Privacy policy
What we process, for whom, and why
1. Who we are
Anty Food is operated by Majesto Capital Limited (RC 908662), No. 14 Olayinka Biola Street, Lekki, Lagos State, Nigeria (“we”, “us”). Anty Food is a product of Anty Virtual, whose platform and engineering we use to run it. Questions about this policy go to hello@antyvirtual.com, or to the address above.
2. Whose data, and on whose behalf
Four kinds of people appear in Anty Food, and our role differs for each:
- A restaurant using Anty Food. The restaurant is the data controller of its customers’ data: it decides to take orders, what to keep and whether to send offers. We are its data processor and act on its instructions under our terms of service. For the restaurant’s own account, the people who sign in and its billing, we are the controller.
- A customer of that restaurant. Someone who orders on WhatsApp, on the restaurant’s storefront or at its counter. Your data belongs to the restaurant you ordered from. We hold it for that restaurant and use it for nothing else.
- A rider carrying orders. Here we are the controller.
- Someone who contacts us through this website. Here we are the controller.
3. What we process
For a restaurant’s customers
- On an order: your name as you give it, your phone number, the delivery address, what you ordered and when, the price, the payment status from the payment company (never your card or bank details, which go to the payment company directly) and the delivery’s progress.
- In a chat with the restaurant: the messages you send on WhatsApp and the replies, so the order can be taken and questions answered. An assistant drafts the replies; a person at the restaurant can take over at any time.
- In a rewards programme: the phone number the programme is keyed on, visits, points and rewards, if you chose to join.
- Feedback: what you type on a feedback card or form, if you leave any, and the fact that a review link was shown to you. We never read or hold the public review itself.
- Marketing consent: whether you said yes to offers, the exact words you agreed to, when, and by what route (section 5).
- Measurement: that somebody opened a restaurant’s storefront or started a conversation on a given day, and whether an order followed, so the restaurant can see how many enquiries become orders. This is recorded as a one-way code made from the phone number or the address and browser with a secret that changes every month, so the code cannot be turned back into you or matched from one month to the next; the phone number and address themselves are not written into that record.
For a restaurant
- The business name, address, the people who sign in and their email addresses and phone numbers, the WhatsApp number connected, the menu and prices, opening hours, the bank account that orders settle to (held by the payment company; we hold the account name and the last digits), and the invoices.
- Staff names and the PINs they use at the counter, stored as hashes.
For riders
- Name, phone, a photograph for customers to recognise you, the bank account for payouts, a National Identification Number for the identity check (held encrypted; the identity photograph is taken by the verification provider’s own screen and we keep the result, not the image), your position while you are carrying an order, and the record of each delivery.
On this website
- What you type into the contact form (restaurant name, area, your name and phone), and the ordinary server logs of a website: the address a request came from and the page asked for. We set no advertising cookies and run no analytics trackers on antyfood.com.
4. Why, and the lawful basis
| Purpose | Lawful basis under the Act |
|---|---|
| Taking, paying for, cooking and delivering your order, and telling you where it is | Performance of the contract you entered when you ordered |
| Service messages about an order: confirmation, a delay, a refund | Performance of that contract |
| Offers and news from the restaurant on WhatsApp or by text | Your consent, which you may withdraw at any time (section 5) |
| Keeping payment and settlement records, refunds and disputes | Legal obligation of the restaurant and of the payment company, and the contract |
| Preventing fraud and abuse, keeping the service secure | Our legitimate interest and the restaurant’s, balanced against yours |
| Showing a restaurant its own business: who orders, how often, what sells | The restaurant’s legitimate interest in running its business, on its instruction, using its own customers’ order history |
| Running a rider’s account, identity check and payouts | The contract with the rider, and legal obligation for the identity check and payments |
| Answering a message you send us on this website | Your request, and our legitimate interest in replying |
5. Marketing consent: how it is asked for, and how to stop it
A restaurant may only send you offers if you have said yes. We never treat an order as consent to marketing. Consent is asked for in one of these ways, and the exact sentence you agreed to is stored with the date, the route and a reference to the message or form:
- On WhatsApp, after an order is paid: the restaurant asks once, “May [the restaurant] send you offers on WhatsApp now and then? You can stop them any time by replying STOP. Your order is not affected either way.” Only a Yes is recorded as consent. No is recorded as a no, and you are not asked again.
