Optional preferences

Marketing emails are optional for buyers and sellers. Only verified accounts that opted in receive offers and news, and every marketing email has an unsubscribe link. Order, payment and security emails are separate.

If you enable marketplace personalisation, we use your shopping searches, viewed products, saved items and recent purchases to suggest products. Shopping interests expire after 90 days. Turning personalisation off deletes those interests; your order records remain available. Signed-in buyers who disable personalisation see products ranked using aggregate activity. A Papi buyer account is required to enter the marketplace.

1. Who this policy covers

Papi ("papi", "we", "us") operates digital commerce infrastructure that enables independent business owners ("Merchants") to launch, customize, and operate storefronts, and enables customers ("Buyers") to browse, order, and receive products and services. This Privacy Policy outlines how Papi collects, processes, protects, and respects your personal data with reference to the Nigeria Data Protection Act 2023 (NDPA).

This policy covers all services offered via papi.ng, merchant storefronts hosted on papi.ng subdomains or custom domains managed through Papi, the merchant webapp dashboard, universal customer accounts, and related administrative platforms.

Independent merchants using Papi act as autonomous data controllers with respect to their direct commercial interactions with customers. When you purchase from a merchant, their specific fulfillment practices are also governed by their own customer policies.

2. Data we collect

2.1 From Merchants

Account & Identity: Full name, verified email address, phone number and verification status, securely salted and hashed password credentials.
Business Information: Store name, operational category, business description, logos and brand imagery, catalog information (item names, descriptions, images, prices, variants, stock).
Payout Information: Bank account verification details (account number, account name, bank code). Bank details are encrypted at rest using AES-256 and never exposed in full through any client-facing API.
Security PIN: Securely hashed 4-digit withdrawal authorization PIN for initiating wallet transfers.
Device & Session History: Active sessions, browser family, approximate location, and operating system to enable merchants to review and revoke unauthorized logins.
Business Verification: Submitted registration documents, legal business name, registration number, review decisions and related correspondence.
Support and AI Conversations: Messages, attachments, assistant requests, proposed changes, approval history and support correspondence.
Domain Registrant Information: Where domain registration is requested, registrant contact details required by ICANN and registry policies (such as NiRA).

Images uploaded through Papi’s photo, logo, avatar and review upload tools are re-encoded before storage to remove embedded EXIF metadata, including GPS location and camera details. This does not hide information visible in the picture itself. Externally linked images and PDF documents are not covered by this image-metadata removal process.

2.2 From Customers (Buyers)

Order Details (Guest Checkout): Customer name, delivery address, phone number, and email address for order communications and receipt delivery.
Live Location & Geolocation: When a customer clicks "Use current location" during checkout, their browser requests geolocation coordinates solely to pre-fill street address and state through OpenStreetMap Nominatim reverse geocoding. Exact GPS coordinates are not stored.
Reviews: Ratings, review text, uploaded review photos and your chosen display name may be published on the relevant product and store, and associated with your buyer profile.
Universal Papi Account: Saved delivery addresses, saved pickup contact details, order history across participating stores, verified review history, and secure session credentials.
Push Notifications: Web push subscription endpoints and public keys generated by the browser, used exclusively to deliver order status updates when explicitly permitted by the customer.

2.3 Google account connections

If you choose Google Sign-In, Papi receives your Google account identifier, name, email address and profile picture to authenticate and display your account. Papi does not receive your Google password.

When you choose to connect Google Merchant Center, Papi requests the Merchant API permission shown on Google's consent screen. The enabled connection accesses Merchant Center account identifiers, business details, account relationships and services, catalogue and product listing information, data sources and listing issues to verify access and provide the merchant-management features you request. Permission to manage Merchant Center is separate from a Papi business-verification badge.

OAuth credentials are kept on the server and are not exposed in storefronts. Google-derived data is used for the Google connection and its visible account or product-management features. We do not sell it, use it for personalised advertising, or use it to train AI models. It is not sent to Papi's AI providers. Access by authorised staff is limited to the support you request, security investigations or legal requirements.

