Privacy policy

What we collect, and why

• Your name, so the other side of a job knows who they are dealing with.
• Your phone number, to sign you in and to reach you about a job. Artisans must give one. A customer who signs in with Google or an email can book without one.
• Your email, if you add one, to sign you in and to send receipts and job updates. If you set a password, we keep only a one-way scramble of it, never the password itself.
• Your Google account, if you sign in with Google. Google tells us your account ID, email, name and profile picture. We keep the ID and email to sign you in, and use the name and picture until you set your own.
• Your address and a map pin, to work out which artisan is nearest and to get them to your door. Your street, house number, postcode and map pin are released to the artisan only once they are on the way.
• Your bookings and payments, to run the service and because we are required to keep financial records. You type your card on Paystack's page, so we never see the card number. When you add money by bank transfer, the bank tells us the sender's name, bank, the last 4 digits of their account and the note they wrote on the transfer.
• What you write about a job: the job details, chats with the other side, quotes, problem reports and reviews.
• Photos, if you add them: your profile photo, and photos in a booking, a chat, a problem report or Help. We remove the location a phone writes into a photo before we keep it.
• What you send us in Help, the messages and photos, to answer you.
• Your BVN, only if Paystack asks for it to open your own account number for adding money by bank transfer. It goes straight to Paystack with your bank account, and we keep neither.
• That you agreed to our terms and this policy, and for an artisan the artisan agreement: which version, when, how you signed in or joined, and the version of the Duam app if you used it, so we can show what you agreed to. If an artisan signed on paper, also the signed copy and its photos.

For artisans we also hold identity details, where they work, and a guarantor if they name one. A person at Duam looks at these before approving an artisan. We also keep:

• Their NIN, checked but not stored. Our ID check service tells us the name on it. We keep that name and the last 4 digits. Once the NIN is confirmed we also keep a one-way scramble of it, which cannot be turned back into the number, so the same NIN cannot be used for a second artisan.
• Their guarantors: the name and phone number of one or two people who vouch for them, and how they know them. Their union and its chairman's number, if they give them.
• Their bank account: the bank, the account number and the name on it, to pay them. When they ask for parts money to go to a seller, the seller's bank account too.
• Where they work and a map pin, to send them jobs nearby.
• Their position on the way to a job, only after they tap On my way. The customer sees it on a map.
• Where their phone is at the door, when they tap I have arrived or report that the customer was not home, to check it is near the job's pin. We do not keep that position. A “customer not home” problem keeps how far it was from the pin.
• Photos of their workplace and their work, if they add them. Our staff look at them, and customers see them on the profile once the artisan is approved.
• Whether they are a woman or a man, only if they choose to say. It is optional. We use it to send jobs where the customer asked for a woman or a man, and it is part of their public profile, below.

From your phone or browser we also get:

• A push token, if you allow notifications: the address our notifications go to on that phone, and whether it is Android or iPhone.
• Your IP address and device details, for security. We count the tries from each IP address, so nobody can guess codes, passwords or searches without limit. We keep the device details each sign-in in the app came from, and the app tells us its version, so we can ask an old app to update.
• Error reports, when error tracking is on: what went wrong and the steps just before it, with the device model, its system and the app version. The app also sends a note each time it is opened, saying whether that use ended in a crash. They carry no name, and we remove phone numbers and emails from them before they leave.
• Map data, when a map is Google's. The map in the app is Google's, and Google collects device details, your IP address, a random ID, crash data and how you move the map, under its own privacy policy. When the website shows Google's map, your browser loads it from Google, which then sees your IP address and the part of the map on screen.

Who receives it

The other side of a job. A job is often offered to several artisans at once. Each of them sees the area, how far it is, and what you wrote about the job with its photos. The artisan who accepts also sees your landmark, and your street, house number, postcode and map pin once they are on the way. Once an artisan accepts a job, the customer sees their position on the way, but not their phone number. The two sides talk in the job chat, and both see it. Before 9 November 2026, the customer saw the artisan's number while the job was live, and the WhatsApp message that told them the artisan accepted gave it too, so a customer from before then may still have it. A review shows on the artisan's profile with the customer's first name.

