Privacy Policy

1. Introduction

Welcome to Gran360, operated by REGO360 Company Limited (RC 7265838), a company duly incorporated under the laws of the Federal Republic of Nigeria (hereinafter referred to as "we," "our," "us," "the Company," or "Gran360"). Gran360 is a community-driven safety and awareness platform that enables users to post, view, and engage with reports about scams, incidents (accidents, fires, disasters, assaults, road blocks, etc.), and missing persons.

Your privacy and trust are fundamental to our mission. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our mobile application ("App") and website ("Web Platform") (collectively, "Services").

Important Notes:

  • Gran360 is operated in Nigeria, and our services are primarily intended for use within Nigeria
  • The mobile app provides full functionality for creating, viewing, and managing reports
  • The web platform provides read-only access—users cannot create, update, or delete content from the web
  • We comply with the Nigeria Data Protection Regulation (NDPR) 2019, Nigeria Data Protection Act (NDPA) 2023, and where applicable, the EU General Data Protection Regulation (GDPR) and US privacy laws

By using our Services, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use immediately.

2. Information We Collect

2.1 Personal Information

When you create an account, we collect:

  • Email address (required for authentication and communication)
  • Password (securely hashed using bcrypt with salt; never stored in plain text)

Third-Party Authentication: If you sign up using Google or Apple Sign-In, we collect:

  • Name provided by the authentication provider
  • Email address
  • Profile picture URL (optional)
  • Unique provider ID

We do not store or access your password when using third-party authentication. Authentication is handled securely by those providers using OAuth 2.0 protocols.

Optional Profile Information (added during onboarding or later):

  • Full name
  • Phone number (for SMS features and verification)
  • Date of birth (for age verification)
  • Profile picture
  • Bio and personal description
  • Privacy settings and notification preferences
  • SOS emergency contacts (stored locally on your device, not on our servers)
  • GeoFence contact relationships (mutual consent required - both parties must add each other)
  • Gamification profile: Experience points (XP), user level, achievements, badges, leaderboard rankings
  • Subscription tier and payment preferences

2.2 Report Data

When you submit a report, we collect:

  • Report title, description, and category
  • Media files (photos, videos, or other attachments)
  • Exact location coordinates (precise GPS location where incident occurred, if location services are enabled)
  • Location displayed as H3 hexagon area on public map (for reporter privacy)
  • Social media handles or external references you provide
  • Timestamps and metadata
  • Law enforcement information (voluntarily provided): Whether reported to authorities, case file/reference number, additional references

⚠️ Content Warning:

  • Community reports may contain descriptions or evidence of sexual violence, physical violence, graphic content, or other sensitive material
  • Our machine learning moderation system reviews all reports
  • Sexual or violent content IS ALLOWED when used to:
    • • Report genuine safety incidents
    • • Educate the community about threats
    • • Provide evidence for law enforcement
    • • Warn others about dangerous situations
  • Content that glorifies violence or is purely gratuitous will be removed
  • Users can report inappropriate content for human review
  • Viewer discretion is advised when browsing community reports

You may update or delete your reports at any time. Deleted reports are soft-deleted—removed from public view but retained for operational, audit, security, and legal purposes.

2.3 Location Data

Low-Precision Location

  • Used to show nearby reports and send location-relevant safety alerts
  • Can be disabled anytime in app settings
  • Approximate coordinates only; not used for real-time tracking

High Risks Near Me Notifications

When you enable "High Risks Near Me" in Notification Preferences:

  • We collect approximate low-precision location data rounded to 2 decimal places
  • This ensures your exact location is never collected or stored
  • The recorded location points to a nearby area (neighboring street or further), not your precise position
  • Used solely to alert you about high-risk incidents in your general vicinity
  • Can be disabled anytime in notification settings

High-Precision Location

Powers two critical safety features:

SOS Alerts:

  • Sends precise location as Google Maps link to designated emergency contacts
  • Contact lists and messages stored locally on your device only (not on our servers)
  • Queued messages auto-deleted from device after 14 days
  • We do not access your contact list or store SOS data on our servers

GeoFence Alert Tracking:

  • Allows authorized GeoFence contacts to monitor your journey between designated locations
  • Only users you have added as GeoFence contacts can create GeoFence alerts for you
  • Mutual relationship required: Both parties must explicitly add each other as GeoFence contacts before any tracking requests can be sent
  • GeoFence contacts can also be designated as emergency contacts in your "Track My Journey" self-tracking alerts
  • You must explicitly accept each GeoFence alert request before monitoring begins
  • During active tracking, we collect:
    • • Real-time GPS coordinates (latitude, longitude)
    • • Location accuracy (used to indicate GPS signal strength)
    • • Altitude, speed, and heading
    • • Timestamps for each location update
    • • Battery level and charging status (for low-battery alerts)
    • • Device geofencing events (departure, arrival)
    • • ETA calculation data: We use your current coordinates, speed, and location accuracy to estimate your arrival time and display signal strength indicators to authorized GeoFence contacts
  • Tracks departure from origin, journey progress, and arrival at destination
  • Full control to pause, stop, or delete alerts at any time
  • Cascading deletion: Deleting or blocking a GeoFence contact immediately deactivates all alerts and removes all associated location data

🔒 Privacy-Protected Location Storage:

