Privacy Policy
We collect only what we need to run orders, deliveries and payments, and we never sell your data. This policy follows the Nigeria Data Protection Act 2023 (NDPA). EA.TSAMBI ENTERPRISES is the data controller.
1. What we collect
| Who | Information | Why |
|---|---|---|
| Everyone | Name, email, phone number, password (stored by Google Firebase, never seen by us), and an optional profile picture that only you can see in the app (remove it any time in Account) | Create and secure your account |
| Customers | Delivery address and map location, orders, wallet top-ups, refunds, reports and their photos | Deliver orders, take payment, resolve problems |
| Sellers | Shop name, business address and type, products and photos, bank account number and name | List products, pay you, confirm the bank account is yours |
| Riders | Vehicle type, location while using the rider app, trips, bank account number and name | Assign nearby deliveries, pay you |
| Admins | Sign-in times, device and actions taken in Admin | Security and accountability |
| Everyone | Device notification token, basic technical data (app version, IP address for abuse limits) | Send order updates, stop attacks |
We do not collect card details. Card payments are handled entirely by Paystack.
2. Our legal basis
- Contract: to provide orders, deliveries, wallet and payouts you ask for
- Legal obligation: to keep financial records and respond to lawful requests
- Legitimate interest: to prevent fraud and abuse and keep the app secure
- Consent: for optional things such as notifications and camera access, which you can turn off in your phone settings
3. Who we share it with
| Service | What they receive | Purpose |
|---|---|---|
| Sellers | Your name and the items ordered | Prepare your order |
| Riders | Your name, phone, delivery address and location | Deliver your order |
| Paystack | Payment details, and sellers' and riders' bank account numbers | Take payments, confirm bank account names, send payouts |
| Google Firebase | Account and app data | Sign-in and database |
| Vercel | App data in transit and encrypted daily backups | Run our server and store backups |
| Expo | Notification token and message | Send push notifications |
| AI services (DeepSeek or Anthropic) | Product photos and text sellers choose to send | Suggest product details for listings |
Some of these providers store data outside Nigeria. We use only well-known providers with security safeguards, as the NDPA allows. We share information with authorities only when the law requires it.
4. How long we keep it
- Your account: while it is open. When you delete it, sign-in is locked at once, and your personal details are erased after 7 days.
- Order and payment records: kept for accounting and tax, but with your name, phone and address removed.
- Backups: encrypted, kept for 30 days, then deleted automatically.
- Admin activity log: kept for 12 months.
5. How we protect it
Data is sent over encrypted connections. Backups are locked with encryption. Access to Admin is limited, logged and protected by two-step verification. No system is perfect, and if a breach affects you, we will tell you and the Nigeria Data Protection Commission (NDPC) as the law requires.
6. Your rights
Under the NDPA you can ask to:
- See the personal data we hold about you
- Correct wrong details
- Delete your account and data (you can do this yourself in Account → Delete account)
- Object to or limit some uses, or withdraw consent
- Receive a copy of your data in a common format
Contact us at eatsambienterprise@gmail.com or 07063587442. We will reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).
7. Children
CommunityMarket is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has an account, contact us and we will remove it.
8. Changes
We will tell you in the app before important changes to this policy take effect.