- On a feedback card or form: an unticked box reading “Send me offers from [the restaurant] on WhatsApp or text. You can stop them any time.”
- When joining a rewards programme: a separate question with the same words. Joining the programme does not switch offers on; only a Yes does.
To withdraw consent, reply STOP to any message from the restaurant on WhatsApp, tell the restaurant, or write to us at hello@antyvirtual.com. The withdrawal is recorded with its date and no further offers are sent from that restaurant; ordering still works. A restaurant can also withdraw it for you from your record.
6. Payments
Payments are collected by a licensed Nigerian payment company (Monnify, a Moniepoint service). Your card or bank details go to them directly and we never see them. Each order’s payment is split at the point of payment and the restaurant’s share settles to the restaurant’s own bank account; money does not sit with us. The payment company keeps payment records under its own obligations and policy.
7. Where the data is held, and who else sees it
The platform is built and hosted by Anty Virtual, and runs on service providers that act as our sub-processors: the database and hosting (in the United States), the WhatsApp Business Platform (Meta), the payment company (Nigeria), the email sender, the identity verification provider for riders, and the language-model provider that drafts replies, which handles one message at a time and is contractually barred from training on it. The current list, with each provider’s location and the terms it holds our data under, is published and kept up to date at my.antyvirtual.com/trust/sub-processors. Where data leaves Nigeria it does so under those contracts, to providers that hold it under their published data processing terms.
Nobody else sees your data. We do not sell it, rent it, or share it with marketplaces or advertisers. A restaurant sees only its own customers. A rider sees the name, address and phone number needed to deliver your order, for that order.
8. How long we keep it
| What | Kept |
|---|---|
| Orders, chats and customer records held for a restaurant | While the restaurant is a client, or until the restaurant or you ask for them to go. A restaurant can delete a customer’s record itself. |
| Marketing consent and withdrawal | The record of what you agreed to, and when you stopped it, is kept so that no offer is sent after a STOP. |
| Payment and settlement records | For as long as the restaurant and the payment company must keep them under Nigerian financial and tax rules. |
| A restaurant’s account | While open; on closure the restaurant may export its customer list first, and the records are then removed on request. |
| Rider identity results and payout records | While the rider works with us and for as long afterwards as payment and identity rules require. |
| Contact form messages | Until the enquiry is dealt with and for a reasonable time after. |
| Storefront and conversation measurement codes | Ninety days; after that only the monthly totals per restaurant and channel remain. |
A deleted record survives in backups for up to seven days and is then gone.
9. Your rights
Under the Nigeria Data Protection Act 2023 you may ask to see the data held about you, have it corrected, have it deleted, object to or restrict its use, receive a copy in a usable form, and withdraw consent at any time without affecting what was done before. You may also complain to the Nigeria Data Protection Commission. For data a restaurant holds about you, ask the restaurant first, since it is the controller; if you cannot reach it, ask us and we will pass the request on and help carry it out. We answer within the time the Act allows.
10. Children
Anty Food is for adults placing orders. We do not knowingly process a child’s data, and a restaurant may not use it to market to children.
11. Changes
When this policy changes the date at the top changes with it, and a change that affects how your data is used is announced to restaurants before it takes effect.
12. Contact
Majesto Capital Limited, No. 14 Olayinka Biola Street, Lekki, Lagos State, Nigeria. Email hello@antyvirtual.com. Our registration with the Commission, NDPC/DCP/15692, can be checked on the Commission’s verification page.