Corridor
Privacy Policy

Corridor (app id com.bluehydra.corridor) is developed and published by Bluehydra, a software development agency operating from Nigeria. We are the data controller for information collected through the app.

Contact us at bluehydra001@gmail.com.

Corridor is only open to people with a verified work email, so everyone you ride with is a fellow professional. Here is everything we store, and who inside the app can see each part.

Some small things are kept only on your phone and never sent to us: where you last started a ride (to fill in the next one), your app theme, and whether you have seen the introduction.

Corridor does not:

• →Track your live location. The app asks for location only to show where you are on your own map. That position stays in memory on your phone while the map is open. It is never stored, never sent to our servers, and never shown to anyone else.
• →Ask for your phone number. Phone numbers are also refused in the trip chat, ride notes, car descriptions and display names, so they cannot leak through the app.
• →Use profile photos. Your initials are your only avatar.
• →Access your contacts, photos, camera, microphone or files.
• →Contain advertising, ad SDKs or third-party analytics that track you.
• →Sell, rent or share your personal information with data brokers or advertisers.
• →Process payments. A fuel contribution is paid by the rider straight to the driver. Corridor never touches the money.

• →To create your account, sign you in, and confirm through your work email that you work where you say you do.
• →To show tonight’s rides, let drivers post rides and riders take seats, and let people on the same ride chat and find each other.
• →To show a rider the driver’s bank details for a paid ride, so they can pay the fuel contribution directly.
• →To send ride alerts, such as a seat being taken, a ride leaving, or a ride being cancelled.
• →To investigate reports, keep a safety record of rides, and block people or company domains that break the rules.
• →To answer you when you contact support.

We do not use your information to build advertising profiles, and we do not make automated decisions that have legal or similarly significant effects on you.

Where the Nigeria Data Protection Act 2023 or the UK/EU GDPR applies, we process your data to provide the service you signed up for (contract), on your consent where you give it (for example, location and notification permissions), and in our legitimate interest in keeping riders and drivers safe and the service secure.

We use a small number of providers to run Corridor. Each receives only what it needs for its job.

• →Supabase hosts the accounts and database, on our behalf and under contract.
• →Mapbox draws the maps and helps with place search and routes. It receives the map area on screen and the text you type into search.
• →Photon (Komoot), an OpenStreetMap search, also helps with place search. It receives only the text you type and a fixed point in Lagos, nothing about you.
• →Expo, Apple and Google deliver push notifications and app updates. They receive your phone's notification token and the alert text.
• →Google (Gmail) sends the work email verification code, so it handles your work email address and that code.
• →Google Maps opens only when a driver taps for directions. The ride's stops are passed to Google Maps at that moment.

Beyond that, we share information only where the law requires it, or where it is needed to establish, exercise or defend a legal claim, including a safety incident on a ride. If Bluehydra is ever acquired, data may transfer to the acquirer under the same commitments in this policy, and we will tell you before that happens.

Data is held on servers operated by our providers, which may be outside Nigeria, including in the European Union or the United States. Transfers rely on the safeguards those providers offer, such as standard contractual clauses.

All traffic between the app and our servers is encrypted with TLS. Database access is controlled by row-level security rules, so the app can only read what the table in section 2 allows. Bank details and old rides, for example, are refused to anyone not entitled to them. A small number of authorised Bluehydra staff can access records to investigate reports and keep the service safe.

Your profile, rides, seats, chat messages and bank details are kept while your account exists, so the people on a ride keep a record of it. Your drop off place has no history: each change replaces the last one.

For safety, we keep a private record of each ride (who drove, who rode, the car, and where it started and ended) and any reports, even after an account is deleted. These records are readable by nobody in the app, only by authorised Bluehydra staff, and exist so that a problem on a ride can be looked into later.

Deleting removes at once your profile, your rides, your seats, your chat messages, your bank details, your verified work email and any pending code. The safety records and reports described in section 8 are kept, and so is any block on your account, so deleting and signing up again is not a way round a block.

Your login (email and password) is not deleted by this, because the same login can sign you in to other Bluehydra apps. To remove the login too, email us as above. Uninstalling the app does not delete your account.

Depending on where you live, you can ask us to:

• →Confirm what personal data we hold about you and give you a copy in a portable format.
• →Correct information that is inaccurate or incomplete.
• →Delete your account and personal data, subject to the safety records in section 8.
• →Restrict or object to certain processing.
• →Withdraw consent you gave, without affecting processing already carried out.

Email bluehydra001@gmail.com and we will respond within 30 days. Users in Nigeria may complain to the Nigeria Data Protection Commission; users in the EU or UK may complain to their local supervisory authority.

Corridor is for working adults aged 18 and over with a work email. It is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has an account, contact us at bluehydra001@gmail.com and we will delete it.

If a security incident affects your personal data, we will notify you and the relevant supervisory authority within the timeframes required by law, and tell you what happened and what to do about it.

We will update this page when the app's data practices change, and the date at the top will change with it. If a change is material, for example if we begin collecting a new kind of data or use a new provider that receives ride or chat data, we will tell you in the app or by email before it takes effect.

Questions about this policy or about your data in Corridor: