Spa2You
Privacy Policy
Last updated 2026-09-15
How Spa2You collects, uses, stores and shares your personal data, and the choices you have — written to the Nigeria Data Protection Act 2023.
1. Who we are
Spa2You is operated by Spa2You Africa Limited, Lagos, Nigeria ("Spa2You", "we", "us"). We are the data controller for the personal data described in this policy.
Questions about this policy or your data: support@spa2you.com.
2. What we collect
We collect only what the service needs to work. Depending on how you use Spa2You, that is:
•
Account details — your name, email address, phone number and password (passwords are stored only as a hash by our authentication provider, never in plain text).
•
Profile information — a profile photo if you add one, and for providers a business name, description, service categories, prices, business address and portfolio photos or videos.
•
Verification data — one-time codes sent to your email or phone, and, where you choose to verify your identity, the identity documents you upload.
•
Booking data — the services you book or offer, dates and times, the service address you enter for home visits, booking status and history.
•
Messages — text, photos and videos you send in Spa2You chats, so the other party can receive them.
•
Payment data — booking amounts, payment references and payout records. Card and bank details entered at checkout go directly to Flutterwave; Spa2You never receives or stores your card number. A provider's payout bank account number and verified account name are stored so payouts can be made.
•
Location — your approximate device location, only while the app is open and only if you grant permission, to show providers near you. We do not track location in the background.
•
Device and usage data — a push-notification token for your device, device type and operating system, app version, and diagnostic logs when something goes wrong.
•
Reviews and ratings you leave, and comments or likes on provider posts.
3. Why we use it (and our legal basis)
Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use of your data. Ours are:
•
To provide the service you asked for — creating your account, matching you with providers, running bookings, chats, payments and payouts (performance of a contract).
•
To keep the marketplace safe — verifying emails and phone numbers, checking provider identity, holding payment in escrow until both sides confirm the service was delivered, and detecting fraud or abuse (legitimate interest and legal obligation).
•
To notify you — booking updates, messages, payment confirmations and important account notices, by push notification, email or WhatsApp/SMS (performance of a contract). You can turn push notifications off in your device settings.
•
To meet our legal duties — keeping transaction records for tax and financial regulation, and responding to lawful requests from authorities (legal obligation).
•
To improve Spa2You — understanding which features are used and fixing errors, using aggregated or de-identified data wherever possible (legitimate interest).
•
Where we rely on your consent — for example, device location — you can withdraw it at any time in your device settings.
4. Who we share it with
We do not sell your personal data. We share it only with:
•
The other party to your booking — a provider sees the customer's name, profile photo, service address for home visits and messages; a customer sees the provider's business profile. Phone numbers are shared only where a booking needs it.
•
Service providers who process data for us, under contract: Google Firebase (authentication, database, file storage, push notifications and hosting of our backend), Flutterwave (payments, refunds and payouts), Google Maps Platform (address search), Resend (verification emails), Meta's WhatsApp Business Platform (verification codes) and Vercel (web hosting).
•
Authorities, regulators or courts where the law requires it, or to protect the rights, safety or property of Spa2You, our users or the public.
•
A buyer or successor if Spa2You is sold or merged, in which case this policy continues to apply to your data.
5. Where your data is stored
Your data is stored on Google Cloud infrastructure. Our primary database is located in the africa-south1 (Johannesburg, South Africa) region; some processing, such as sending notifications and verifying payments, runs in other Google Cloud regions. Flutterwave processes payment data under its own security and regulatory obligations.
Where data leaves Nigeria we rely on the safeguards permitted by the Nigeria Data Protection Act, including contractual protections with each provider.
6. How long we keep it
We keep your account data for as long as your account is open. When you delete your account (section 8) we delete or anonymise it as described there.
Records of completed transactions — booking amounts, dates and payment references — are kept for as long as Nigerian tax and financial-record laws require, but with your name and contact details removed once your account is deleted.
Verification codes expire within minutes and are deleted shortly afterwards. Diagnostic logs are kept for a limited period and then discarded.
7. Your rights
You have the right to access the personal data we hold about you, to correct it, to have it deleted, to receive a copy in a portable format, to object to or restrict certain processing, and to withdraw consent where processing is based on consent.
Most of this you can do yourself in the app: edit your profile, change your password, or delete your account. For anything else, email support@spa2you.com and we will respond within the time the law allows. We may ask you to confirm your identity first.
If you are unhappy with how we handle your data you can complain to the Nigeria Data Protection Commission (NDPC).
8. Deleting your account
You can delete your account at any time from Security → Delete account inside the app, or on the web at the Delete account page. Deletion is permanent.
When you delete your account we remove your sign-in, profile, photos, saved items, notifications and, for providers, your services, posts, portfolio and payout account. Bookings, messages and reviews you were part of are kept for the other party but with your name, photo and contact details replaced by "Deleted user", and transaction records are kept without your identity as required by law.
If a booking of yours still has money in escrow, a refund pending or a payout in progress, deletion is paused until it settles, and the app tells you why.
9. Security
All traffic between the app and our servers is encrypted in transit. Access to your data is restricted by security rules so that only you, the other party to a booking where relevant, and authorised Spa2You staff can reach it. Payment is held in escrow and released only after both the customer and the provider confirm the service was delivered.
No system is perfectly secure. If we learn of a breach affecting your data we will notify you and the NDPC as the law requires.
10. Children
Spa2You is for adults. You must be at least 18 years old to create an account. We do not knowingly collect data from anyone under 18; if you believe a child has created an account, contact us and we will remove it.
11. Changes to this policy
We may update this policy as the service or the law changes. The date at the top shows the latest version. For significant changes we will notify you in the app or by email before they take effect.
12. Contact
Spa2You Africa Limited, Lagos, Nigeria. Email: support@spa2you.com.
Spa2You · spa2you.online · support@spa2you.com