Draft — under legal review. This document may still change before NairaBio launches.
Privacy Policy
What personal data NairaBio collects about buyers and sellers, why, who we share it with, how long we keep it, and your rights under the Nigeria Data Protection Act 2023.
The short version
- We collect what we need to run shops, take payments, deliver orders and keep people safe from fraud. We don’t sell personal data and we don’t show ads.
- Card and bank details are handled by our payment partner, Bachs. We never see your card number.
- We never keep a seller’s full NIN or BVN: only the result of the check and the last 4 digits. ID photos go straight to Bachs and aren’t stored by us.
- Messages go by WhatsApp (Meta) and email (Resend). Photos are stored with Cloudinary.
- We only use essential cookies, to keep sellers logged in.
- You can ask to see, correct or delete your data: write to [DPO CONTACT].
1. Who is responsible for your data
NairaBio is run by Sentri Digitals Ltd (trading as NairaBio) (RC 8992567), Ogun State, Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (NDPA).
Our Data Protection Officer can be reached at [DPO CONTACT]. For anything else, write to [SUPPORT EMAIL: support@nairabio.com — confirm].
Sellers are controllers too. When you buy from a shop, the seller gets your name, WhatsApp number and (for deliveries and home services) your address so they can fulfil your order. The seller is responsible for how they use it. Sellers must use it only for your order.
Platform collection. While a new seller’s ID is being checked, NairaBio collects their buyers’ payments on its own Bachs account. For those payments we are also responsible for the payment records that Bachs shares with us.
2. What we collect
If you buy (no account needed)
- Order details: your name, WhatsApp number, delivery address (if the item is delivered), what you bought, prices, delivery zone and order status.
- Booking details: your name, WhatsApp number, the time you booked, notes you add, and your address for home services.
- Payment details from Bachs: whether and when you paid, the amount, the method, and the payment reference. Bachs’ payment page asks for your email, and its payment notifications can include your email, name and the name and bank of the account a transfer came from. We never receive card numbers.
- Problem reports: what went wrong, your description, photos you upload, what you asked for, and, for transfer refunds, the bank account (bank, number and name) you want the refund paid to.
- Find my order: your WhatsApp number and a one-time code.
- On your phone: your bag and links to your recent orders are kept in your browser’s storage on your phone, not on our servers, until you clear them.
If you sell
- Account: shop name, link (handle), what you sell, WhatsApp number, email, and the record of what you agreed to (which terms, version, time and IP address).
- Shop: bio, profile photo, Instagram, TikTok and public WhatsApp details, product and service listings and photos, digital files you sell, prices, stock, delivery zones, pickup address, opening hours and booking rules.
- Payout account: bank, the name on the account (as the bank reports it) and the last 4 digits of the account number. The full number goes to Bachs, which pays you.
- Identity (NIN): your NIN, date of birth, address and a photo of your ID are sent to Bachs for checking. We keep only the result, the last 4 digits of your NIN, the name checked, and Bachs’ reference. We don’t keep your date of birth, address or the ID photo.
- BVN and CAC (if you level up): your BVN is sent to Bachs; we keep only the result and the last 4 digits. For CAC we keep the last 4 digits of the RC number and your business name.
- Money: sales, fees, held and available balances, payouts, refunds, amounts owed and card disputes.
- Devices: a label for each logged-in device (for example “Chrome on Android”), when it was last used and when its login expires.
Everyone
- Technical data: IP address, browser and device type, and the pages requested, used for security, rate limits and fixing problems. When you report a payment link we store a scrambled (hashed) version of your IP address, not the address itself.
- Messages: a record of the WhatsApp messages and emails we send you (login codes are removed from the record).
- Support: what you tell us when you contact us.
