Plain summary: we store what is needed to run a vendor's AI shop — the vendor's business details and catalogue, and the chats customers have with the shop assistant. Customer contact details are shared with one party only: the shop the customer chose to order from. We never sell data. Card payments are handled by Paystack; we never see full card numbers. You can request deletion at any time.
(a) Vendors — business owners who create a NaijaKash shop; (b) Customers of vendors — people who chat with a vendor's shop page; (c) Visitors to naijakash.com and users of our clearly-marked DEMO shops.
| Category | Examples |
|---|---|
| Vendor account | Name, shop name, WhatsApp number (verified by OTP), trade category, catalogue items, prices, photos, delivery info. |
| Customer chat | Messages and voice notes sent to a shop page; and — only after the customer expressly agrees — their name, WhatsApp number and area, collected to pass their order to that vendor. |
| Order records | Items requested, estimates, order status, reference numbers. |
| Billing | Subscription status and payment references. Card details are processed by Paystack; we never store them. |
| Technical | Error logs and basic usage statistics needed to run the service. |
We do not sell personal data, use chats for third-party advertising, or contact a vendor's customers for our own marketing.
The assistant asks the customer's permission before collecting their name and number, and those details go only to the specific shop they ordered from. The vendor is the data controller for their customer relationship; Bamaja Integrated Online Services Ltd acts as processor on the vendor's instructions. DEMO shops belong to us; on those, we are the controller, no goods are sold, and demo conversations can be deleted on request.
| Provider | Purpose |
|---|---|
| AI language-model provider (currently DeepSeek) | Generating assistant replies from chat text and shop facts. |
| OpenAI (Whisper) | Transcribing customer voice notes to text. |
| Google (Gemini) | Reading vendor price-list photos during shop setup. |
| Paystack | Subscription payments; PCI-DSS compliant. |
| Cloud hosting | Servers may be located outside Nigeria (currently Europe/US) with NDPA-appropriate safeguards. |
Customer chat transcripts are deleted automatically after 30 days. Order records (name, number, what was ordered) are kept while the vendor's account is active, because they are the vendor's own business records. A vendor can normally review the last 2 days of chats on their own shop only; we can open that to 14 days on request, and that access expires by itself.
Other data is kept while the account is active. On account closure or a verified request we delete personal data within 30 days, except records the law requires us to keep (e.g. payment records). See Delete my data.
HTTPS/TLS everywhere, per-shop data isolation, access controls, key-only server access, monitored infrastructure. No system is 100% secure; we notify affected parties of any breach as the NDPA requires.
Access, correction, deletion, objection, and complaint to the Nigeria Data Protection Commission. Contact privacy@naijakash.com; we respond within 30 days.
A session cookie keeps vendors logged in. We set a first-party cookie recording which link brought a visitor to us, so we can tell which of our own adverts work, and the browser remembers a customer's number on the shop they ordered from, so the assistant can greet them by name when they return. No advertising cookies, no third-party trackers, and nothing shared with any advertising network. IP addresses are stored only as a one-way hash, never in full.
The vendor service is for persons 18+.