You can revoke Papi's access in your Google Account connections and request deletion of stored connection data by emailing [email protected]. Revoking access stops future Google API access; it does not delete product listings or accounts already created in Merchant Center. Records required by law may be retained.

Papi's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

2.4 Collected Automatically

Telemetry & Traffic: Page and product views, pseudonymous visitor identifiers used for traffic measurement and bot detection, and anti-bot verification tokens (via Cloudflare Turnstile). Telemetry is automatically pruned after 90 days.
Security and Communications: Session and access metadata, identity restrictions, audit actions, email and SMS delivery results and support routing references. Delivery diagnostics distinguish provider acceptance from confirmed delivery where a confirmation is available.
Aggregated Store Analytics: Store view counts, checkout conversion metrics, and aggregate traffic patterns maintained for merchant performance reporting.

3. Why we collect it (Legal Bases for Processing)

Under the NDPA, we process your personal data under the following lawful bases:

Performance of Contract: To provision your merchant storefront, process transactions, facilitate checkout, generate receipts, and fulfill orders.
Legal & Regulatory Compliance: To comply with banking and anti-money laundering regulations, retain statutory accounting records, and observe domain registry standards.
Legitimate Interests: To detect and prevent fraudulent transactions, secure account access, mitigate bot abuse, and continually optimize platform performance.
Consent: Where you have granted explicit opt-in consent, such as enabling browser push notifications or granting geolocation permission for address autofill.

AI features and model training

Google account and Merchant Center data are excluded from model training. Papi may use information you provide, including shop content, AI prompts, generated responses and feedback, to evaluate, improve or train AI models used in Papi. This is separate from sending a prompt to an AI provider to answer your immediate request.

Any use of personal data for this purpose must have an applicable lawful basis. Where consent is required, we will ask before using that data for training, and you may withdraw that consent. We will explain any new training purpose and relevant recipients before it begins. Passwords, sign-in codes, withdrawal PINs and payment-card credentials are not intended training data.

To ask about AI use, object to processing or withdraw consent, email [email protected] with the subject "AI data use". Avoid including customer personal information or sensitive details in AI prompts unless they are needed for the requested feature.

4. Third-Party Sub-processors

Papi uses service providers for the purposes below. Providers receive the information needed for the enabled service; some providers may be inactive while a feature is unavailable:

Paystack (Payment Gateway): Payment collection, card authorization and settlement to verified merchant subaccounts. Papi stores payment references and limited payment-method details, not full card numbers or card security codes.
Cloudflare: Hosting, edge security, DNS, asset storage, bot protection (Turnstile), and AI processing where enabled.
Cloudflare R2: Secure asset and product image storage.
Brevo / configured SMTP provider: Transactional order receipts, verification codes, and merchant notification delivery.
Termii: Phone verification and enabled SMS notifications.
AI providers (Cloudflare, DeepSeek or OpenAI): Processing assistant prompts and relevant store context. Do not submit passwords or full payment details to the assistant.
Google: Optional sign-in and authorised Merchant Center account and product management, as described in the Google connections section above.
WhoGoHost: Domain registration, transfer and renewal. Requested registrant contact details are shared with the registrar and relevant registry; publication depends on registry rules and available privacy services.
Korapay and Flutterwave, where enabled: Payment or subscription processing and card verification. Only the configured provider receives information needed for the payment feature you use; an inactive integration does not receive transaction data merely because it exists in our software.
Telegram, where enabled: Operational usage, balance and milestone alerts to authorised staff destinations. These alerts are not intended to include customer order contents, passwords or payment credentials.
Hosting and database infrastructure: Our application servers, database and backup infrastructure store the account and commerce records needed to operate Papi. Cloudflare edge services and our VPS infrastructure support delivery of the service.
Zoho Mail: Receiving and responding to messages sent to our support mailbox.
OpenStreetMap (Nominatim): Reverse-geocoding for buyer address autofill upon permission.

Marketing emails are optional for buyers and merchants. We send them only to opted-in recipients, who can unsubscribe. Order, support and security messages are service communications and continue as needed.