3. Why we use it, and our lawful bases
The NDPA lets us use personal data only for a lawful reason. Ours are:
| What we do | Lawful basis |
|---|---|
| Create and run seller accounts, log you in by code, show shops, take payments, send receipts and order updates, pay sellers out | Contract (to provide the service you asked for) |
| Check sellers’ identity, apply limits, keep financial and tax records, answer lawful requests from regulators and courts | Legal obligation |
| Prevent fraud and abuse, secure accounts, rate-limit requests, investigate reports, handle disputes and card disputes | Legitimate interests (keeping buyers, sellers and NairaBio safe) |
| Improve NairaBio using totals and counts (for example how many orders a day) | Legitimate interests |
| WhatsApp messages to sellers about their shop | Consent, given when you claim your link (you can withdraw it, see section 8) |
Automated decisions. Some decisions are made automatically: whether a payment is within a shop’s limits, whether an identity check passed (Bachs decides), and whether a shop pauses after a refund has been owed for 14 days. You can ask a person on our team to review any of these.
5. Data sent outside Nigeria
Some of the providers above store data outside Nigeria (for example in Germany, the European Union and the United States). We only send personal data abroad where the NDPA allows it: to countries or organisations with adequate protection, under contracts with data protection safeguards, or where it’s needed to perform our contract with you (for example, to send you a WhatsApp code). You can ask us for details of the safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| One-time login and confirmation codes | 10 minutes (only a scrambled copy is stored) |
| Seller login sessions | 90 days from login, or until you log out |
| Seller account and shop details | While your account is open, then [ACCOUNT RETENTION: e.g. 2 years after closing — confirm] |
| Old shop links (handles) | Kept so nobody else can take your old link and pose as you |
| Orders, bookings, payments, payouts, refunds and the money ledger | [FINANCIAL RECORDS RETENTION: e.g. 6 years — confirm against tax and AML rules] |
| Identity check results (last 4 digits, result, reference) | [IDENTITY RETENTION: confirm] after the account closes. Full NIN, BVN, date of birth, address and ID photos are never stored by us |
| Raw payment notifications from Bachs | [WEBHOOK RETENTION: target 90 days, then personal details removed — confirm the job is live] |
| Problem reports, photos and refund bank accounts | Until the dispute and any refund are settled, then with the order records |
| Records of messages sent | [MESSAGE LOG RETENTION — confirm] |
| Find my order | Shows orders from the last 365 days |
When we no longer need data we delete it or make it anonymous. We may keep it longer if the law requires it or if it’s needed for a legal claim or an investigation.
8. Your rights
Under the NDPA you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that’s wrong or incomplete;
- delete your data, where we don’t need to keep it;
- stop or limit using it, or object to how we use it;
- give you your data in a common, machine-readable format, or send it to someone else;
- have a person review an automated decision;
- withdraw consent you gave (for example to WhatsApp messages). This doesn’t affect what we did before, and we may then need to use email instead or, for logins, stop the service.
Write to [DPO CONTACT] from the WhatsApp number or email linked to your order or shop, so we can confirm it’s you. We’ll reply within 30 days. It’s free unless a request is clearly unfounded or excessive.
Some data we must keep even if you ask us to delete it, for example payment and tax records, or records needed for a dispute.
9. How we protect it
- Everything travels over HTTPS. Our database isn’t reachable from the internet.
- Login codes and session tokens are stored only as scrambled (hashed) values.
- Full NIN and BVN numbers, dates of birth and ID photos are not stored by us at all.
- Buyers’ addresses and refund accounts are shown only to the seller of that order and to our staff who need them.
- Our staff sign in with a password and a second factor, have only the access their role needs, and every action they take is logged.
No system is perfectly secure. If a breach puts your rights at high risk, we’ll tell you and the Nigeria Data Protection Commission (NDPC) as the law requires.
10. Children
NairaBio is not meant for children. Sellers must be 18 or over. We don’t knowingly collect data from anyone under 18 without a parent or guardian’s consent. If you think a child has given us personal data, tell us and we’ll delete it.
11. Complaints
If you’re unhappy with how we’ve handled your data, please tell us first at [DPO CONTACT]. You also have the right to complain to the Nigeria Data Protection Commission (NDPC): ndpc.gov.ng.
12. Changes to this policy
We’ll update this policy when what we do with data changes. The date and version at the top show which edition you’re reading. If a change matters to you, we’ll tell sellers by WhatsApp or email before it applies.