Privacy Policy
Effective: September 9, 2026
1. Data controller and contact
Naijack is the data controller for the processing described here. Privacy requests may be sent to privacy@naijack.com.
2. Information we process
We process account details such as name, email, phone number, state, login and security records; seller business details and optional identity or CAC documents; ads, buyer requests, photos, offers and reviews; in-platform and relayed WhatsApp communications; support, abuse and dispute reports; subscription, promotion and provider payment references; preferences, saved items and marketplace activity; and technical information such as IP address, device/browser data, timestamps and security events. We do not intentionally collect card numbers. Payment providers process payment credentials under their own notices.
Android app permissions and notifications
With your permission, the app uses the microphone for voice messages, the camera for photos and approximate location for nearby marketplace results. You can decline or change these permissions in your phone settings. Notifications use Google Firebase Cloud Messaging and a device registration token linked to your signed-in account. Photos, voice messages and other files you send are uploaded to Naijack to deliver them to the intended recipients. Firebase Analytics collection is disabled in the Android app.
3. Purposes and lawful bases
We process data to perform our contract with you, operate accounts and marketplace features, deliver messages, provide support and administer purchased services. We rely on legitimate interests to prevent fraud, secure the platform, moderate content, improve reliability and understand marketplace demand, after considering your rights. We process information where necessary to comply with Nigerian law, enforce legal claims or respond to lawful authorities. We rely on consent for optional analytics, advertising technologies and other activities where consent is required. You may withdraw consent without affecting earlier lawful processing.
4. Public information and recipients
Seller display names, storefront details, verification status, approved ads and buyer requests are public by design. Email addresses, verification documents and private messages are not public. We disclose only what is necessary to hosting, email, SMS, analytics, fraud-prevention, communications and licensed payment providers acting under appropriate terms; professional advisers; a buyer or seller involved in a transaction; and regulators, courts or law-enforcement authorities where legally required. Staff access is role restricted and recorded where supported.
5. International transfers
Some service providers may process data outside Nigeria. Before enabling such a provider, Naijack must document the destination, purpose, recipient, security measures and a lawful transfer basis under the Nigeria Data Protection Act 2023. Provider contracts must include confidentiality, security, deletion, incident reporting and data-protection obligations.
Phone sharing is optional and off by default. Sellers can allow buyers to view their profile phone number after a safety notice, and can turn sharing off in Account settings. We record who viewed a shared number and when for security and abuse handling. Turning sharing off cannot recall a number someone has already seen or copied. Ordinary phone calls happen outside Naijack; Naijack does not record their audio.
In marketplace chat, text checks identify common phone-number, payment, contact-sharing and abuse patterns to provide safety guidance. Detected phone numbers are concealed from ordinary chat, reply, notification and export displays. A participant may request one-time access to a sender’s own current profile number; the sender can approve or decline, and the recipient sees safety guidance before viewing. We store the request, decision and viewing time. Original messages remain stored for delivery, abuse handling and lawful requests under the retention rules below. These checks do not understand every wording, image or voice note and cannot guarantee fraud prevention.
6. Retention
Active account and marketplace information is retained while the service is provided. Deleted-account content is removed or anonymised within 30 days where feasible. Security logs are ordinarily retained for 12 months; support and abuse records for up to 24 months; and transaction, invoice, tax and payment reconciliation records for the period required by applicable law. Verification documents must be deleted when review, appeal, fraud-prevention and legal retention needs end. Information may be preserved longer for an active dispute, investigation, legal hold or statutory obligation, then securely deleted.
7. Your rights
Delete your Naijack account or request deletion without the app.
Subject to lawful limits, you may request access, correction, deletion, restriction, portability and information about recipients; object to processing based on legitimate interests or direct marketing; withdraw consent; and challenge a decision based solely on automated processing. Account Settings provides profile correction, data export and account deletion. You may also email privacy@naijack.com. We may verify your identity before acting and will respond within the period required by law.
8. Recommendations and automated processing
For You recommendations may use location, searches, saved ads, garage details and marketplace demand to rank relevant ads. This ranking does not determine access to credit, employment, insurance or another similarly significant right. You can browse Trending or general categories instead and may object to personalised ranking through the privacy contact.
Referral links identify who invited a new account. Referrers may see the referred account’s name or business name and reward eligibility status, but not their bank details or full payment records. Withdrawal bank details are used by authorised staff to check and arrange payouts. Sharing an invitation is your choice; the referral feature does not upload your contacts or send invitations automatically.
9. Children
Naijack accounts and commercial marketplace services are intended for people aged 18 or older. We do not knowingly create accounts for children. If you believe a child supplied personal data, contact us so we can investigate and delete it where required.
10. Cookies and tracking choices
Strictly necessary session and security storage keeps accounts signed in and protects requests. Optional analytics and advertising tools load only after consent. Declining does not block marketplace access. Use the Cookie Settings link in the footer to review or change your choice at any time.
11. Security and personal-data breaches
We use password hashing, access controls, request protection, rate limits, private storage, upload validation, encryption in transit, incident references and operational monitoring. No system is risk free. Where a breach is likely to create risk to people, Naijack will notify the Nigeria Data Protection Commission within the legally required period and notify affected people where required, while taking containment and recovery action.
12. Complaints and changes
Contact privacy@naijack.com first so we can investigate. You may also complain to the Nigeria Data Protection Commission and seek remedies available under Nigerian law. Material policy changes will be dated, clearly published and, where required, brought to registered users' attention before taking effect.
