Privacy Policy

1. Who we are

Bitvora Stores is operated by Bitvora Tech, Nigeria. We are the data controller for merchant account information. For the details customers enter when they order from a store, the merchant who runs that store decides how they are used, and we process them on the merchant's behalf.

2. What we collect

When you use Bitvora Stores, we collect:

• Account information: name, email, phone number, business name
• Identity details for merchants: your NIN (National Identification Number) and CAC registration number
• Plan and billing records: your plan, renewal dates, and payment status. Card details are handled by Paystack; we never see or store your card number.
• Store data: products, images, order history, customer details you enter
• Customer checkout information: name, phone, email, delivery address, order details
• Technical data: your IP address and basic device information, used for security

3. Why we use it, and our legal basis

We use your information:

• To provide the Service you signed up for, including your store, orders, and billing (performance of our contract with you)
• To verify merchants before their store goes live: a one-time SMS code for your phone, and a manual review of your NIN and CAC details (our legitimate interest in keeping fraud off the platform)
• To send account messages, such as SMS updates on your verification (performance of our contract)
• To prevent abuse, for example by limiting repeated sign-up and code requests from the same IP address (legitimate interest)
• To keep records the law requires, such as payment records (legal obligation)

We do not sell your personal data or use it for advertising.

4. Your NIN

We only use your NIN to confirm who is behind a store. Once we approve your details, we delete the full number and keep only its last 4 digits as a record that the check was done. Until then, it is visible only to you and to the Bitvora team members who review verifications. We never show it on your store.

5. Customer data

When a customer places an order on a merchant's store, their name, phone number, delivery address, and order details are stored and shown to that merchant so they can fulfil the order. Merchants must only use this data to handle the order and their relationship with that customer.

6. Who we share it with

We use these service providers to run Bitvora Stores. They only get what they need to do their job:

• Supabase (database and authentication)
• Cloudinary (image storage)
• Paystack (plan payments)
• Termii (SMS verification codes and account messages, which receives your phone number)
• Upstash (rate limiting, which processes IP addresses)
• Vercel and Cloudflare (hosting and anonymous visit analytics)
• WhatsApp (order messaging, only when a customer chooses to message a merchant)

Some of these providers store data on servers outside Nigeria. Where they do, we rely on their security commitments and contractual safeguards to protect it as Nigerian law requires. We may also disclose data when the law requires it.

7. Cookies

We use cookies that are needed for the Service to work, such as keeping you logged in and remembering your dashboard layout. Our visit analytics do not use cookies to track you across sites.

8. Data storage and security

We protect your data with access controls on our database, encrypted connections, and by limiting which team members can see identity details. No system is completely secure. If a breach puts your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours and tell you without undue delay.

9. How long we keep it

We keep your account and store data while your account is open. When you ask us to delete your account, we delete your store data and identity details within 30 days, except records that Nigerian law requires us to keep for longer, such as payment records.

10. Your rights

Under the Nigeria Data Protection Act 2023, you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct data that is wrong
• Delete your data
• Stop or limit how we use it, or object to a use
• Send your data to you or another service in a usable format
• Withdraw consent you have given, at any time

Email help@bitvoratech.com and we will respond within 30 days. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

11. Children

Bitvora Stores is not meant for anyone under 18, and we do not knowingly collect data from children.

12. Changes to this policy

We may update this policy from time to time. We'll note the "last updated" date above when we do, and tell merchants by email about significant changes.

13. Contact

Questions about your data? Reach us at help@bitvoratech.com.