Privacy Policy

Last updated: 12 October 2026

Draft notice: this is a starting template, not finished legal advice. Fill in the bracketed details and have it reviewed against the Nigeria Data Protection Act (NDPA) before launch, since NexBox collects customer and payment-related data on behalf of business owners.

1. What we collect

Account data: name, business name, phone number, email address, password (stored hashed by our authentication provider, Supabase).
Storefront data: product listings, prices, images, and branding you upload.
Order data: customer names, phone numbers, and order details submitted through your storefront's WhatsApp checkout or invoice flow.
Payment data: processed directly by Paystack. NexBox does not store your customers' card or bank account numbers.
Usage data: basic technical data such as IP address and browser type, collected automatically for security and analytics. We also log a few anonymous product events (for example, "account created") and technical error messages so we can keep the Service reliable. These logs contain no names, emails or phone numbers.

2. How we use it

We use this data to operate your storefront and dashboard, process orders, generate invoices and receipts, send you product/order notifications, and improve the Service. We do not sell your data or your customers' data to third parties.

3. Who we share it with

Supabase: our database and authentication provider, which stores account and order data.
Netlify: hosts the website and serverless functions.
Paystack: processes payments and holds payment-method data under its own privacy policy.

We only share what each provider needs to perform its function.

4. Data retention

We keep account and order data for as long as your account is active, and for a reasonable period afterward as needed for legal, tax, or dispute-resolution purposes. [Specify a retention period.]

5. Your rights

You can access, correct, or request deletion of your account data at any time by contacting us. Business owners are responsible for honoring similar requests from their own customers regarding the order data collected through their storefront.

6. Security

We use industry-standard measures (encrypted connections, access controls, Row Level Security on our database) to protect your data, but no system is 100% secure, and we cannot guarantee absolute security.

7. Children's privacy

NexBox is intended for business owners aged 18 and older. We do not knowingly collect data from children.

8. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page.

9. Contact

Questions about this policy: [support email / WhatsApp number].