Privacy Policy

Brinmart Technologies is the data controller. Reach the team at support@brinmart.com.

We comply with the Nigeria Data Protection Act (NDPA) 2023.

When you sign up: email, full name, phone number (optional but required to receive buyer contacts), WhatsApp number (optional), and a password hash (we never see your raw password).

When you create a seller profile: store name, username, bio, profile photo.

When you list items: photos, descriptions, prices, categories, delivery info, and your selected state/city.

When you apply for verification: a photo of your government-issued ID (NIN, driver's licence, voter's card, or passport) and a selfie holding that ID.

When you transact: wallet balance, top-up references, withdrawal bank details, boost purchases, conversation history with other users.

Automatically: device type, browser, approximate location (from IP), pages visited, and basic interaction events. We do not use third-party advertising cookies.

• To operate the platform: show your listings, route messages, process boost payments, send notifications.
• To verify identity: ID + selfie are used to confirm you are who you say, then encrypted at rest.
• To prevent fraud: we monitor for scam patterns and may freeze accounts that look suspicious.
• To improve the product: aggregate analytics help us see which features work.
• To contact you: email and in-app notifications about your account, new messages, or platform updates.

Our legal basis under NDPA: consent (which you give on signup), contract (operating the service you signed up for), and legitimate interest (preventing fraud).

We share only what's necessary, and only with these third parties:

• Supabase — our database and authentication provider. Hosts your account data and listings.
• Paystack — processes payments (top-ups, withdrawals, boost purchases). Receives your name, email, and bank details when relevant.
• Resend — sends transactional emails (OTP codes, notifications). Receives your email and the email content.
• Vercel — hosts the website. Receives standard server logs (IP, request paths).

We do not sell your data to anyone. We do not share it with advertisers or marketing companies. We do not use your data to train AI models.

We may disclose data when required by law (court order, subpoena, regulatory investigation) or when necessary to protect users from imminent harm.

• Your store name, username, avatar, bio, and rating are publicly visible.
• Your phone and WhatsApp numbers are shown only to logged-in users who explicitly reveal your contact on one of your listings. We log every reveal so you can see who's interested.
• Your email is never visible to other users.
• Your verification ID and selfie are never visible to other users — only our internal review team.
• Your wallet balance, transactions, and withdrawal history are private to you.

• Account data: kept while your account is active. Deleted within 30 days of account closure.
• Verification IDs: kept only as long as needed to verify; deleted within 90 days of approval or rejection.
• Transaction records: kept for 7 years for tax and regulatory compliance.
• Server logs: kept for 30 days.

Under the NDPA, you have the right to:

• Access the data we hold about you
• Correct inaccurate data (most of this is editable from your settings)
• Delete your data (close your account)
• Object to certain processing
• Withdraw consent at any time
• File a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these, email support@brinmart.com. We respond within 30 days.

We use industry-standard security: HTTPS everywhere, encrypted database, hashed passwords, and row-level security to ensure your data is only accessible to you (and our admin team where necessary for support).

No system is 100% secure. If we discover a breach affecting your data, we will notify you within 72 hours as required by law.

Brinmart is for users 18 and over. We do not knowingly collect data from anyone under 18. If we discover an under-18 user, we will delete the account and any associated data.

Our service providers (Supabase, Vercel, Resend) operate servers outside Nigeria. Your data may be transferred to and processed in those countries. Where the recipient country has different data protection standards, we ensure equivalent safeguards via standard contractual clauses.

We use only essential cookies needed for authentication and session management. We do not use third-party advertising or tracking cookies.

We may update this Privacy Policy occasionally. If we make material changes, we'll notify you by email or in-app notification. The "last updated" date at the top of the page always reflects the most recent version.

Privacy questions or requests? Email support@brinmart.com.