  • We do NOT directly store your precise origin and destination addresses. However, if you provide an exact address during setup and do not modify the location name, that text label may be saved. We strongly recommend using friendly names (e.g., "Home," "Office," "School") instead of full addresses for maximum privacy.
  • Area-based locations: When you accept a GeoFence alert request, origin and destination are stored as hexagonal areas (~65-174m across) instead of precise addresses
  • H3 geospatial indexing: We use Uber's H3 hexagonal grid system (resolution 10) to approximate locations, ensuring your exact address is never stored in the alert configuration
  • Approximate coordinates only: The map shows hexagonal geofence boundaries, not precise pinpoints, until journey begins
  • Precise tracking only during journey: Exact GPS coordinates are collected only during active journey tracking (between departure and arrival)
  • Immediate deletion: All precise location breadcrumbs are automatically deleted upon journey completion
  • Privacy by design: This hexagonal area approach prevents your home, work, or other sensitive locations from being exposed even if someone gains unauthorized access to alert data

Example: Instead of storing "123 Main Street, Lagos" (precise), we store a hexagonal area covering ~65-174 meters that includes your general neighborhood (approximate). Your exact address remains private.

⏰ Time-Based Privacy Controls:

  • Tracking window: Location tracking only occurs during a defined time window (30 minutes before expected departure until arrival + grace period + 1 hour)
  • No premature tracking: If you accept an alert for tomorrow, tracking does not start until the window opens
  • Automatic geofence activation: Native device geofencing (low battery mode) or precise tracking (normal mode) activates only when the window opens
  • Server-side enforcement: Location updates submitted outside the tracking window are rejected by our servers to prevent unauthorized tracking
  • Recurring alerts: For recurring alerts (e.g., daily commute), tracking windows reset and activate only on scheduled days and times

Example: If your morning commute alert is set for 7:30 AM departure, tracking begins at 7:00 AM and ends shortly after arrival. Outside these hours, no location data is collected or transmitted.

⚠️ CRITICAL: GeoFence Tracking Reliability Limitations

WE ARE NOT LIABLE FOR GEOFENCE TRACKING FAILURES, INACCURACIES, OR UNAVAILABILITY RESULTING FROM:

  • User misconfiguration (incorrect times, wrong locations, disabled location services, battery saver mode)
  • Device issues (low/dead battery, GPS disabled, background restrictions, location permissions revoked, phone off)
  • Network connectivity problems (no internet, poor signal, airplane mode, data restrictions)
  • Server downtime, maintenance, or technical issues
  • Third-party service failures (Google Maps API, AWS, Expo notifications)
  • Mobile OS restrictions or updates changing permissions
  • Device manufacturer battery optimization or background process killers
  • Acts of God, force majeure, natural disasters, government actions
  • GPS signal loss (tunnels, underground, tall buildings, bad weather)

GeoFence tracking is a BEST-EFFORT SERVICE, not a guaranteed safety mechanism. You assume all risk when relying on it. Always have backup safety plans. NOT A SUBSTITUTE FOR professional security services or law enforcement.

Battery Information for GeoFence:

  • Battery level percentage to alert contacts if your device runs low during journey
  • Battery state (charging, discharging, full, unplugged, not charging, unknown)
  • Used for safety alerts when battery drops below configured threshold
  • Battery data collected only during active tracking window

Journey Summary and Data Retention:

  • Upon journey completion, raw geolocation data is converted to a Journey Summary
  • Journey Summary includes: distance covered (km), duration, average/top speed, battery status during journey, departure/arrival times, and on-time status
  • Raw geolocation breadcrumbs are immediately deleted after summary creation
  • No GPS coordinates stored in summaries: Journey Summaries contain aggregated statistics only, never precise location data
  • Journey Summaries are retained for 90 days for your reference
  • You can delete Journey Summaries at any time by deleting the GeoFence alert or contacting support
  • Cascading deletion: Deleting a GeoFence alert removes all associated data (summaries, logs, location data, monitored location) immediately through automatic cascading deletion

Location Permission Requests for GeoFence:

When you receive a GeoFence alert request, the app will prompt you to allow location tracking if you haven't already granted permission. By tapping "Allow" or "Request Permission," you will be directed to your device's system settings where you can enable location permissions for Gran360. The exact steps may vary depending on your device (iOS or Android). Location permissions are only requested when needed and can be revoked at any time through device settings.

Automatic Batch Location Updates:

In cases where your device is unable to send real-time location updates during an active GeoFence alert (due to network issues, app background restrictions, or device settings), the app will automatically store location data locally on your device.

  • Local Storage: Location data is temporarily stored locally on your device when real-time updates fail
  • Tracking window enforcement: Batch uploads are only accepted if they fall within the alert's active tracking window
  • User Notification: You will be notified when location tracking resumes and prompted to upload stored data
  • Consent Required: Batch uploads only occur with your explicit consent when prompted by the app
  • Data Minimization: Only location data from the active alert period is stored
  • Automatic Cleanup: Stored location data is automatically deleted after 7 days if not uploaded
  • Manual Control: You can choose to upload stored data, deactivate the alert, or keep data locally
  • Privacy Protection: Batch uploads are processed securely and data is handled according to our standard retention policies
  • Journey completion: Upon arrival, batched data is included in Journey Summary calculation, then immediately deleted

This feature ensures journey completeness while maintaining your privacy and control over location data sharing.

2.4 GeoFence Alert Requests

When a GeoFence contact creates an alert request for you, we collect:

  • Alert configuration (name, type, origin/destination locations stored as H3 hexagonal areas)
  • Schedule details (expected departure/arrival times, grace period, timezone)
  • Recurrence settings (if applicable)
  • Notification preferences
  • Optional message from the requester

Privacy Protection:

  • Declined or expired requests: All location data (H3 indices, coordinates, and location names) are immediately nullified and removed from our systems for your privacy
  • Automatic cleanup: Pending requests that expire are automatically deleted with all associated data
  • No retention: We do not retain location information from requests you decline

2.5 Engagement and Activity Data

We automatically collect: Reports viewed, bookmarked, marked as "Found Helpful", or flagged; community feedback; gamification progress (XP points, badges, levels); report contests or disputes; notification interaction metrics.

