Privacy Policy

ShopCera (Lagos, Nigeria) is responsible for the personal data of ShopCera account holders and website visitors. Questions or requests: privacy@shopcera.com.

• Business owners and team members: we are the data controller. We decide how your account data is used.
• Shoppers and customers of a store: the store is the data controller and ShopCera is its processor. The store decides why your order, booking or contact details are collected, and we process them on its behalf to run its store. If you want to use your rights over that data, contact the store first. We will help the store respond.

From businesses and their teams:

• Account details: name, email address, phone number, password (stored only as a one-way hash), role and team invitations.
• Business details: business name, type, country and city, logo, description, brand colours, delivery and pickup settings, bank account details you choose to show for transfers, and the plan you choose.
• Billing: your plan, invoices and payment status. Card payments are handled by Paystack or Flutterwave; we do not see or store your full card number.
• Content you add: products, services, photos, categories, coupons, customer lists, messages and support requests.
• Usage and device data: pages viewed, actions taken, browser, device type, approximate location from IP address, and error logs.

When a shopper uses a store, the store collects (and we process for it):

• Contact and delivery details: name, email, phone number, delivery address.
• Order and booking details: items, amounts, payment method and status, booking times, notes.
• Messages sent through the store's contact form, and customer support conversations.
• Anonymous visit statistics for the store: visits, page views and actions, recorded with randomly generated identifiers that are hashed so they can't be turned back into a person.

• To provide the service: create and run your account and store, process orders and bookings, send confirmations and receipts, and give support. (Contract.)
• To bill you and prevent fraud and abuse. (Contract, legal obligation and legitimate interests.)
• To keep the service secure, fix problems and improve it, including through aggregate and anonymous statistics. (Legitimate interests.)
• To send you service messages (security, billing, changes to terms) and, if you agree, product news. You can opt out of news at any time. (Contract, legitimate interests and consent.)
• To meet legal obligations, such as tax and accounting records and responding to lawful requests. (Legal obligation.)

We don't sell personal data. We share it only with:

• Payment providers (Paystack, Flutterwave) to take subscription payments and, where a store connects its own account, to process card payments for it.
• Delivery and courier services a store connects (for example Shipbubble, Fez) to book shipments for that store's orders.
• Messaging providers that deliver SMS and email on a store's behalf (for example Termii and our email delivery provider).
• Hosting, database, file storage and monitoring providers that run ShopCera for us (for example Vercel, Render, Neon and cloud storage).
• The store a shopper buys from, which receives that shopper's order and contact details.
• Professional advisers, regulators, courts or law enforcement when the law requires, or to protect rights, safety and security.
• A buyer or successor if ShopCera is involved in a merger, acquisition or sale. We would tell you and the new owner would have to respect this policy.

Some of our providers store or process data outside Nigeria, including in the United States and Europe. Where that happens we rely on contracts and the safeguards the Nigeria Data Protection Act allows to keep the data protected.

We keep account and store data while your account is active. After you close it we delete or anonymise it within a reasonable period, normally within 90 days, except records we must keep by law, such as invoices and payment records (typically up to six years). Backups roll off on a regular cycle. Stores decide how long to keep their own customer records and can delete them from their dashboard.

We use encryption in transit, hashed passwords, encrypted storage of connected payment keys, access controls, and separate data for each store. No system is perfectly secure, so please use a strong, unique password and keep it private. If a breach puts your rights at risk, we will notify you and the regulator as the law requires.

You can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to how we use it; give you a copy in a portable format; and withdraw consent where we rely on it. You can also object to direct marketing at any time.

To make a request, email privacy@shopcera.com. We may need to verify who you are, and will reply within a reasonable time. If you aren't happy with our answer you can complain to the Nigeria Data Protection Commission (NDPC).

For data a store holds about its customers, please contact the store first.

We use a small amount of browser storage to keep you signed in, remember your cart and settings, and count visits anonymously. See our Cookie Policy for the details and your choices.

ShopCera is for businesses and isn't aimed at people under 18. We don't knowingly collect data from children. If you think a child has given us personal data, email us and we will delete it.

We may update this policy. We will change the date at the top and, if the change matters, tell you by email or in your dashboard.

ShopCera, Lagos, Nigeria. Email privacy@shopcera.com.