Privacy Policy
Effective [EFFECTIVE DATE]
The short version
- We use your data to run your orders, payments, delivery and identity checks, and to keep Keepa safe.
- We never store your full NIN, BVN, card number or selfie.
- AI reads your chats to find products. Don't share ID numbers or passwords in the chat.
- We don't sell your data, and we don't use ad trackers.
- You can ask for a copy, a correction or deletion at [PRIVACY EMAIL], and complain to the NDPC.
On this page
1.Who is responsible for your data
The data controller is [BUSINESS NAME] (RC [RC NUMBER]), of [REGISTERED ADDRESS], which runs Keepa. If you have a question or a request about your data, contact our Data Protection Officer, [DPO NAME], at [PRIVACY EMAIL].
This policy explains how we handle personal data under the Nigeria Data Protection Act 2023 (NDPA) and the rules of the Nigeria Data Protection Commission (NDPC). It covers keepa.shop, every shop page on Keepa, and the Keepa chat.
When you buy from a seller, the seller also receives your order details to fulfil it, and is responsible for how they use them.
2.What we collect
- Account details: name, email address and/or phone number, and sign-in records, through Clerk.
- Orders and delivery: what you ordered, the delivery name, phone number, address, state and area, and the delivery tracking.
- Payments: the amount, method, payment reference and status from Paystack. We never receive or store full card numbers. For sellers: payout bank, account number and account name.
- Chats and uploads: what you type or say to Keepa, photos you send, questions to sellers, reviews, and messages and photos in a dispute.
- Preferences: what Keepa learns about your taste from chats and orders (for example sizes or brands you like), and your usual delivery area.
- Identity checks: see the next section.
- Shops: shop name, handle, logo, photos, bio, location, delivery areas, WhatsApp number and social links, which sellers choose to make public.
- Technical data: IP address, browser and device type, and logs of errors and security events. A cookie (“keepa_guest”) keeps your chats and cart together if you use Keepa without an account; it lasts 180 days. Sign-in cookies keep you signed in. We don't use advertising or tracking cookies.
3.Identity checks (NIN, BVN and selfie)
To prevent fraud and to pay sellers safely, Keepa verifies identity through Dojah. Sellers verify to receive payouts, and buyers may be asked to verify their NIN before their first payment. You choose to start each check, and we ask for your consent first.
- NIN and BVN. Dojah checks them with NIMC and bank records and returns your name and date of birth. We keep your verified name and date of birth, the last 4 digits, and a one-way keyed hash of the number (so one ID can't verify two accounts). We do not store your full NIN or BVN.
- Short-lived NIN copy. If you go on to the selfie check, your NIN is kept encrypted for up to one hour so the selfie can be matched to your NIN photo, and is then discarded.
- Live selfie. Your selfie is sent to Dojah to confirm it's a live person and to match it to your NIN photo. It is biometric data, which the NDPA treats as sensitive, so we only process it with your explicit consent. We do not store the selfie or the ID photo. We keep only the result: the match and liveness scores and when the check passed.
- Attempt log. Each attempt is recorded (type, result, time) for audit and to limit attempts to 5 per check per day.
Your verification level appears publicly as a badge (“ID verified”, “ID & bank verified”, “Fully verified”). Your ID numbers and scores are never shown to other users.
4.Why we use it, and our lawful basis
The NDPA requires a lawful basis for each use. Ours are:
- To run the service you asked for (contract): accounts, chats, finding products, orders, payments (into escrow or split straight to the seller), delivery, refunds, payouts, receipts and text messages about your order.
- To meet legal duties (legal obligation): tax invoices and records, accounting, responding to lawful requests from regulators, courts and law enforcement.
- To keep Keepa safe and fair (legitimate interests): NIN and BVN checks, stopping fraud and duplicate accounts, deciding disputes, seller reliability scores, usage limits on the AI chat, security logs, and improving Keepa.
- To personalise (legitimate interests): learning your taste to suggest products. You can see, remove, clear or turn this off on your profile.
- Selfie face match (explicit consent). You can withdraw consent at any time; it doesn't affect checks already done, but you won't get the “Fully verified” level.
Where we rely on legitimate interests, we have weighed them against your rights. You can object (see “Your rights”).
5.AI and automated decisions
Keepa's chat sends your messages, photos and voice-note text to an AI model (Anthropic's Claude, and sometimes Google or OpenAI) to understand what you need and reply. They receive it to produce that reply, under their business terms. Don't share ID numbers, card details or passwords in the chat.
Some decisions are automated: which listings are shown first, and whether an identity check passes. No decision about a refund or a dispute is made by AI alone; Keepa staff decide disputes. If an automated result affects you, you can ask for a person to review it.
7.Transfers outside Nigeria
Some providers above store or process data outside Nigeria, mainly in the United States. We transfer data abroad only as the NDPA allows (Part VIII): where the NDPC recognises adequate protection, or under contracts with data protection terms and safeguards such as encryption in transit and at rest, or where the transfer is needed to provide the service you asked for. You can ask us for details of the safeguards for a given provider.
8.How long we keep it
- Orders, payments, payouts, receipts and tax invoices: at least 6 years after the order, for tax and accounting law.
- Dispute messages and photos: with the order record, for the same period.
- Account and shop details: while your account is open, then up to 2 years after it closes, unless we must keep them longer for a legal claim or investigation.
- Identity results (hash, last 4 digits, name, date of birth, scores, attempt log): while your account is open and up to 6 years after, to prevent fraud and repeat accounts. The NIN copy for the face check: up to one hour.
- Chats and learned preferences: until you delete them or close your account. Chats from a browser without an account are kept while its cookie is active, and up to 1 year after.
- Security and error logs: up to 12 months.
9.Your rights
Under the NDPA you can:
- get a copy of your personal data, and have it sent to you or another service in a common format;
- correct data that is wrong or incomplete (much of it you can edit yourself on your profile or in your shop);
- ask us to delete it, or limit how we use it, where we have no legal reason to keep it;
- object to uses based on legitimate interests, including personalisation;
- withdraw consent at any time, where we rely on consent;
- not be subject to a decision based only on automated processing that significantly affects you, and ask for a person to review it.
Email [PRIVACY EMAIL] from the email or phone on your account. We may ask you to confirm who you are. We'll reply within 30 days, and it's free unless a request is clearly excessive.
10.Security and breaches
We protect data with encryption in transit (HTTPS), access controls (staff access is limited and logged), signed webhooks, hashed and encrypted ID data, and private storage for dispute evidence. No system is perfectly secure. If a breach is likely to put your rights at risk, we'll tell the NDPC within 72 hours of becoming aware of it, and tell you without undue delay.
11.Children
Keepa is not meant for children under 18 on their own, and we don't knowingly collect their data without a parent or guardian's consent. If you think a child has given us data, contact [PRIVACY EMAIL] and we'll delete it.
12.Complaints and changes
If you're unhappy with how we handle your data, contact our DPO at [PRIVACY EMAIL] first and we'll try to fix it. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
We'll update this policy when our practices change, and tell you about important changes on Keepa or by message. General questions: [SUPPORT EMAIL].