How VARS handles your data

Last updated: 17 August 2026

Who we are

VARS is an on-demand beauty and grooming marketplace connecting customers in Lagos with verified barbers, hair stylists, makeup artists, and nail technicians. We are a CAC-registered entity based in Lagos, Nigeria.

Data controller: VARS, Lagos, Nigeria. Contact: hello@bookwithvars.com.

This policy applies to the VARS mobile app (iOS and Android), the website at bookwithvars.com, and all related services.

VARS has appointed a Data Protection Officer. Data protection queries can be directed to hello@bookwithvars.com.

What we collect

Customers

Name and phone number when you create your account, verified by a WhatsApp code
Email address, if you choose to add one for receipts and updates
A secure payment token when you verify a card through Paystack (not your full card number)
Your GPS location when you set a booking location
Access details (building name, floor, flat number, gate code) when you confirm a booking
Booking history, reviews, and dispute details through your use of the platform

Vendors

Name, email address, and phone number at registration
A liveness face image captured during identity verification through Youverify, used to confirm your identity. VARS does not store your government-issued ID document; it is referenced by Youverify during the check only. VARS retains just the liveness image and the verification result. The raw liveness image is stored in a private, access-restricted file store; a cropped copy becomes your public profile photo (see below)
Profile photo, extracted from your KYC liveness check and locked to your account
Bank account details when you set up payouts (verified via Paystack)
GPS location while you are online (every 5 minutes for zone drift detection) and while en route to a booking (every 60 seconds for live tracking)
Service listings, portfolio photos, earnings, and booking history

Prospective vendors

Name, email address, phone number, and service type when you register interest on our website

We do not collect data from anyone under 18. We do not use advertising identifiers or third-party tracking for marketing purposes. The mobile app uses Sentry for crash reporting and PostHog as an analytics provider; both are configured to minimise data collection (crash reports only; screen capture is disabled). For full details, see our Cookie and Tracking Policy.

Why we collect it

Nigerian data protection law (NDPA 2023) requires a lawful basis for every type of processing. Here is how ours maps:

Creating and managing your account — contract
Processing bookings, payments, and refunds — contract
Vendor identity verification (KYC), including biometric data — explicit consent plus legal obligation
Verifying vendor bank accounts for payouts — contract
Location-based vendor discovery — legitimate interest (core platform function)
Live vendor tracking while en route to a booking — contract
Booking confirmations, reminders, and status updates — contract
Dispute resolution — contract and legitimate interest
Lead outreach to prospective vendors — consent plus legitimate interest
Fraud prevention and platform enforcement — legitimate interest

Where we rely on consent, you can withdraw it at any time (see “Your rights” below).

Who we share your data with

We share your data only with parties necessary to deliver the service. We never sell your data.

Between customers and vendors

When a booking is confirmed, the customer sees the vendor's name, photo, bio, services, and ratings. The vendor sees the customer's first name and service requested. Fifteen minutes before the appointment, both parties receive each other's phone number and the vendor receives the customer's access details. While the vendor is en route, the customer sees the vendor's live location on a map.

Service providers

Supabase — database hosting, authentication, file storage, and edge functions (United States and European Union)
Paystack — payment processing, card verification, vendor bank verification, and settlement (Nigeria)
Youverify — vendor identity verification including biometric liveness check (Nigeria)
Resend — email delivery (United States)
360dialog — WhatsApp message delivery (European Union)
Expo — push notification delivery via Apple APNs and Google FCM (United States)
Google — Maps API for vendor discovery and address lookup (United States)
Apple — push notification delivery via APNs (United States)
Vercel — website and admin panel hosting (United States)
Sentry — crash reporting and error monitoring in the mobile app (United States / EU). Enabled in production only. Collects stack traces and device context; no personal identifiers are explicitly sent.
PostHog — analytics provider in the mobile app (European Union, eu.i.posthog.com). Automatic event capture is disabled. No screen recordings or personally identifiable events are collected.

Each provider processes data under contract and only for the purposes stated. We disclose data to legal or regulatory authorities when required by Nigerian law or court order.

International transfers

Several of our service providers operate outside Nigeria. When your data is transferred internationally, we protect it through data processing agreements with each provider, transfer impact assessments where required, and standard contractual safeguards consistent with NDPC guidance.

How long we keep your data

Customer and vendor account data: your name, contact details, and photo are anonymised immediately when you delete your account. Records we are required by law to keep, such as the KYC, financial, and dispute records below, are retained for their stated periods regardless of account deletion
KYC records (ID documents and face images): 5 years after the end of the vendor relationship, as required by anti-money laundering law
Booking records and payment history: 6 years, as required by Nigerian tax law (CITA)
Payout and settlement records: 6 years
Dispute records: 6 years
Booking access details (building, floor, flat, gate code): deleted 30 days after booking completion or cancellation
Vendor GPS location: ephemeral; overwritten on each update, never stored as a historical trail
Reviews: life of the platform; anonymised to "VARS Customer" if you delete your account
Unconverted vendor leads: 24 months from last contact, then deleted

Your rights

Under the NDPA 2023, you have the following rights over your personal data:

Access — request a copy of the data we hold about you
Rectification — ask us to correct inaccurate or incomplete data
Erasure — ask us to delete your data; we will comply unless a legal obligation requires retention (for example, KYC records for 5 years, financial records for 6 years)
Restriction — ask us to limit processing while a concern is being resolved
Portability — request your data in a structured, machine-readable format
Objection — object to processing based on legitimate interest
Withdraw consent — where processing relies on your consent, you can withdraw it at any time; withdrawal does not affect processing that already took place

To exercise any of these rights, email hello@bookwithvars.com with enough detail to verify your identity. We will respond within 30 days.

To unsubscribe from marketing emails, use the unsubscribe link in any email we send.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Security

Our security measures include encryption in transit (TLS) and at rest, row-level security policies ensuring users can only access their own data, hashed passwords, HMAC-authenticated webhooks for payment and KYC callbacks, and access controls limiting each role to the minimum access needed. Service keys are server-side only and never exposed in client-side code.

If you believe your account has been compromised, contact us immediately at hello@bookwithvars.com.

Cookies and tracking

The VARS website uses only strictly necessary cookies. We do not use advertising cookies or cross-site tracking on the website.

The VARS mobile app uses Sentry (crash reporting) and PostHog (analytics) as described in the service providers section above. Neither tool is used for advertising or selling data. For full details, see our Cookie and Tracking Policy.

Changes to this policy

When we make material changes, we will notify you via the app or by email before the changes take effect. The "Last updated" date at the top reflects the most recent version. Continued use of VARS after a policy update constitutes acceptance.

Contact

Email: hello@bookwithvars.com

Data protection queries can be directed to the same address.