Privacy Policy

1. Who we are

NamibiaGo is a mobile app for discovering, booking and navigating travel in Namibia. The person responsible for your personal data — the data controller — is:

Because we are established in the European Union, the EU General Data Protection Regulation (GDPR) applies to everything described here, wherever in the world you use the app. Namibian users additionally have the privacy protections of Article 13 of the Namibian Constitution.

We have not appointed a Data Protection Officer — we are not required to. Privacy questions go to privacy@namibiago.com, and we answer within 30 days.

2. What we collect

We only collect data you give us or that the app needs to function. Specifically:

Everyone with an account

• Account data — your email address, display name, and profile photo if you add one. If you sign in with Google or Apple, we receive your email address and name from them; we never receive your Google or Apple password.
• Bookings— what you booked, dates, number of guests, any notes or special requests you write, and the booking's status.
• Payment records — amount, currency, status, and the reference our payment processor gives the transaction. We never see or store your card number — card details go directly from your device to Stripe.
• Messages — the content of messages you exchange with a business through the app.
• Reviews — your rating, your written review, and your display name. Reviews are public.
• Road reports — the road, your description, any photos you attach, and your display name. Road reports are public.
• Trips and saved items — the itineraries you build and the places you save.
• AI trip planner input — the preferences and trip description you type when you ask the planner to generate an itinerary, plus the itinerary it returns.
• Push notification token — if, and only if, you allow notifications. This identifies your device installation so we can deliver a notification; it is not a device-tracking identifier we use for anything else.
• Technical data — device model, operating system version, app version, and the IP address recorded in our server logs when your app talks to our servers.

Businesses and hosts, in addition

• Business details — trading name, description, category, address, contact details, opening hours, and the photos you upload for your listings.
• Verification documents — identity documents and business registration documents you upload so we can verify who you are before your listing goes live.
• Payout details — account holder name, bank, branch code and account number, so we can pay you what you have earned.

What we deliberately do not collect

• No GPS or precise location. The app never asks for location permission and never records where you are. Maps show places, not you.
• No advertising identifiers, no ad networks, no cross-app or cross-site tracking.
• No third-party analytics or behavioural profiling SDKs.
• No card numbers, CVCs or bank credentials on our servers.
• No access to your photo library or camera unless you tap to attach a photo, and then only for the photo you choose.
• No special-category data (health, religion, political opinions, biometrics) — please do not put any into reviews, messages or road reports.

3. Why we use it, and our legal basis

Where we rely on legitimate interests, we have weighed our interest against your rights and privacy. You can object at any time — see Your rights.

We do not use your data for advertising, we do not sell it, and we do not make automated decisions that produce legal effects for you. The AI trip planner writes suggestions; it decides nothing about you.

4. Who we share it with

We share the minimum necessary, with the following categories of recipients. Each processor acts on our instructions under a data processing agreement.

We will also disclose data where we are legally compelled to — a valid court order, a regulator, or to establish or defend a legal claim — and if the business is ever sold or transferred, in which case you will be told before your data moves.

5. International transfers

Some of our processors are based outside the European Economic Area, principally in the United States. Where data leaves the EEA we rely on the European Commission's Standard Contractual Clauses, and, where applicable, the processor's certification under the EU–US Data Privacy Framework. Namibia has no EU adequacy decision, so transfers of your data to a Namibian business you book with are made under Article 49(1)(b) GDPR — the transfer is necessary to perform the booking contract you asked for.

You can ask us for a copy of the safeguards in place at privacy@namibiago.com.

6. How long we keep it

Stripe keeps its own record of payments it processed, for as long as its own legal obligations require. That is outside our control and survives deletion of your NamibiaGo account.

7. Your rights

Under the GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct anything inaccurate.
• Erasure — have your data deleted.
• Portability — receive your data in a structured, machine-readable format.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — for example, turn off push notifications at any time in your device settings. This does not affect processing done before you withdrew.

You can exercise most of these yourself, immediately, inside the app:

• Profile → Settings → Export My Data — access and portability.
• Profile → Settings → Delete Account — erasure. See how account deletion works.
• Profile → Edit Profile — rectification.

For anything else, email privacy@namibiago.com. We respond within 30 days and never charge for a first request.

If you think we have handled your data badly, please tell us first — but you always have the right to complain to a supervisory authority. Ours is the Comissão Nacional de Proteção de Dados (CNPD) in Portugal, and you may also complain to the authority where you live or work.

8. How we protect your data

• All traffic between the app and our servers is encrypted in transit (TLS).
• Data is encrypted at rest by our hosting provider.
• Every database table is protected by row-level security, so one user's query cannot reach another user's rows.
• Card data never touches our servers — Stripe handles it directly.
• Access to production data is limited to what is strictly necessary to run the service.
• Payment webhooks are cryptographically signature-verified before they are trusted.

No system is perfectly secure. If a breach occurs that risks your rights and freedoms, we will notify the supervisory authority within 72 hours and tell you directly where the law requires it.

9. Children

NamibiaGo is not for anyone under 16. We do not knowingly collect data from children under 16. If you believe a child has given us personal data, email privacy@namibiago.com and we will delete it.

10. Changes to this policy

We may update this policy. The effective date at the top always tells you which version is current. If a change materially affects your rights, we will tell you in the app or by email before it takes effect — we will not change it quietly.

11. Contact

Privacy questions and rights requests: privacy@namibiago.com
Everything else: legal@namibiago.com