Privacy Policy
Last updated: 23 September 2026 · Version 1.0
1. Who we are and what this covers
This policy explains what Gathora Ltd (RC 9845461) ("Gathora", "we", "us") collects when you use the Gathora website and apps, why we collect it, who we share it with, how long we keep it and what you can do about it.
Gathora is a marketplace for group trips and events. People who organise them are Hosts, people who book them are Travellers, and most of what follows applies to both. Gathora is the data controller for the personal data described here. A Host is a separate controller for the personal data they collect from their own attendees, and this policy does not govern what a Host does with it.
This policy is written to meet the Nigeria Data Protection Act 2023 and the regulations made under it. If you use Gathora from outside Nigeria, local law may give you further rights, and we will honour them where they apply.
It covers personal data, which means information that identifies you or could be linked to you. It does not cover data that has been aggregated or stripped of identifiers so that it no longer relates to you.
2. What we collect from everyone
Account: name, email address, username, password stored as a hash, phone number, profile photo, bio, location, date of birth if you give it, and your sign in provider if you use Google or Apple.
Content and activity: listings, posts, photos and videos, messages in group rooms and direct messages, polls and votes, reactions, comments, reports you make, communities you join, who you follow and who you block, and check ins at events.
Location: the place you attach to a listing or a post, and, only while you are using the Nearby filter, your device's approximate location.
Device and usage, collected automatically: IP address, browser and device type, operating system, app version, pages and listings viewed, referring page, crash and error reports, and push notification tokens.
Inferences: what kinds of trips and events you seem interested in, drawn from what you view, save and book, which we use to order your feed.
3. What we collect from Hosts who want to be paid
Identity verification: images of a government issued identity document and the data on it, a selfie or liveness check, your date of birth and address, and the result of the check. We use an identity verification provider for this, currently Dojah, which performs the check and returns the outcome to us.
Business details, where you host as a company or an agency: registered name, registration number, business address and the details of the people who own or control it.
Payout details: bank name, account number, and the account name our payment processor returns when it resolves the account, which we compare with your verified identity before we allow a payout.
We collect this because the law requires us to know who we are paying before we send money, and because it protects Travellers. If you do not provide it you can still host, but you cannot be paid.
4. What we collect from Travellers
Bookings and payments: what you booked, the amount, your payment plan, your instalment history, receipts and refunds. Our payment processor, currently Paystack, handles your card details. We never see or store your full card number; we hold only the last four digits, the card type and the transaction reference.
Refund payout details, if we have to refund you by bank transfer rather than back to your card: bank name, account number and the resolved account name.
Anything a Host asks you for on their own registration questions, which the Host receives and controls.
5. Why we use it, and our legal basis
- To run the marketplace: create your account, show listings, take bookings, collect instalments, pay Hosts, issue refunds, run rooms, communities and passes. (Performance of our contract with you.)
- To verify Hosts and prevent fraud: identity and bank account checks, first payout holds, chargeback and dispute handling, sanctions screening. (Legal obligation under anti money laundering rules, and our legitimate interest in a platform people are not defrauded on.)
- To keep you informed: booking confirmations, instalment reminders, payout and refund notices, security alerts, and other messages the service cannot work without. You cannot opt out of these while you hold a booking or a listing. (Contract.)
- To market Gathora to you, and to let Hosts message people who booked their listing: email, in app broadcasts and push notifications. Marketing is sent on consent, which you can withdraw at any time in Settings. (Consent.)
- To personalise what you see: ordering your feed, suggesting communities and listings near you. (Legitimate interest; you can turn location off.)
- To keep the platform safe: moderation, reports, blocking, rate limiting, suspension and investigation. (Legitimate interest, and legal obligation where a report concerns a crime.)
- To improve Gathora: aggregated analytics, error monitoring and product research. (Legitimate interest.)
- To comply with law and to respond to regulators, courts and law enforcement. (Legal obligation.)
We do not sell your personal data, and we do not make decisions about you by automated means alone that have a legal or similarly significant effect. Payout holds, suspensions and refund decisions are reviewed by a person.
