Privacy Policy

1. What we collect

Account details you give us: your name, and an email address and password (the password is stored as a salted hash, never in plain text) or a mobile phone number, or both. If you sign in with your phone, we text you one-time codes; we store only a scrambled (hashed) copy of each code, for a few minutes. Vendor storefront details you choose to publish (business name, description, WhatsApp number, social links), order and payment records needed to fulfil a purchase, and any profile photo, banner or listing images you upload.

2. Sensitive personal data

Vendors who choose to verify their identity may give us a National Identification Number (NIN), Bank Verification Number (BVN), CAC registration number, a photo of an identity or business document, and a selfie. A selfie matched against an ID photo is biometric data, which the NDPA treats as sensitive personal data. We process it only with your explicit consent, only to verify you, and:

• NIN, BVN and selfie images are passed to our identity verification provider (Prembly or Smile ID) and are not stored by us; we keep only the result and the provider's reference number.
• Document photos you upload for manual review are stored in private storage that only our staff can open, and are never shown to buyers.
• Buyers only ever see which checks you passed (for example, “ID verified”), never the documents or numbers themselves.

3. How we use it, and why we may

To create and secure your account, sign you in, process orders and payments, and send you messages about them (codes, password resets, order confirmations). Our lawful bases are the contract between us (running your account and orders), your consent (identity verification, and anything optional), and our legitimate interest in preventing fraud on the platform. We do not sell your personal data.

4. Who we share it with

Only the providers we need to run the service, each for its own task:

• Payment providers (Flutterwave, Paystack, Stripe, Remita, OPay) receive what they need to process a payment you start.
• Termii, our SMS and WhatsApp provider, receives your phone number and the code we send.
• Meta (WhatsApp) receives your verified phone number and the WhatsApp messages we exchange with you: order updates and message alerts, which you can turn off on your account page or by replying STOP, and any stock list a vendor sends to our WhatsApp number to draft listings.
• Resend, our email provider, receives your email address and the email we send you.
• Prembly and Smile ID receive the identity details a vendor submits for verification.

Some of these providers process data outside Nigeria. Where they do, we rely on the safeguards the NDPA requires for transfers abroad. We don't share data with anyone else except where the law requires it.

5. Your rights

Under the NDPA you can ask for a copy of your data, ask us to correct or delete it, object to some uses, withdraw a consent you gave, and ask for your data in a portable form. You can deactivate your account at any time (Account settings → Danger zone); this is reversible by resetting your password or signing in with a code sent to your phone. You can also permanently delete your account, which scrubs your name, email, phone number and photo and cannot be undone. Deleting your account does not remove order records that a vendor you traded with, or we, must keep by law.

6. Cookies

We use essential cookies to keep you signed in (httpOnly, not readable by page scripts) and a non-essential cookie that remembers whether your connection looks slow, so we can show a lighter version of the site. Only if you choose "Allow" in the cookie banner, we also set an anonymous visit ID so we can measure how buyers use the service (for example, whether they come back); choose "Essential only" to refuse it.

7. Security and breaches

We protect your data with encryption in transit, hashed passwords and codes, and access limited to staff who need it. If a breach puts your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, you, within the time limits the NDPA sets.

8. Data retention & residency

[Retention period and hosting region to be confirmed before this goes live].

9. Data Controller

The data controller responsible for your personal data under the NDPA is Solvelean Africa Limited, registered in Nigeria (RC number to be confirmed), registered office: to be confirmed, which operates Stallcrest in Africa. The Stallcrest brand is owned by Solvelean Limited, registered in England and Wales (Company number 17514591), registered office: 4 Norfolk Street, Cambridge, England, CB1 2LF.

Privacy requests and questions: to be confirmed. Data Protection Officer: to be confirmed.

10. How to exercise your rights or complain

To ask for access, correction or erasure, contact to be confirmed. If you're not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).