Legal

Privacy Policy

Last updated 27 October 2026

In short

We collect only what SellPlaza needs to work: your account, your shop, the records you keep, and the details shoppers give when they order or pay.
We don’t sell personal data, show ads, or use tracking or analytics cookies.
Card details go straight to Paystack, our payment processor. We never see them.
You can ask us for a copy of your data, to correct it, or to delete it, under the Nigeria Data Protection Act 2023.

1. Who we are

SellPlaza (sellplaza.com.ng) is operated by {{LEGAL NAME}}, {{BUSINESS ADDRESS}} (“SellPlaza”, “we”, “us”). For anything in this policy, contact us at {{CONTACT EMAIL}}.

2. Who this policy covers

Sellers: people who create a SellPlaza account to run their shop.
Shoppers: people who browse a SellPlaza shop, place an order or pay through it.
Sellers’ customers: people whose details a seller records, for example for a sale on credit.

3. Our role

For sellers’ accounts, SellPlaza decides how and why personal data is used, so we are the data controller.

A seller decides what to record about their own customers: names, phone numbers, sales and debts. For those records, the seller is the data controller, and SellPlaza processes them on the seller’s behalf as a data processor. We look at these records only to run and support SellPlaza (see section 10). If you are a seller’s customer, please contact the seller first about your details. We will help them respond.

4. What we collect

From sellers

Account details:
- Your email address.
- Your password, which we store only in scrambled, one-way form (salted hashing with scrypt), so even we can’t read it.
- Your Google account ID and email, if you sign in with Google.
Shop details:
- Your shop name, tagline and shop link.
- Your WhatsApp number and location.
- Bank details you choose to show shoppers for transfers.
- Opening hours, delivery areas and social media handles.
- Your logo, cover photo, product photos and videos.
Business records:
- Products, prices, costs and stock.
- Sales, expenses and payments.
- The names and phone numbers of customers you record.
Payout account (if you turn on online payments): the bank, account number and account holder’s name, as confirmed by Paystack.
Support notes: notes our staff write about your account when they help you, for example after a call. You can ask to see them.

From shoppers

Order details: your name, WhatsApp number, delivery area, any note you add, and the items you order. The shop you order from sees them, to confirm your order, remind you about payment and arrange delivery.
Online payment details:
- The email address you give for your payment receipt.
- The payment’s reference, amount, status and method (for example card or transfer).
- Your card or bank details go to Paystack, not to us.

From people who report a shop

Your report: the reason you choose, what you tell us happened, and the email address or phone number you give if you’d like us to reply. Only SellPlaza staff see reports. We don’t share your details with the seller.

From everyone

Technical data: your IP address, used to protect SellPlaza from abuse (for example, to limit repeated sign-in attempts), and error logs that help us fix problems.
Shop statistics: when you open a shop or a product, or add something to your bag, we add one to that shop’s and that product’s daily counts of visits, views or items added. We don’t record who you are, and the seller sees only the totals.

5. How we use it

To provide SellPlaza:
- your account and your shop’s records;
- your public storefront and product links;
- orders and debt payment links.
To send account emails: confirming your address, password resets, and security notices such as an email change.
To process online payments through Paystack, and to pay sellers through their linked bank accounts.
To show sellers how their shop is doing: daily totals of visits, product views, items added to bags and orders.
To keep SellPlaza secure:
- to prevent fraud and abuse;
- to back up data so it can be restored after a failure.
To meet legal obligations and respond to lawful requests.

We do not sell personal data, use it for advertising, or make decisions about you based solely on automated processing.

6. Our legal bases

Under the Nigeria Data Protection Act 2023 we rely on:

Contract: to provide the service you sign up for, or to process the order or payment you make.
Legitimate interests: to keep SellPlaza secure and reliable, and to prevent fraud.
Consent: where you choose optional features, such as signing in with Google. You can withdraw consent at any time.
Legal obligation: where the law requires us to keep or disclose information.

7. Who we share it with

When you order from a shop, its seller sees your order details, including your WhatsApp number.

We use trusted service providers to run SellPlaza. They may use personal data only to provide their service to us.

Provider	What for	Where
Hostinger	Hosting the SellPlaza servers and database	Europe
Paystack	Processing online payments and paying sellers. Paystack’s own privacy policy also applies to payment data.	Nigeria
Resend	Sending account emails	United States and Europe
Backblaze	Storing backups, which we encrypt before they leave our servers, so Backblaze cannot read them	United States
Google	Signing in, only if you choose “Continue with Google”	Global

WhatsApp: when you tap a WhatsApp button, SellPlaza opens WhatsApp on your device with a message ready for you to send. SellPlaza doesn’t send it or receive a copy. WhatsApp’s terms and privacy policy apply to messages you send there.

We may also disclose personal data:

where the law requires it;
to protect the rights, property or safety of our users or others;
to a successor if SellPlaza is sold or reorganised, under the same protections.

8. Transfers outside Nigeria

Our servers are in Europe. Our email provider and our off-site backups, which are encrypted, are in the United States. Where personal data leaves Nigeria, we transfer it only as the Nigeria Data Protection Act 2023 allows, relying on the data protection laws where it is stored and our providers’ contractual safeguards.

9. How long we keep it

Data	Kept for
Your account, shop and business records	While your account is open. When you ask us to delete it, within 30 days.
Backups	14 days on our servers, and 30 days off-site. Deleted data disappears from backups within that time.
Signed-in sessions	90 days after your last visit, and never more than a year
Password reset links	30 minutes
Email confirmation links	24 hours
Debt payment links	30 days
Reports about a shop	While the shop’s account is open

We keep information longer only where the law requires it, for example for tax or to settle disputes.

10. How we protect it

All connections use HTTPS.
Passwords, and the codes in sign-in sessions and emailed links, are stored only in scrambled, one-way form.
The app runs with only the access it needs.
Only a few authorised SellPlaza staff can see account and shop records, including sellers’ products, sales, customers and debts, and only when needed to give support, handle billing, keep SellPlaza secure or meet a legal duty. Every change staff make to a shop, such as its plan or hiding it from buyers, is logged.
Backups are encrypted before they leave our servers.

No system is perfectly secure. If a breach puts your rights at risk, we will notify the Nigeria Data Protection Commission, and you where the law requires.

11. Your rights

Under the Nigeria Data Protection Act 2023, you can ask us to:

give you a copy of your personal data;
correct data that is wrong or incomplete;
delete your data;
restrict or object to how we use it;
give you your data in a reusable format. Sellers can also download their records as CSV files at any time.

You can also withdraw any consent you have given, at any time.

Email {{CONTACT EMAIL}} and we will respond within 30 days. If you’re not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

12. Cookies and browser storage

SellPlaza uses only what it needs to work and to count shop visits, and nothing for advertising or for following you across other websites:

Sign-in cookie (sp_session): keeps sellers signed in.
Google sign-in cookie (sp_google): lasts 10 minutes, only during a Google sign-in.
Your browser’s storage:
- your shopping bag, saved separately for each shop;
- your latest order receipt;
- the payment link’s code while you pay a debt. This is cleared when you close the tab.
- notes of the shop and products you’ve opened, so each is counted once. These are cleared when you close the tab.
This stays on your device.

13. Children

SellPlaza is not intended for anyone under 18, and we do not knowingly collect their personal data.

14. Changes to this policy

If we make an important change, we will tell sellers by email or in the app before it takes effect. The date at the top shows when this policy last changed.