2.6 Device and Technical Information

Device identifiers, type, and OS; device tokens for push notifications (managed by Expo Push Notifications, no personal identifiers embedded); app version; IP address (truncated for privacy); error logs and crash reports (via Sentry, anonymized).

2.7 Subscription and Payment Data

Through RevenueCat and Paystack: subscription tier/status, renewal dates, payment amounts, transaction IDs. We never store your full payment card details. Payment card information is tokenized and handled securely by PCI-DSS compliant payment processors.

2.8 Security Audit Data

To protect your privacy and security, we maintain comprehensive audit logs:

Contact Actions:

  • When you delete, block, or unblock contacts, we log: timestamp, IP address, user agent, and affected data counts
  • This helps detect unauthorized account access and suspicious activity patterns
  • Logs include number of alerts deactivated, locations deleted, and requests cancelled

Location Access:

  • Every time someone views your GeoFence location, we log: who accessed it, when, from what IP address, and which alert
  • You can request your access logs to see who has viewed your location data
  • Helps detect potential misuse or unauthorized monitoring

Rate Limiting:

  • Location access is rate-limited to 100 requests per hour per user
  • Prevents mass scraping or abuse of location tracking features
  • Ensures system stability and protects against automated attacks

3. Automated Evaluation and Machine Learning

Gran360 uses automated machine learning systems to evaluate and assign risk levels to reports (low, medium, high), assess credibility, detect spam/fraud, and improve abuse detection.

Important Clarifications:

  • Risk assessments are not manually reviewed in routine operations
  • Human review occurs only for user-initiated reassessment requests, community flags, or anomaly detection
  • Users may contest automated decisions through the app
  • You have the right to request human review of any automated decision that significantly affects you

4. How We Use Your Information

Service Delivery:

  • Provide and maintain reporting and safety services
  • Enable posting, viewing, and engagement with community reports
  • Deliver SOS alerts and GeoFence alert tracking
  • Display relevant nearby reports with location-based filters
  • Process GeoFence alert requests and journey monitoring
  • Generate Journey Summaries from completed trips
  • Calculate ETA and display signal strength indicators during active tracking

Communications:

  • Send push notifications about incidents, alerts, and updates
  • Communicate about account security and support
  • Deliver promotional messages (opt-out available)
  • Alert GeoFence contacts about journey events (departure, arrival, delays, low battery)

Improvement and Analysis:

  • Improve credibility models and risk evaluation algorithms
  • Optimize alert targeting and notification delivery
  • Enhance app performance and user experience
  • Analyze anonymized usage data for service improvements

Safety and Compliance:

  • Detect, prevent, and respond to fraud and security threats
  • Comply with legal obligations and protect legal rights
  • Cooperate with law enforcement where legally required

5. Data Sharing and Disclosure

We do not sell your personal information to third parties.

We may share limited information only in these circumstances:

  • With Your Consent: When you accept GeoFence alert requests or authorize specific purposes
  • GeoFence Contacts: Location and battery data shared only with contacts you have explicitly authorized, and only during active alert periods. When you delete or block a GeoFence contact, all active monitoring is immediately terminated and all associated location data is automatically removed from our systems.
  • Public Reports: Approved reports are visible to all platform users. Reports display your full name (unless anonymous reporting is enabled for that report type), exact location coordinates (stored internally), location shown as H3 hexagon on public maps, and "Found Helpful" count plus "Confirmed Reports" status.
  • Service Providers: With AWS (cloud hosting), RevenueCat (subscriptions), Paystack (payments), Expo (push notifications), Google Maps API (geocoding), Sentry (error tracking), analytics providers (anonymized data), and Elasticsearch (search infrastructure). All are bound by strict confidentiality and data processing agreements.
  • Law Enforcement: When required by law, court order, or necessary for public safety. For missing persons/high-risk incidents, we may request proof of law enforcement reporting
  • Emergency Situations: SOS alerts sent to chosen contacts automatically, even if they don't have the app
  • Business Transfers: In event of merger, acquisition, or sale (with 30 days advance notification)

6. Data Storage, Security, and International Transfers

Hosting and Storage

All backend services are securely hosted on Amazon Web Services (AWS) infrastructure located in the Africa (Cape Town) region (af-south-1). We maintain industry-standard security practices including:

  • AWS security groups with strict access controls
  • VPC (Virtual Private Cloud) network isolation
  • Encryption of data at rest using AWS KMS (Key Management Service) with AES-256
  • Encryption of data in transit using TLS 1.3
  • Regular security audits and vulnerability assessments
  • Multi-factor authentication for administrative access
  • Role-Based Access Control (RBAC) for employees
  • JWT token authentication with short expiration (15 minutes access, 7 days refresh)

Our employees and contractors receive regular training on data protection principles and security best practices. All personnel with access to personal data are bound by confidentiality agreements and undergo background checks where appropriate.

Security Measures

  • HTTPS/TLS 1.3 encryption for all data transmission
  • Encryption of data at rest and in transit (AES-256)
  • Secure password hashing using bcrypt with salt (never stored in plain text)
  • Role-based access controls (RBAC)
  • Rate limiting: 100 location requests per hour per user
  • Regular security audits and continuous monitoring
  • Automated threat detection systems (AWS GuardDuty)
  • DDoS protection via Cloudflare
  • Data minimization practices
  • H3 hexagonal geofencing for location privacy
  • Comprehensive audit logging for location access

However, no digital service is entirely risk-free. Users are responsible for maintaining account security with strong passwords and secure devices. You assume inherent risk when sharing location data with GeoFence contacts.

