Last updated: April 2026
Cravy ("we", "us", "our") operates the Cravy mobile and web application, a multi-sided marketplace combining food discovery, product ordering, live streaming, ride-hailing, event ticketing, and social commerce. Our registered contact for privacy matters is: admin@cravy.eu
This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights over it. It applies to all users of the Cravy app on iOS, Android, and web.
When you create an account or complete your profile we collect: full name, username, and email address; phone number with country code; profile photo and avatar; bio and website URL; business name and business address for business accounts; role such as consumer, business, influencer, or rider/driver.
We collect precise GPS location to find nearby businesses, calculate delivery distances, match taxi rides, and show locally relevant content. This is collected when you use delivery, taxi, or location-based search features. We also collect saved delivery addresses you store in the app including street, city, state, postal code, and country. Business coordinates in the form of latitude and longitude are stored for distance calculations.
We also use your device locale (the language and region setting on your device, for example "fi_FI" for Finnish users in Finland) to determine which payment methods are available in your region. This is read locally on your device and is not transmitted to our servers.
We collect your payment method preference such as card, cash, or mobile money, as well as payment provider reference IDs including Stripe PaymentIntent IDs and Paystack references, transaction currency, and detected country for payment routing. We do not store raw card numbers, CVVs, or full bank account details. These are handled directly by Stripe or Paystack under their own PCI-DSS compliance.
We collect videos, photos, and images you post to the feed, live stream recordings and thumbnails, product descriptions, menus, and pricing, reviews and ratings you write, and comments and chat messages. When you upload a video with attached music or adjusted audio levels, we store the audio volume settings and music trim preferences you set during editing so your creative choices are preserved in the feed.
We collect device push notification tokens via OneSignal and FCM, device type and operating system, app version and session data, and IP address collected by Supabase infrastructure. We also read your device locale setting to determine your region for payment method selection. This locale data is processed locally and is not stored on our servers.
We collect search history and search queries, content you view, like, share, bookmark, or comment on, feed preferences and content type settings, and order history and appointment history.
Face ID and Touch ID are used locally on your device only to unlock the app. We do not transmit or store biometric data on our servers.
We collect messages you send to other users or businesses, support tickets and support chat messages, and order chat messages between customers and businesses.
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Creating and managing your account | Profile data, email | Contract performance |
| Processing orders and payments | Payment data, address, order history | Contract performance |
| Selecting the correct payment provider for your region | Device locale, delivery address, profile country | Contract performance |
| Matching taxi rides and delivery | GPS location, address | Contract performance |
| Showing nearby businesses and content | Location, preferences | Legitimate interest |
| Sending push notifications | Device tokens | Consent |
| Personalising your feed | Behavioural data, search history | Legitimate interest |
| Preserving your video editing choices | Audio volume, music trim data | Contract performance |
| Preventing fraud and abuse | Account data, device data | Legitimate interest / Legal obligation |
| Improving the platform | Aggregated usage data | Legitimate interest |
| Complying with legal obligations | Any relevant data | Legal obligation |
| Service | Purpose | Privacy Policy |
|---|---|---|
| Supabase | Database, authentication, file storage, real-time messaging | supabase.com/privacy |
| Stripe | Payment processing for EU, US, Canada, and other supported regions | stripe.com/privacy |
| Paystack | Payment processing for Ghana and Nigeria | paystack.com/privacy |
| OneSignal | Push notifications | onesignal.com/privacy |
| LiveKit | Live video streaming | livekit.io/privacy |
| Nominatim / OpenStreetMap | Address geocoding | openstreetmap.org/privacy |
| Jamendo | Creative Commons music library | jamendo.com/legal/privacy |
| Klipy | GIF, sticker, and clip content | klipy.com/privacy |
| Resend | Transactional email delivery | resend.com/privacy |
We do not sell your personal data to any third party.
Cravy automatically selects the most appropriate payment provider based on your location. We determine your region using the following signals in order of priority:
Users in Ghana and Nigeria are routed to Paystack. Users in the EU, UK, US, Canada, Australia, and other supported regions are routed to Stripe. This selection happens on your device and the locale data is not stored on our servers.
Account data is retained while your account is active and deleted within 30 days of an account deletion request. Order history is retained for 7 years for financial and legal compliance. Messages are retained for 12 months and then automatically deleted. Location data is not stored persistently beyond your saved addresses. GPS coordinates used for matching are not logged. Search history is retained for 12 months for personalisation and then deleted. Payment session data is retained for 7 years for financial compliance. Video editing preferences such as audio volume and music trim settings are stored as part of the feed item and retained for as long as the post exists.
Depending on your location you may have the right to: access a copy of the personal data we hold about you; request correction of inaccurate data; request deletion of your account and personal data; receive your data in a machine-readable format; object to processing based on legitimate interest; ask us to restrict processing in certain circumstances; and withdraw consent for any processing based on consent such as push notifications.
To exercise any of these rights, contact us at admin@cravy.eu or use the in-app support chat. We will respond within 30 days.
GDPR users in the EU and EEA have the right to lodge a complaint with their local data protection authority.
Users in Ghana and Nigeria: we comply with the Ghana Data Protection Act 2012 and the Nigeria Data Protection Regulation (NDPR).
All data in transit is encrypted using TLS and HTTPS. Database access is protected by Row-Level Security so users can only access their own data. Payment data is handled by PCI-DSS compliant providers Stripe and Paystack. Biometric data never leaves your device. We use idempotency keys and webhook signature verification to prevent payment fraud. Tickets are encrypted to prevent forgery. Video content uploaded to the feed is stored in Supabase Storage with access controls.
Cravy is not directed at children under 13 or under 16 in the EU. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at admin@cravy.eu and we will delete it promptly.
Your data is stored on Supabase infrastructure. If you are in the EU or EEA, your data may be transferred to and processed in countries outside the EEA. Where this occurs, we rely on Standard Contractual Clauses or equivalent safeguards.
We may update this policy from time to time. We will notify you of material changes via push notification or email. Continued use of the app after changes constitutes acceptance.
Cravy
Email: admin@cravy.eu
Website: cravy.fi