5. Data Storage and Cross-Border Transfers

Hosting and service providers may process data outside Nigeria. Applicable transfer requirements under the Nigeria Data Protection Act apply, including an appropriate legal basis and safeguards. Contact us for information about your data and relevant providers.

6. Data Retention Schedules

Deletion and Restrictions: Accounts placed in the deletion process currently have a 30-day restoration window before scheduled permanent deletion. Limited records may remain for legal obligations, unresolved disputes and fraud prevention, including email or phone restrictions needed to enforce an account ban. Restoration does not automatically remove a separate ban.
Account Records: Kept while your account is active and as needed afterwards for legal obligations, fraud prevention, unresolved disputes or a documented operational purpose. Contact us to request deletion or ask about retention.
Financial & Transaction Records: Kept for applicable accounting, tax and dispute-resolution requirements. The required period depends on the record and legal obligation; contact us for details about records associated with your account.
Temporary Telemetry: Detailed traffic visits, marketplace interest events and delivery diagnostics are scheduled for deletion after 90 days. Security challenges have separate short expiry periods.
Aggregated Performance Metrics: Analytics events are scheduled for deletion after 400 days; security audit records after 730 days.

7. Your Rights under the NDPA

Under the Nigeria Data Protection Act 2023, you have guaranteed rights regarding your personal information, including:

Right of Access: You may request a copy of the personal data Papi holds concerning you.
Right to Rectification: Use available profile, address and store settings to correct information. If a verified identity field is locked, contact support to request a verified correction.
Right to Erasure ("Right to be Forgotten"): You may request deletion of your account and personal data, subject to Papi's legal requirements to retain financial transaction records.
Right to Object & Restrict Processing: You may opt out of non-essential communications or withdraw browser notification permissions at any time.
Right to Data Portability: You may request a copy of eligible personal data in a usable format. Available exports and disclosure are subject to identity verification and the rights of other people.
Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) (ndpc.gov.ng) if you believe your privacy rights have been violated.

Request a copy of your data by email

Email [email protected] with the subject "Personal data request", preferably from the email on your Papi account. Include your shop address, if you have one, and describe the information you need.

Our team will verify that the request comes from you before releasing information. We will reply to your verified email with the data we can disclose, or a secure way to receive it, and explain any information we cannot provide. A request does not give access to another person's private data. Do not send passwords, sign-in codes, withdrawal PINs or card details.

Request my data

8. Cookies and Local Storage

Papi uses cookies and browser storage to sign you in, protect against fraud, and remember interface preferences. Referral sources and campaign parameters may be recorded to understand how people find Papi. Optional marketplace personalisation uses your shopping interests, saved products and purchases when you enable it; you can turn it off in your account. We do not use third-party advertising trackers or sell your browsing history.

Essential Session Cookies: Used to maintain authenticated merchant and customer sessions, manage shopping basket contents across page visits, and prevent Cross-Site Request Forgery (CSRF).
Security & Abuse Prevention: Used by Cloudflare and Turnstile to distinguish human visitors from automated botnets and malicious scrapers.
Functional Local Storage: Remembers your preferred interface theme (dark or light mode) and dashboard sidebar collapse state.

Marketplace and buyer-account sessions use separate host-only cookies. You can manage or disable cookies via your browser settings; disabling essential cookies can prevent sign-in, marketplace access or checkout features from working.

9. Protection of Children

Papi is strictly designed for adults and legally incorporated commercial entities. We do not knowingly solicit or collect data from individuals under 18 years of age. If we become aware that a minor has provided personal data, we take prompt action to remove such information.

10. Information Security

We deploy robust organizational and technological defenses to protect your information, including end-to-end HTTPS enforcement, salted key hashing for credentials, role-based access control, and monitoring for unauthorized access. No system can guarantee absolute security.

11. Policy Revisions

We may update this Privacy Policy to reflect technical, operational, or legal developments. We show the revised effective date and notify affected users of material changes through email or the app. Where a new use requires consent, we ask before that use begins. Policy updates do not remove your statutory rights.

12. Privacy Contact & Inquiries

For any inquiries, requests to exercise your data subject rights, or questions regarding our privacy practices, please contact our team at [email protected].