International Data Transfers

While our primary infrastructure is located in Africa (Cape Town), data may be transferred to other AWS regions or third-party service providers in other countries (e.g., United States, European Union) for specific processing purposes. By using our Services, you consent to this transfer.

We ensure international data transfers comply with applicable laws including NDPR requirements for cross-border transfers and, where applicable, GDPR-approved mechanisms such as Standard Contractual Clauses (SCCs) and EU-US Data Privacy Framework.

7. Data Retention

  • Account Data: Retained while account is open. After deletion, 30-day grace period (logging in cancels deletion). After 30 days, personal identifiers permanently removed.
  • Reports: Remain visible even after account deletion but attributed to "Deleted User." Soft-deleted reports retained for operational, audit, security, and legal purposes.
  • Temporary Data: SOS messages deleted from device after 14 days.
  • GeoFence Location Data: Raw geolocation breadcrumbs and MonitoredUserLocation entries are immediately deleted upon journey completion when the Journey Summary is created. Orphaned location data older than 7 days is automatically deleted as a safety measure.
  • Batched Location Data: Location data stored locally on devices due to network or technical issues during GeoFence alerts is automatically deleted after 7 days if not manually uploaded. Uploaded batch data follows the same retention policy as regular GeoFence location data.
  • Declined/Expired Requests: When you decline a GeoFence alert request or it expires, all location data (H3 indices, coordinates, and names) are immediately nullified to protect your privacy. The request record (without location data) may be retained briefly for operational purposes before automatic deletion.
  • Contact Deletion: When you delete or block a GeoFence contact, all active alerts are immediately deactivated and all associated location data (real-time positions, journey summaries, logs) is removed through cascading deletion.
  • Audit Logs: Contact action logs (delete, block, unblock) and location access logs are retained for 180 days for security monitoring and dispute resolution, then automatically deleted. Long-term security logs retained for 7 years (anonymized after 2 years).
  • Journey Summaries: Retained for 90 days, then automatically deleted. You can delete earlier via app or by contacting support.
  • GeoFence Alert Requests: Pending requests expire after configured period. Expired/declined requests automatically removed.
  • Inactive GeoFence Alerts: Alerts inactive for more than 7 days, along with all associated data, are automatically deleted.
  • Alert Logs: GeoFence alert event logs retained for 90 days for your reference, then deleted.
  • Session Data: Expired sessions deleted after 7 days.
  • Logs and Analytics: May be retained longer for security, compliance, and improvement, in anonymized form where possible. Server logs retained for 90 days, security event logs for 1 year.

8. Your Rights and Choices Under NDPR and Other Regulations

Under the Nigeria Data Protection Regulation (NDPR), GDPR (where applicable), and other privacy laws, you have the following rights:

Right to Access and Data Portability

  • Request copy of your personal data (within 14 days)
  • Export data in common machine-readable format (CSV, JSON)
  • View your Journey Summaries, reports, and activity logs in-app
  • Access your complete data profile upon request

Right to Rectification

  • Update and correct inaccurate personal information
  • Edit or update reports you have submitted
  • Modify GeoFence alert settings and preferences
  • Complete incomplete data where appropriate

Right to Erasure (Right to be Forgotten)

  • Delete individual reports you have created
  • Delete entire account with 30-day grace period
  • Delete GeoFence alerts and all associated location data
  • Request deletion of Journey Summaries and activity logs
  • Request erasure of specific personal data

Right to Restrict Processing

  • Accept or decline GeoFence alert requests
  • Pause/stop GeoFence tracking at any time
  • Temporarily restrict processing while accuracy is verified
  • Restrict processing when data is unlawfully processed

Right to Object

  • Object to processing based on legitimate interests
  • Opt out of direct marketing communications
  • Object to automated decision-making and profiling
  • Object to processing for research or statistical purposes

Rights Related to Automated Decision Making

  • Challenge automated risk assessments
  • Request human review of automated decisions
  • Express your point of view regarding automated processing
  • Contest the outcome of automated evaluations

Right to Withdraw Consent

  • Withdraw consent for location tracking at any time
  • Revoke consent for GeoFence monitoring
  • Withdraw marketing consent through unsubscribe options
  • Manage communication preferences in settings

Right to Transparency and Information

  • Request information about data processing activities
  • Access your location access logs and audit trails
  • View who has accessed your GeoFence location data
  • Receive clear information about data sharing practices

Control Over Batch Uploads

  • Choose whether to upload stored location data when prompted
  • Review number of stored location points before uploading
  • Delete locally stored location data without uploading
  • Configure app settings for background location updates
  • Control automatic batch upload behavior in app settings

How to Exercise Your Rights

You can exercise your NDPR rights through the following methods:

  • Use in-app settings and privacy controls
  • Contact us at support@gran360.app
  • Submit a formal data subject request via email
  • Use the "Delete Account" feature in app settings

We will respond to all valid requests within 14 business days (or 30 days for complex requests). There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive.

