details like “two kids” are only numbers we use to size portions. If you think a child has given us personal data, email us and we’ll delete it.

We’ll update this policy as Basket grows, for example when live payments start. If a change affects how we use your data, we’ll tell you by email or in the app before it takes effect. The date at the top shows when it last changed.

Questions about your data or this policy? Email hello@getbasket.ng and a real person will get back to you.