This policy explains what personal data Nodaar Limited ("Nodaar", "we") collects when you use the Nodaar app, the Nodaar web stores (store.nodaar.com.ng) and nodaar.com.ng, why we use it, who we share it with, and your rights under the Nigeria Data Protection Act 2023 (NDPA). Nodaar is the data controller.
1. What we collect
Sellers (resellers and suppliers)
- Account details: full name, email, phone and WhatsApp number, password (stored only as a secure hash), and your role.
- Store or business details: store or business name, category, state and LGA, logo, and your store link.
- Products and content: product details, prices, photos and videos you upload, and reviews and replies.
- Verification (KYC): BVN or NIN, a photo of your government ID, a selfie taken with your camera, and for businesses your CAC number and certificate. These are used only to verify you, prevent fraud and meet financial rules.
- Bank and wallet: bank name, account number and account name for payouts, and your wallet and transaction history.
- Customers: the names, phone numbers and notes of your buyers that the app keeps for you.
- Support: messages you send to our support team.
Buyers
- Order details: name, email, phone number and delivery address you enter at checkout, what you bought, the amount and the payment reference.
- Returns: the reason and details you give when you report a problem.
- Reviews: your rating, comment and the name you choose to show.
Card and bank payment details are entered on Korapay's secure checkout. Nodaar never sees or stores your card number.
Collected automatically
- App: device type, operating system and app version, a push notification token, and error logs. The app does not use your GPS location. If you turn on fingerprint or face login, it is checked by your phone; we never receive your biometric data.
- Web stores: when someone opens a store we record the store, product and where the visit came from (for example WhatsApp or Instagram), without your name, so sellers can see which links bring sales. The web store also keeps your cart and where you came from in your browser's storage.
- Cookies and pixels: if you accept them, our websites load Google Analytics, the Meta (Facebook/Instagram) Pixel and the TikTok Pixel to measure visits and ads. See section 7.
2. Why we use it, and our legal basis
- To provide Nodaar (contract): creating your account and store, showing products, processing orders and payments, paying sellers, and sending order and account messages by in-app notification, push notification, email or WhatsApp.
- To keep Nodaar safe (legitimate interests and legal obligation): verifying identities, preventing fraud and abuse, checking listings, resolving disputes, measuring seller performance and keeping an audit trail of money actions.
- To meet the law (legal obligation): financial, tax and anti-money-laundering records, and requests from authorities.
- To improve Nodaar (legitimate interests): understanding how features are used, using data we have combined or made anonymous where possible.
- Marketing (consent or legitimate interests): tips and offers for sellers. You can opt out at any time. Ad cookies on our websites need your consent.
3. Who we share it with
- Buyers and sellers in an order: the supplier and reseller see the buyer's name, phone and delivery address so they can deliver. Buyers see the seller's store name and WhatsApp number. Public store pages show store names, products and reviews.
- Service providers who process data for us under contract: Korapay (payments, payouts and identity checks), Supabase (database, login and file storage), Google Firebase (push notifications), Resend (email), Meta WhatsApp Business (messages), our website hosting provider, and, if you accept cookies, Google Analytics, Meta and TikTok.
- Authorities when the law requires it, or to protect users from fraud or harm.
- A buyer of our business, if Nodaar is sold or merged, under this same policy.
We do not sell your personal data.
4. Where your data is stored
Some of our providers store data outside Nigeria (for example on cloud servers in Europe or the United States). When we transfer data abroad we rely on the safeguards allowed by the NDPA, such as contracts that require the provider to protect your data.
5. How we protect it
- Data is encrypted in transit (HTTPS) and access is controlled so users can only see their own data.
- Verification documents are kept in private storage that only authorised Nodaar staff can open.
- Large refunds need approval from a second admin, and money actions are logged.
No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.
6. How long we keep it
- Account and store data: while your account is open. When you delete your account we remove your profile, store, listings, contacts, bank details and verification documents within 30 days.
- Orders, payments and payouts: kept for 6 years for tax, accounting and dispute purposes, even after you delete your account.
- Store visit records: contain no name or contact details and are kept for up to 2 years.
- Support messages: up to 2 years.
7. Cookies and similar technology
Our websites use storage in your browser that is needed for them to work, such as your cart and your login on the admin site. With your permission they also use analytics and advertising cookies (Google Analytics, Meta Pixel, TikTok Pixel) that tell us which ads and links bring visitors and sales. The first time you visit we ask whether you accept these. You can change your choice any time with the "Cookie settings" link in the website footer, or by clearing your browser's site data.
8. Your rights
Under the NDPA you have the right to:
- be told how your data is used (this policy);
- get a copy of your data, and receive it in a portable format;
- correct wrong data (most details can be edited in the app);
- ask us to delete your data (see Delete your account);
- object to or restrict some processing, and withdraw consent at any time;
- not be subject to decisions made only by automated means that seriously affect you, without a way to ask a person to review them;
- complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Email nodaarltd@gmail.com with the subject "Privacy request". We may ask you to confirm your identity and will reply within 30 days.
9. Children
Nodaar is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.
10. Changes to this policy
We will update this policy when our practices change and tell you in the app or by email about important changes. The date at the top shows the latest version.
11. Contact
Nodaar Limited () · · Email: nodaarltd@gmail.com · WhatsApp: +234 703 495 6393