Control Over Features

  • Manage Location Permissions: Enable or disable location access through your device settings. If you initially denied location permissions, you can enable them manually. Depending on your device, you will be taken to the system settings page for Gran360 to adjust your location preferences.
  • Manage GeoFence Contacts: Add, remove, block, or unblock GeoFence contacts
  • Manage SOS Contacts: Configure and update emergency contact lists
  • Disable low-precision location: Turn off location-based features in settings
  • Manage Notification Preferences: Control which notifications you receive
  • Enable/disable High Risks Near Me alerts: Toggle location-based safety alerts
  • Control alert frequency: Adjust how often you receive notifications

To exercise your rights, contact us at support@gran360.app or use in-app settings. We will respond within 14 business days (or 30 days for complex GDPR requests).

9. Missing Persons Reports: Special Guidelines

When reporting a missing person, you confirm that:

  • At least 24 hours have passed since disappearance (unless immediate danger)
  • Law enforcement has been notified and you have permission to share publicly
  • The missing person is a minor, vulnerable, or potentially in danger
  • You will not interfere with ongoing investigations

We may request proof of law enforcement involvement. You are solely responsible for ensuring proper authorization and accuracy.

10. User Responsibility and Content Liability

Gran360 does not verify the accuracy of user-submitted reports. Users are solely responsible for truthfulness, legality, and safety of their posts. We encourage independent verification.

Users may flag inappropriate reports, mark as "Found Helpful" or "Confirmed Reports", or contest through dispute mechanism.

REGO360 Company Limited is not liable for:

  • False, defamatory, or misleading user reports
  • Actions taken based on unverified community reports
  • Harm from reliance on user-generated content
  • Interference with investigations due to unauthorized disclosures
  • Technical failures in GeoFence tracking or SOS alerts

JOURNEY SAFETY ALERTS:

Journey safety alerts are based on unverified community reports and are provided for informational purposes only. REGO360 Company Limited is NOT liable for actions taken (or not taken) based on these alerts, alert failures, false positives/negatives, or any harm occurring regardless of alert status. See Section 24 for complete disclaimers and limitations.

11. Journey Safety Alerts: Important Disclaimers and Limitations

⚠️ CRITICAL SAFETY NOTICE - READ CAREFULLY

Journey safety alerts are informational only and NOT a substitute for personal judgment, professional security services, or law enforcement protection.

How Journey Safety Alerts Work

When you are traveling with an active GeoFence alert, Gran360 monitors your route in real-time and may send notifications if you are approaching or entering areas where community members have recently reported incidents.

Alert System Overview:

  • Data Source: Alerts are based entirely on user-submitted community reports, NOT verified crime statistics or official law enforcement data
  • Geographic Precision: We use H3 hexagonal geospatial indexing (covering approximately 0.1 km² areas) to identify incident zones
  • Time Window: Alerts consider only incidents reported within the last 3 days to focus on recent activity
  • Risk Classification: Automated machine learning algorithms assign risk levels (medium, high, critical) based on report severity, frequency, and community validation
  • Prioritization: We prioritize alerts for incidents marked as "approved," "shared," and "confirmed by other users"
  • Predictive Warnings: When traveling at speed above 5 m/s, the system attempts to predict your path and alert you approximately 30 seconds before reaching a flagged area

Community-Generated Content Limitations

GRAN360 DOES NOT AND CANNOT VERIFY THE ACCURACY, COMPLETENESS, OR TRUTHFULNESS OF USER-SUBMITTED REPORTS.

All journey safety alerts are derived from community reports that have NOT been independently investigated or confirmed by Gran360, law enforcement, or any official authority.

What This Means for You:

  • Unverified Information: Reports may contain inaccurate locations, exaggerated descriptions, outdated information, or deliberate misinformation
  • False Positives: You may receive alerts for areas that are actually safe, causing unnecessary anxiety or route changes
  • False Negatives: Dangerous areas may NOT trigger alerts if no community members have reported incidents there recently
  • Confirmation Bias: Even reports marked as "confirmed by other users" only mean multiple users submitted similar reports—this does NOT guarantee accuracy or truthfulness
  • Incomplete Picture: Journey alerts show only a snapshot of reported incidents in the last 3 days and may miss ongoing threats, emerging dangers, or chronic safety issues
  • Subjective Assessments: Risk level classifications (medium, high, critical) are automated algorithmic determinations based on limited community data, not professional threat assessments

Technical Limitations and System Failures

Journey Safety Alerts Are NOT Guaranteed and May Fail Due To:

  • Network connectivity issues (no internet, weak signal, data restrictions)
  • GPS inaccuracies or signal loss (tunnels, buildings, weather interference)
  • Device limitations (low battery, background app restrictions, permissions disabled)
  • Server downtime, maintenance, or technical failures
  • Database synchronization delays between services
  • Third-party service outages (AWS, Elasticsearch, RabbitMQ)
  • Mobile OS updates or changes that affect location tracking
  • User configuration errors (incorrect alert settings, disabled notifications)
  • Prediction algorithm errors (wrong path calculations, speed/heading inaccuracies)
  • H3 geospatial indexing edge cases (incidents just outside checked hexagons)

Real-Time Processing Delays: Even under optimal conditions, there may be delays of several seconds between your location changing and receiving an alert. At high speeds, you may enter a flagged area before receiving notification.

Your Responsibility and Independent Judgment

YOU ARE SOLELY RESPONSIBLE FOR YOUR OWN SAFETY.

Journey safety alerts are provided as informational assistance ONLY. They do not replace your personal judgment, situational awareness, or common sense.