7. Where your data goes
Gathora's database and application servers are hosted outside Nigeria, currently in the European Union, and several of the providers listed above process data outside Nigeria as well.
Where we transfer personal data out of Nigeria we rely on the mechanisms the NDPA allows: an adequacy decision of the Nigeria Data Protection Commission where one applies, and otherwise contractual commitments from the recipient that give your data the same protection it has here. You may ask us for details of the safeguards for any particular transfer.
8. How long we keep it
Account data: while your account is open, and for 90 days after you close it, unless we must keep something longer.
Payment, receipt, statement, payout and refund records: 7 years after the transaction, because tax and financial record rules require it. These survive account deletion.
Identity verification: the images of your identity document are deleted 90 days after the verification decision, unless an investigation, a dispute or a legal obligation requires us to keep them. The record that you were verified, when, by which provider and with what outcome is kept for 5 years after our relationship ends, as anti money laundering law requires.
Messages: while the room exists. Rooms for completed trips are archived and deleted 12 months after the end date.
Reports, moderation records and suspension decisions: 2 years, so that repeat behaviour can be recognised.
Backups: deleted data can persist in encrypted backups for up to 35 days before those backups roll over.
9. Your rights
Under the NDPA you can ask us to give you access to your personal data, to correct it, to delete it, to give you a copy in a portable form, to restrict or object to certain processing, and to withdraw consent where consent is the basis. Withdrawing consent does not undo what we did before you withdrew it.
You can do most of this yourself in Settings: edit your profile, change privacy and notification preferences, download your data, and delete your account.
For anything else, email info@gathora.app. We respond within 30 days, and we may ask you to confirm who you are first. There is no charge unless a request is repetitive or excessive.
Deleting your account does not delete the records we are required to keep under section 8, content you posted into a group that others still hold, or data a Host received independently.
10. Your choices
Marketing email and broadcasts: unsubscribe from the link in any marketing email or turn them off in Settings. This takes effect within 48 hours.
Push notifications: turn them off in Settings or in your device's own settings.
Service messages such as booking confirmations, instalment reminders and security alerts cannot be switched off while you hold a booking or a listing, because they are part of the service.
Location: the Nearby filter only uses your location while you have it on, and your browser or phone asks you first. Turn it off and the feed falls back to the city on your profile.
Browsing: you can look at Gathora without an account, and we will only collect what section 2 describes as automatic.
We do not respond to browser Do Not Track signals, because there is no agreed standard for what they should do.
11. Security
We use encrypted connections, hashed passwords, access controls, audited staff actions, rate limiting and monitoring. Actions that move money require an administrator to confirm their password again, and every one is logged against the person who did it.
No system is perfectly secure. If we discover a breach that is likely to harm you, we will tell you and the Nigeria Data Protection Commission as the law requires. Tell us immediately at info@gathora.app if you suspect a problem with your account.
13. What this policy does not cover
Anything you choose to share with another user directly, or post publicly. Once you have sent it, we cannot take it back from whoever received it.
Sites and apps we link to, including a Host's own website and the payment processor's pages. They have their own policies, and a link is not an endorsement.
What a Host does with the attendee data they receive from us, which is covered by section 6.
14. Children
Gathora is for adults. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it and close the account. If you believe a child has given us data, tell us at info@gathora.app.
15. People who do not use Gathora
We sometimes hold data about people who do not have an account: someone who appears in a photo a user posted, someone a Host lists as an emergency contact, or someone named in a report. We use it only for the purpose it was given for, we keep it no longer than we need it, and the rights in section 9 apply to you too even without an account.
16. Changes to this policy
We may update this policy. We post the new version and its date here, and for material changes we tell you in the app or by email before they take effect.
17. Contact and complaints
Gathora Ltd (RC 9845461), Block 119, Karfin Madaki Crescent, Kubwa, Abuja.
Data protection contact: info@gathora.app. General support: support@gathora.app.
If you are not satisfied with how we have handled your personal data or your request about it, you can complain to the Nigeria Data Protection Commission.