Anyone. An approved artisan's profile is public: their name, photo, trades and prices, rating, jobs done, years of experience, area, union, what they wrote about themselves, when they joined, reviews with their replies, and work photos. It shows Duam's own “Did not turn up” marks beside the reviews, how often they take the jobs sent to them, whether they are free now, on a job or not taking jobs, and whether they take repeat jobs. It says when a Duam agent checked where they work, and whether they have a guarantor, but never the guarantor's name. It also carries whether they are a woman or a man, if they said, and a woman with no photo of her own gets a woman's face. Anyone can open it without signing in, and search engines list it.

An artisan's guarantor and union. A person at Duam may call a guarantor once, to ask whether they vouch for the artisan. After that, Duam calls them only if it cannot reach the artisan about a live job, or about a serious complaint. If Duam ends an artisan's agreement for taking customers off the app, it may also tell their guarantor and their union why.

Duam staff see what they need to run a job, check an artisan or decide a problem.

The services that run Duam for us. Each gets only what its part of the work needs:

• Paystack: card payments, and your own account number for bank transfers, with your name, email and number, and your BVN when it asks for one. It also pays artisans' cash outs and parts money to a seller, so it gets that bank account and checks the name on it.
• WhatsApp, and the service that sends our messages to it: your number and the words of each code and update we send you.
• Our email service: your email address and the emails we send you.
• Google: the maps, the place search on the website, Google sign-in, notifications to Android phones, and the street name for a pin and the road to a job, each when we use it.
• Our push notification service: your push token and the words of each notification, which it hands to Google or Apple to deliver.
• Our database and photo storage service: it keeps our records and the photos.
• Our web host: it runs our website and server, so every request passes through it.
• Our error tracking service: the error reports above, when error tracking is on.
• Our ID check service: an artisan's NIN, to tell us the name on it.
• A route service: an artisan's position and the job's pin, to work out the road, when we use it.
• The national postcode register: a pin, or the postcode you type, to find or check the postcode, when we use it.

Public map services. These are free services run by others, not by us. Our server asks them, so they do not see who you are:

• A public place search service: what you type in a place search in the app, or on the website when Google does not take it, with your rough area (about 11 km) so places near you come first. When Google does not name streets for us, a pin too, to find its street.
• Public route services: an artisan's position on the way and the job's pin, to work out the road between them.

When the website shows a map that is not Google's, your browser loads its map pictures from a free public map service, which then sees your IP address and the part of the map on screen.

Where it is kept. Our server and database are in the United Kingdom, and several of these services work from other countries, so what you give us is stored and handled outside Nigeria.

What we do not do

We do not sell your data, and we do not use it for advertising, except an artisan's photos if they say yes. We do not give your number to anyone outside a job, except the services above that carry our messages and payments. We do not use your address for anything except getting an artisan to it.

Cookies

We use cookies only to make Duam work. One keeps you signed in, for up to 30 days. Signing in with Google adds one for 10 minutes, to keep that sign-in safe. Duam staff have one more on the staff side. We use no cookies for advertising or tracking.

How long we keep it

These are the longest we mean to keep each kind of record. The automatic deletion that keeps to them is not switched on yet, so older records may still be held until it is:

• Codes we send you: 7 days.
• Links we email you, to confirm an email or reset a password: 7 days after they run out.
• Sign-ins: 30 days after they end. A sign-in lasts 30 days on the website and 90 days in the app.
• Push tokens: 180 days after the app last sent it to us.
• Counts of tries, by account or IP address: 7 days.
• Call records: 90 days. We do not record calls, only which two numbers a Duam line connected.
• WhatsApp messages we sent you: 12 months.
• Job conversations and their photos: 12 months after the job ends, whether it was paid, cancelled or never taken.
• Help conversations with Duam and their photos: 12 months after the last message.
• Fraud and safety flags, such as a phone number tried in a chat, a dropped job or a card dispute: 2 years, so the reason for a suspension outlasts any argument about it.
• An artisan's position on the way to a job: taken only after they tap On my way, and wiped when they arrive or the job is cancelled. If a problem is raised while they are on the way, the problem keeps their last position, to about 11 metres.
• Bookings, payments and receipts: at least 7 years, because Nigerian tax law requires it. No schedule deletes them.

Deleting your account

You can delete your account yourself in the app or on the website once nothing is still running on it: a booking or a job, money on its way or owed to Duam, or a problem Duam is deciding. An artisan also waits 48 hours after their last job, while its customer can still report a problem, and cashes out first when ₦1,000 or more is ready to cash out.