  • Assess Your Own Risk: You have the right and responsibility to evaluate threats independently based on your own knowledge, observations, and circumstances
  • Freedom of Movement: You are entitled to travel through any area you choose, regardless of alert status. Alerts are suggestions, not restrictions
  • Context Matters: Consider time of day, visibility, crowd density, your familiarity with the area, and other factors that alerts cannot capture
  • Professional Advice: For serious safety concerns, consult professional security services, local authorities, or trusted contacts—not a mobile app
  • Verify Information: Cross-reference alerts with official sources, news reports, or local knowledge when making important safety decisions
  • Trust Your Instincts: If something feels unsafe, trust your intuition regardless of whether you received an alert

Gran360 journey alerts are meant to supplement—never replace—your own judgment, awareness, and decision-making abilities.

No Liability for Actions Taken or Not Taken

REGO360 COMPANY LIMITED, GRAN360, AND OUR AFFILIATES EXPRESSLY DISCLAIM ALL LIABILITY FOR:

1. Actions Taken Based on Alerts:

  • Changing your route or destination based on an alert
  • Avoiding certain areas or neighborhoods
  • Canceling plans, appointments, or travel
  • Experiencing increased anxiety, stress, or fear
  • Economic losses from avoided opportunities or changed plans
  • Harm occurring in an "alternative" route you chose
  • Accidents or incidents while attempting to avoid flagged areas
  • Property damage, lost time, or other consequential damages

2. Actions NOT Taken Due to Lack of Alerts:

  • Harm occurring in areas where NO alert was issued
  • Failure to avoid dangerous situations due to absence of warnings
  • False sense of security in unmonitored or "green" areas
  • Delayed response to threats not captured by community reports
  • Incidents occurring immediately after the 3-day reporting window

3. Technical or System Failures:

  • Alert delivery failures due to network, device, or server issues
  • Inaccurate location detection or path prediction errors
  • Delayed or missing notifications
  • Incorrect risk level classifications
  • Database synchronization failures

4. Community Report Issues:

  • False, misleading, or malicious reports submitted by users
  • Outdated information no longer reflecting current conditions
  • Incomplete incident descriptions lacking critical context
  • Deliberate misinformation or hoaxes
  • Reports submitted by bad actors with ulterior motives

5. Psychological or Emotional Impact:

  • Unnecessary fear, anxiety, or panic caused by false alerts
  • Psychological distress from repeated safety notifications
  • Avoidance behaviors affecting quality of life
  • False sense of security when no alerts are received
  • Hypervigilance or paranoia from constant threat monitoring

BY USING JOURNEY SAFETY ALERTS, YOU ACKNOWLEDGE THAT YOU UNDERSTAND THESE RISKS AND AGREE THAT REGO360 COMPANY LIMITED SHALL NOT BE HELD LIABLE FOR ANY HARM, LOSS, DAMAGE, OR INJURY—WHETHER DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE—ARISING FROM YOUR USE OF OR RELIANCE ON THIS FEATURE.

Intended Use and Scope

Journey safety alerts are designed as a supplementary awareness tool for individuals traveling through areas with recent community-reported incidents. This feature is NOT:

  • A comprehensive crime prevention system
  • A real-time emergency response service
  • A replacement for professional security or law enforcement
  • A guarantee of safety in any location
  • A verified or authoritative source of threat intelligence
  • Medical, legal, or professional safety advice
  • An insurance policy against harm or criminal activity

Recommendation: Use Multiple Information Sources

For comprehensive safety awareness, we strongly recommend:

  • Cross-referencing Gran360 alerts with official crime statistics
  • Checking local news sources for current safety information
  • Consulting with local residents familiar with the area
  • Following guidance from law enforcement and public safety officials
  • Using multiple safety apps and community platforms
  • Staying informed about general security conditions in your region
  • Maintaining situational awareness regardless of alert status

Disabling Journey Safety Alerts

You can disable journey safety alerts at any time through:

  • App Settings → Notifications → Journey Safety Alerts (toggle off)
  • Individual GeoFence alert settings when creating or editing alerts
  • Device notification settings to block alert notifications entirely

Disabling alerts does NOT affect other GeoFence tracking functionality (departure/arrival notifications, low battery alerts, emergency contact updates).

Acknowledgment and Acceptance of Risk

BY ENABLING OR USING JOURNEY SAFETY ALERTS, YOU EXPRESSLY ACKNOWLEDGE AND AGREE THAT:

  1. You have read and understood all disclaimers and limitations described in this section
  2. You understand that alerts are based on unverified, user-generated community reports
  3. You will NOT rely solely on Gran360 alerts for personal safety decisions
  4. You accept full responsibility for your own safety and risk assessment
  5. You will exercise independent judgment and maintain situational awareness
  6. You understand Gran360 cannot prevent harm and does not guarantee your safety
  7. You waive any right to hold REGO360 Company Limited liable for outcomes related to journey safety alerts
  8. You agree this feature is provided "AS IS" without warranties of any kind

Questions or Concerns About Journey Safety Alerts?

Contact our support team at support@gran360.app for assistance with alert settings, technical issues, or clarification about how this feature works.

12. Third-Party Services and Emergency Helplines

Integrated Services

Gran360 integrates with Google Maps, RevenueCat, Paystack, Apple, and Google authentication. Each operates under their own privacy policies. We encourage you to review their policies.

Emergency Helplines

The app provides public emergency helplines (fire, health, gender-based violence, disaster response).

Disclaimer: We do not verify or guarantee accuracy of these numbers and are not liable for disconnected numbers, response failures, or delays. Confirm helplines with local authorities.

13. Advertising, Promotions, and Gamification

  • Advertising: May display third-party ads. While we avoid harmful content, we don't independently verify all advertisers. Users can report inappropriate ads.
  • Gamification: Points, badges, and levels have no real-world monetary value. Gran360 may adjust, pause, or remove rewards at any time.
  • Subscription Pricing: May change with reasonable notice. Current subscribers notified before renewal at new price.

