Privacy policy
Last updated [date]- Hosts and corpers see your first name, photo, bunkie answers and a verified badge. Never your ID documents, NIN or phone number.
- We use your details to verify you, match you with a bunkie, run bookings and payments, and keep everyone safe.
- We don’t sell your data, and we don’t use it for outside advertising.
- ID photos and letters are deleted after your check. We keep the result.
- You can see, correct, download or delete your data. Ask from Get help.
1. Who we are
Bunkie is the data controller for the personal data described here. In this policy, “Bunkie”, “we” and “us” mean Bunkie and the company that runs it.
Bunkie helps corp members find a bunkie: a fellow corper, or another verified host, to share a home with during the service year. Bunkie is not affiliated with or endorsed by the National Youth Service Corps (NYSC).
Our Data Protection Officer can be reached at [dpo email]. This policy follows the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC).
2. What we collect
Account details. Your email address and password (stored only as a secure hash), or your name and email if you sign in with Google.
Profile. Your first and last name, photo, where you are in NYSC (in camp, posted or serving), your batch, your PPA area, the household you’d share with (women only, men only or mixed), and your answers to the bunkie questions about sleep, guests, cooking, cleaning and noise.
Verification. To confirm who you are, we ask for an ID number, a live selfie and, for corp members, NYSC documents such as a call-up letter, posting or acceptance letter, state code or discharge certificate. We may ask for a phone number. Checks are done with an identity verification provider. We keep the result of each check (passed or not), a masked version of your name and the date. ID photos and letters are deleted once the check is complete, unless we need them for an open safety review. [Retention period to confirm with counsel.]
Rooms. If you host: the room’s location, photos taken in the app (with the time and place they were taken), price, bills, house rules, availability and the household type.
Bookings and stays. Requests, viewings, inspections, agreements, move-in and move-out dates and photos, deposit decisions, early-leave notices and reviews.
Messages. Chats between corpers and hosts, including photos you send. See “Keeping chats safe” below.
Payments. Amounts, dates, references and status for rent, deposits and inspection fees. Card and bank details you type when paying go to Paystack, not to us. If you host, we keep your payout bank name, account name and the last four digits of the account number.
Room posts. If you post what you’re looking for: the area, budget, dates, room type and any note you add.
Location. When you allow it, your device’s location, to find your PPA or to stamp room photos. You can say no and type an area instead.
Device and usage. Basic technical data such as your browser, device type, IP address, pages visited and errors, plus a sign-in cookie. Your search preferences are saved on your own phone. If you turn on notifications, we keep a push subscription for your device.
Support and reports. What you tell us when you ask for help or report someone.
3. How we use it, and why we’re allowed to
We only use personal data when the NDPA gives us a lawful basis.
- To provide Bunkie (contract): your account, search, matching, chat, requests, viewings, agreements, payments, payouts, deposits and reviews.
- To keep people safe (legitimate interests and, for ID checks, your consent): verifying identities, reviewing every room before it goes live, spotting scams and off-app payment requests, and handling reports.
- To meet the law (legal obligation): keeping payment records, responding to lawful requests and preventing fraud.
- To improve Bunkie (legitimate interests): understanding where corpers are looking and fixing problems. We use summaries wherever we can.
- To send updates (contract, or consent for optional messages): emails and notifications about your requests, bookings and messages. You can turn off optional notifications at any time.
Matching uses your bunkie answers and household choice to show a “fit” score. It ranks rooms; it never stops you from seeing or requesting any room. No decision with legal or similarly serious effects is made about you by automated means alone. Account suspensions and disputed payments are decided by a person.
4. What other people see
- Anyone browsing: rooms, the host’s first name, photo, badges (verified, corper host), ratings and reviews, and the room’s approximate area. Never the exact address.
- Signed-in users: room posts show your first name, the area you want, your batch and your preferences. No photo, surname or contact details.
- The other person in a request or chat: your first name, photo, verified badge, bunkie answers and the messages you send.
- After a viewing is booked: the corper sees the room’s exact location.
- After payment: phone numbers and contact details shared in chat stop being hidden.
Hosts and corpers never see your ID number, ID photos, NYSC documents or bank details.
5. Keeping chats safe
Many scams start by moving people off the app. Until a stay is paid, phone numbers, bank and account numbers, emails, links and other apps’ handles are hidden in chat. We keep the original message privately so our team can investigate if someone reports a scam.
Messages that look like common scams are flagged. Trained Bunkie staff can read flagged chats and reported chats to keep people safe. We don’t read chats for any other reason.
7. Data stored outside Nigeria
Some providers store data outside Nigeria. For example, our database is hosted in London, United Kingdom. When data leaves Nigeria, we rely on the transfer rules of the NDPA, such as an adequacy decision or contract terms that protect your data to the NDPA standard. [Transfer basis to confirm with counsel.]
8. How long we keep it
- Account and profile: while your account is open, then deleted within [30] days of closing it.
- ID photos and documents: deleted once the check is complete. The result is kept while your account is open.
- Chats: while your account is open, and longer if a report or dispute about them is still open.
- Payment and booking records: for [6] years after the payment, as the law requires for financial records.
- Room posts: they stop showing after 30 days or a week after your move-in date, and are deleted [90] days later.
- Safety records (reports, suspensions): for as long as needed to keep the community safe, up to [5] years.
9. Your rights
Under the NDPA you can:
- ask for a copy of your personal data;
- correct data that’s wrong;
- ask us to delete your data;
- ask us to limit or stop using it, or object to how we use it;
- get your data in a format you can take elsewhere;
- withdraw consent you’ve given, such as for notifications or location;
- not be subject to decisions made only by automated means that seriously affect you.
Ask from Get help or email [dpo email]. We reply within [30] days. We may need to confirm it’s you first. Some records, like payments, must be kept by law even if you ask us to delete your account.
If you’re unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
10. Keeping it secure
We use encryption in transit, access controls so each person can only reach their own data, private storage for ID documents, and logs of what our team does. Photos are re-encoded before upload, which removes hidden camera data. No system is perfect: if a breach puts you at risk, we’ll tell you and the NDPC as the law requires.
11. Age
Bunkie is for people aged 18 and over. We don’t knowingly collect data from anyone younger.
13. Changes to this policy
We’ll update this page when things change and show the date at the top. If a change matters, we’ll tell you in the app or by email before it applies.
14. Contact us
Data Protection Officer: [dpo email]. Support: [support email], [support phone].