What goes at once:

• Your name, number, email, password, photo and Google sign-in.
• Your saved addresses, with their pins and postcodes. On a past booking only the area stays.
• Your help conversations and their photos, and the codes and email links we sent you.
• Your sign-ins and push tokens, so you are signed out everywhere.
• Any booking with no artisan yet, which is cancelled.
• The name and number on your referral code, and the name on your account number for adding money by bank transfer. We ask Paystack to close the account number itself. If it stays open, money sent to it later is held, not spent, and we send it back.
• For an artisan: the profile, photos, work photos, guarantors, union, the NIN name and last 4 digits, the bank account, whether they are a woman or a man, the pin and postcode of where they work, and the notes from their trade test. Customers can no longer find them.

What stays, and why:

• Bookings, payments, receipts and cash outs: at least 7 years, because Nigerian tax law requires it. No schedule deletes them. They keep what the job was, its notes and photos, the money and the area, but not your name, number or street. A bank transfer you sent keeps what the bank told us: the sender's name, bank, the last 4 digits of their account and the note on it, and the line on your statement keeps the sender's name. A cash out keeps the bank's name and the last 4 digits of the account it went to. Parts money sent to a seller keeps the seller's name, bank and account number.
• Problems reported on those bookings, Duam's decisions on them, and reviews: with the booking, for at least the same 7 years, so a decision can still be checked. A problem raised while the artisan was on the way keeps their last position, to about 11 metres. A “customer not home” problem keeps how far the artisan's phone was from the job's pin. A review you wrote stays on the artisan's profile without your name, with no end date, because it is part of their rating.
• Fraud and safety flags: 2 years, as above. They keep any name or number written in them, such as the name on a card top-up or a bank transfer, or the number somebody tried to join with.
• Call records, messages we sent you and job conversations stay until their own period above ends. The call records and messages keep your number until then. The WhatsApp message that sent the artisan to you keeps your house number, street, landmark and first name until then. For an address saved as a pin only, it keeps a map link to the pin instead.
• Messages we sent the other side of your jobs stay for their 12 months too. The offers keep the area, how far it was and what the customer wrote about the job, even for the artisans who did not take it. Those to the artisan on the job keep the customer's first name, and the reminders keep the area too. Those to a customer keep the artisan's name, and the one sent when the artisan accepted before 9 November 2026 keeps the number it gave to reach them.
• For an artisan, the one-way scramble of a confirmed NIN and when it was confirmed, with no end date, so the same NIN cannot join again, even after the artisan deleted the account themselves. Their ratings, job counts, trades, area and Duam's record of approving them stay on the record, which customers can no longer see. So do Duam's records of what staff did on the account, with the notes staff wrote, such as who saw their ID card, where and when, and any decision on whether they are a woman or a man, which names it.
• Our record that the account agreed to our terms and this policy, and for an artisan the artisan agreement, with the version, when, how and the app version, but not your name. It has no end date, so Duam can show what was agreed.
• If an artisan signed on paper, the signed copy and its photos, with their name. They have no end date either, for the same reason.
• What Paystack keeps: its own record of each card payment, cash out and account number for bank transfers, with the details it was given, under its own privacy policy. A card payment gives it your email, or one made from your phone number if you have none. Our record of your account number keeps Paystack's code for you, so a transfer that still comes in can be matched.
• Counts of tries, by account or IP address: 7 days, as above.

To delete your account:

• In the Duam app: open Account (or Profile, if you are an artisan), tap Delete my account, and confirm.
• On the website: sign in at https://app.duam.work/account (artisans at https://app.duam.work/provider/profile), choose Delete my account, and type DELETE.
• If you cannot sign in: email privacy@duam.work from your account's email, or tell us the phone number on it. We delete it within 30 days.

Who is responsible

Duam Artisans Limited is the data controller. Our Data Protection Officer is the company director, reachable at privacy@duam.work. If we have not dealt with a complaint properly, you can take it to the Nigeria Data Protection Commission.

Your rights

Under the Nigeria Data Protection Act you can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account. Email privacy@duam.work and we will act within 30 days. Some records must be kept for tax and anti-fraud reasons even after an account closes.