Quizzes and Leaderboard

Gran360 offers safety quizzes designed strictly for knowledge and safety awareness purposes.

Public Leaderboard Information:

  • The quiz leaderboard is publicly visible to all users
  • Leaderboard displays: score, number of attempts, and average quiz completion time
  • Personal details shown include: display name, email address, and profile picture
  • If you do not wish to appear publicly on the leaderboard, contact support@gran360.app to request removal
  • We reserve the right to remove users from the leaderboard for internal reasons without notice

Prize Disclaimer:

  • Leaderboard placement does not automatically translate to prizes
  • Quizzes are strictly for knowledge and safety education
  • We may, at our sole discretion, present tokens in physical or virtual form to top placements
  • Any announced prizes may be retracted at our discretion without prior notice
  • No user is entitled to prizes based solely on leaderboard position

14. Children's Privacy

Gran360 is not intended for children under 13 years old. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected data from a child under 13, contact us immediately at support@gran360.app for prompt removal.

Minors aged 13-17 may use the app only with verified parental or guardian consent. Parents/guardians can use GeoFence features to monitor their children's safety with the child's knowledge and consent.

15. Cookies and Tracking Technologies

Website Cookies

Our website (https://www.gran360.app) uses cookies and similar tracking technologies:

Essential Cookies (Required)

Necessary for website functionality, authentication, and security. Cannot be disabled.

Functional Cookies (Optional)

Remember your preferences, settings, and choices. Can be disabled in browser settings.

Analytics Cookies (Optional)

Google Analytics with anonymized IP addresses. Help us understand usage patterns and improve the site.

Marketing Cookies (Optional)

Track conversions and measure advertising effectiveness. Can be disabled via cookie banner.

Mobile App Tracking

Our mobile application uses the following tracking technologies:

  • Mixpanel: Product analytics and user behavior tracking (anonymized)
  • Firebase Analytics: App usage analytics and crash reporting
  • Sentry: Error tracking and performance monitoring (anonymized data only)
  • AppsFlyer: Attribution tracking for marketing campaigns

All analytics data is anonymized and aggregated. We do not sell analytics data to third parties.

Managing Cookies and Tracking

  • Website: Use our cookie banner to manage preferences or adjust browser settings
  • Mobile App: Manage analytics preferences in app settings under Privacy
  • Push Notifications: Control via device settings or in-app notification preferences
  • Advertising ID: Reset or disable in your device's privacy settings (iOS/Android)

16. Marketing Communications

Types of Communications

Transactional (Cannot Opt-Out)

Account verification, password resets, security alerts, payment confirmations, GeoFence alert notifications. These are necessary for service operation.

Service Updates (Can Opt-Out)

New features, product improvements, important policy changes, safety tips. You can opt out while still receiving transactional emails.

Marketing (Opt-In Only)

Promotions, special offers, newsletters, community highlights. We only send marketing emails if you explicitly opt in during registration or in settings.

Push Notifications (Manageable)

Safety alerts, nearby incidents, GeoFence updates, report interactions. Fully customizable in app settings and device notification settings.

How to Opt Out

  • Email: Click "Unsubscribe" link at bottom of any marketing email
  • Push Notifications: Manage in device settings or app notification preferences
  • SMS (if applicable): Reply "STOP" to opt out of promotional SMS
  • In-App Settings: Go to Settings → Notifications → Manage preferences

Changes to communication preferences take effect within 48 hours. You will continue to receive transactional emails necessary for account operation.

Third-Party Marketing

We do NOT share your email address or phone number with third parties for their marketing purposes. Exception: Co-branded campaigns with explicit opt-in consent where clearly disclosed at the time of collection.

17. Data Breach Notification

Our Data Breach Response Protocol:

  • Detection: Continuous monitoring and automated threat detection systems
  • Assessment: Immediate security team investigation within 1 hour of detection
  • Containment: Isolate affected systems to prevent further unauthorized access
  • Notification: Comply with legal notification timelines (see below)
  • Remediation: Fix vulnerabilities and implement additional safeguards
  • Documentation: Maintain detailed breach logs for regulatory review

Notification Timelines

NITDA/NDPR (Nigeria)

24 hours: Notification to NITDA for breaches affecting more than 100 users

Affected Users

72 hours: Direct notification via email and in-app alert to all affected users

GDPR (EU Users)

72 hours: Notification to relevant supervisory authority when applicable

What We Tell You

Our breach notification will include:

  • Nature of the breach (unauthorized access, data leak, etc.)
  • Categories of data affected (emails, location data, etc.)
  • Approximate number of affected users
  • Likely consequences of the breach
  • Measures we've taken to address the breach
  • Recommended actions for affected users
  • Contact information for further questions (dpo@gran360.app)

What You Should Do

If you receive a breach notification:

  • Change your Gran360 password immediately
  • Enable two-factor authentication if not already enabled
  • Review recent account activity for suspicious behavior
  • Check if you use the same password on other services (change those too)
  • Monitor your GeoFence contacts and review who has access to track you
  • Be alert for phishing attempts claiming to be from Gran360
  • Report any suspicious activity to support@gran360.app

Breach Logging

All security incidents and data breaches are documented in our breach log, which is retained for 7 years in compliance with NDPR requirements. You may request information about past breaches that affected your data by contacting our Data Protection Officer.

18. California and International Users

California Residents (CCPA/CPRA Rights)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

  • Right to Know: Request disclosure of personal information collected, sources, purposes, and third parties with whom we share data
  • Right to Delete: Request deletion of personal information (subject to legal exceptions)
  • Right to Opt-Out of Sale: We do NOT sell personal information. If this changes, we will provide an opt-out mechanism.
  • Right to Opt-Out of Sharing: We do not share personal information for cross-context behavioral advertising
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Limit Use of Sensitive Personal Information:Limit use of sensitive data (location data, health info)
  • Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights

California "Shine the Light" Law: You may request information about our disclosure of personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes without your explicit consent.

European Economic Area (EEA) and UK Residents

If you are located in the EEA or UK, your data processing is governed by GDPR. In addition to the rights described elsewhere in this policy:

  • Legal Basis: We process your data based on consent, contractual necessity, legal obligations, vital interests, and legitimate interests
  • Data Transfers: We use Standard Contractual Clauses (SCCs) approved by the European Commission for transfers outside the EEA
  • EU Representative: If we process data of more than 100 EU residents, we will appoint an EU representative as required by GDPR
  • Supervisory Authority: You may lodge complaints with your local data protection authority
  • Automated Decision-Making: You have the right not to be subject to decisions based solely on automated processing with legal effects

Other International Users

Users from other jurisdictions have rights under applicable local laws. We commit to honoring data protection rights equivalent to those described in this Privacy Policy, regardless of your location. If your jurisdiction has specific data protection laws not addressed here, please contact us at dpo@gran360.app to discuss how we can accommodate your rights.

Exercising Your Rights

To exercise any of the rights described above, contact us at:

  • Email: support@gran360.app or dpo@gran360.app
  • In-app: Settings → Privacy → Data Rights
  • Response time: 14 days (NDPR), 30 days (CCPA), 30 days (GDPR)

We may verify your identity before processing requests to protect your privacy and security.

19. Changes to This Privacy Policy

We may update this Privacy Policy periodically. Significant changes will be communicated via in-app notification or email at least 30 days before taking effect. The updated policy will always display a revised "Last Updated" date. Continued use after changes constitutes acceptance.

20. Legal Basis for Processing

For users in jurisdictions with data protection laws (e.g., GDPR, NDPR, CCPA), we process your data based on:

  • Contractual necessity: To provide our Services as agreed in our Terms of Service
  • Legitimate interests: In improving, securing, and analyzing our platform (balanced against your rights)
  • Legal compliance: With applicable laws and regulations
  • Consent: Where explicitly obtained for specific activities (e.g., marketing, GeoFence monitoring)
  • Vital interests: To protect life and safety in emergencies

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

21. Data Protection Officer

In accordance with NDPR requirements, we have designated a Data Protection Officer (DPO) who is responsible for overseeing our data protection strategy and compliance. You can contact our DPO at dpo@gran360.app.

22. Complaints and Regulatory Authority

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with:

  • Nigeria: National Information Technology Development Agency (NITDA)
  • EU/EEA: Your local Data Protection Authority
  • Other jurisdictions: The relevant data protection authority in your location

NDPR Regulatory Authority Contact Information

For NDPR compliance issues, you may contact:

National Information Technology Development Agency (NITDA)

📧 Email: info@nitda.gov.ng

🌐 Website: https://nitda.gov.ng

📞 Phone: +234 9 461 7200

🏢 Address: NITDA Headquarters, Garki, Abuja, Nigeria

We encourage you to contact us first at support@gran360.app so we can address your concerns directly before escalating to regulatory authorities.

22. Contact Us

For questions, data requests, complaints, or to exercise your privacy rights, please contact:

Gran360 Privacy Team

REGO360 Company Limited

📧 Email: support@gran360.app

📧 DPO: dpo@gran360.app

🌐 Website: https://www.gran360.app

🏢 Address: Lagos, Nigeria

Response Time: We will respond to all privacy inquiries within 14 business days (30 days for complex GDPR requests).

23. Definitions and Governing Law

Key Definitions

Personal Data

Any information relating to an identified or identifiable natural person (name, email, location data, device identifiers, etc.)

Processing

Any operation performed on personal data, including collection, storage, use, disclosure, or deletion

Data Controller

REGO360 Company Limited - determines the purposes and means of processing your personal data

Data Processor

Third-party service providers (AWS, RevenueCat, Paystack, etc.) who process data on our behalf

Data Subject

You - the individual whose personal data we process

H3 Hexagon

A hexagonal geographic area (~65-174m across at resolution 10) used by Uber's H3 geospatial indexing system to approximate locations for privacy protection

Tracking Window

The time period during which location data is actively collected for a GeoFence alert (30 minutes before departure until arrival + grace period + 1 hour)

Journey Summary

Aggregated statistics about a completed journey (distance, duration, speed, battery) with NO GPS coordinates, created after journey completion

GeoFence Contact

A mutual contact relationship where both parties have explicitly added each other and can send/receive GeoFence tracking requests or be designated as emergency contacts

Cascading Deletion

Automatic deletion of all related data when a parent record is deleted (e.g., deleting a GeoFence contact triggers deletion of all associated alerts, journey summaries, and location data)

Governing Law

This Privacy Policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Regulation (NDPR) 2019 and Nigeria Data Protection Act (NDPA) 2023. Any disputes arising from this policy shall be subject to the exclusive jurisdiction of Nigerian courts, without prejudice to your rights under GDPR or other applicable data protection laws in your jurisdiction.

By using Gran360, you acknowledge that you have read, understood, and agree to this Privacy Policy.

REGO360 Company Limited © 2025. All rights reserved.

Last Updated: February 7, 2026