Privacy Policy

1. Data we collect

When you register, we collect your email, a protected password hash, country, state and city, account status and records of your acceptance of the Terms. If you enable two factor authentication, we store an encrypted authenticator secret and hashes of one-time recovery codes. Password reset links are stored only as hashes and expire. To make an offer and deliver an order, we collect your name, phone, address, postal code if supplied, offer amount, product, delivery destination and transaction history. Suppliers also supply their business and listing information. We record Paystack transaction references and verification status, shipping and tracking references, partner shipment events, security and login attempts, and technical request data needed to run and protect the service. You provide account, delivery and supplier details directly; payment and shipment updates come from Paystack and our delivery partner. We do not ask you to enter payment card details on our site; Paystack handles its hosted checkout.

Account and delivery details are required to register and transact; without them we may be unable to verify an account, calculate delivery, accept an offer or fulfil an order. Optional postal code and two factor authentication can be left blank or disabled.

2. Purposes and legal bases

We use account, offer, payment and delivery data to perform our contract with you, including verifying eligibility, processing offers, notifying the selected buyer, reconciling payment and arranging shipment. We use security records, fraud checks, account suspensions and service diagnostics for our legitimate interests in maintaining a fair and secure marketplace, balanced against your rights. We retain transaction records where legal, tax, accounting or consumer obligations require them. We send essential verification, offer, win, payment and account-status emails to administer the service. If we introduce optional promotional email, we will request a separate appropriate opt-in and provide a withdrawal method.

Expired unpaid wins may trigger an automated account suspension after we confirm that payment was not completed; initiated payments in uncertain states are held for review. You may ask us to review a decision and provide evidence of payment or an error.

3. Recipients and international transfers

We share only the information needed with Paystack to process and verify payment, our shipment partner to arrange delivery and provide tracking, email and hosting providers to operate the service, suppliers where needed to fulfil an order, and professional advisers or authorities when lawfully required. Providers may process data outside Nigeria. Where a transfer is subject to the Nigeria Data Protection Act, we apply a permitted transfer basis and appropriate safeguards, and assess the recipient and destination as required. Ask us for information about a particular transfer or safeguard.

4. Security and cookies

We use HTTPS in production, access controls, password hashing, protected session cookies, server-side payment checks and limited access to records. No system is risk free; report a suspected account issue promptly. We use an essential session cookie for sign-in, CSRF protection and site function. We do not currently use advertising or third-party tracking cookies in the application. Browser or payment provider pages may have their own privacy notices.

5. Retention

We keep information only as long as reasonably necessary for the purposes above and applicable legal duties. Unused verification links expire after 24 hours; password reset links expire after 30 minutes. Account and offer records are held while your account is active and as needed afterward for disputes, fraud prevention and legal claims. Payment, order and invoice records may be kept for the applicable tax and accounting period; security attempt records are kept for a shorter operational period. A suspended account is not immediately deleted when an unresolved payment or dispute remains. We review retained data, delete or de-identify it when no longer needed, and can explain a category’s retention period on request.

6. Your rights and choices

Subject to legal exceptions, you may request information about our processing, access or a copy of your data, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. You may withdraw any consent you gave for optional processing without affecting earlier lawful use. You may ask for human review of an automated suspension. We will verify identity before disclosing account data and respond within applicable legal timeframes. If you remain dissatisfied, you may complain to the Nigeria Data Protection Commission through its official channels.

7. Children and changes

This marketplace is intended for adults able to transact. We do not knowingly invite children to register or make offers. If we learn that a child has registered without a lawful basis, we will take appropriate steps to restrict or remove the data. We may update this notice as our services or law change; we will post the new effective date and provide additional notice for material changes where required.

8. Privacy contact

Send access requests, corrections, objections, deletion requests, payment-review requests or privacy questions to the contact address published by the marketplace operator. Please do not include passwords or card numbers. If the contact details are missing, the operator must complete the public contact information before opening registration.