Privacy Policy

Last updated: July 2, 2026

1. Introduction

Welcome to Banzaar. Banzaar (“we”, “us”, “our”) is a social commerce platform connecting buyers and vendors. This Privacy Policy explains what personal data we collect, why we collect it, how we use, share, and safeguard it, how long we keep it, and what rights you have over your information.

This Policy applies to everyone who uses the Banzaar app, website, and related services (together, the “Platform”), regardless of role: Buyers, Vendors, Employees, and Admins. Where a section applies to only one type of user, that is stated clearly.

By creating an account or otherwise using the Platform, you agree to the collection and use of your data as described in this Policy. If you do not agree, please do not use the Platform. Where the law requires us to obtain your consent for a specific activity (for example, marketing communications), we will ask for it separately and you may withdraw it at any time — see Your rights.

If a local-language version of this Policy is made available to you and conflicts with this English version, the local-language version will govern for users in that jurisdiction, unless applicable law requires otherwise.

2. Who we are

Banzaar is the data controller responsible for the personal data you provide when using the Platform — meaning we decide why and how your data is processed. Where we act on a vendor's instructions (for example, order data a vendor uses to fulfil your purchase), the vendor may separately act as a controller for that processing, and their own privacy practices also apply.

You can reach us at:

• Email: privacy@getbanzaar.com
• Data Protection Officer / Privacy Lead: Not yet appointed — direct privacy inquiries to privacy@getbanzaar.com

3. Definitions

To keep this Policy clear, here is what a few recurring terms mean:

• Personal data — any information relating to an identified or identifiable individual.
• Processing — anything done with data, including collecting, storing, using, sharing, or deleting it.
• Controller — the entity that decides why and how personal data is processed.
• Processor — an entity that processes personal data on a controller's behalf, such as a hosting provider.
• Sensitive data — data that receives extra protection, such as precise location, government ID/KYC details, or financial account data.
• Platform — Banzaar's apps, website, and related services.

4. Data we collect

We only collect the categories of data described below — nothing else. Where information is especially sensitive (precise location, financial details, identity documents, social media access details), we call that out and give it extra protection, described in Storage & security.

4.1 Account information (all users)

When you register, we collect your email address, a password (which we store securely and never in readable form), and your first and last name. You can also choose to add a phone number, username, date of birth, age, and gender, a bio, and an avatar or cover photo. At sign-up we also record your country, state, language, and timezone, how you signed in (email/password, Google, or Apple), and, if you joined through a referral link, the referral code used.

4.2 Device & session information (all users)

To keep your account secure and deliver the app experience, we collect your IP address and the type of browser or app you're using each time you log in, your device type and name (e.g. “iPhone 14”), the information needed to send you push notifications, and the date and time you last logged in.

4.3 Business account information (vendors only)

If you register as a vendor, we collect your business name, username, email, and phone number, a public business description, and your business address, city, state, and country. We also collect the precise GPS coordinates (latitude/longitude) of your business — this is sensitive location data, used only to power location-based search and discovery for buyers; we do not access device-level GPS in the background, and you control it by setting your business address. We further collect your operating hours, whether you offer retail, wholesale, or both, your KYC (identity and compliance verification) documents — which is sensitive data — your tax settings per country and state, and any social media links you choose to add.

4.4 Financial & banking information (vendors only)

To pay you out, we collect your bank account number and bank code, which we treat as sensitive data, along with the account name confirmed by our payment provider when they verify your bank details. You choose your payment provider (Paystack, Monnify, or Flutterwave). We also maintain your wallet balance, your full transaction history (credits, debits, withdrawals, deposits), and a record of each withdrawal and deposit, including the amount and status. We never store your full card number or security code — your card details are handled exclusively by our licensed payment providers, to the standard required by the card payment industry.

4.5 Order & shopping information (buyers & vendors)

When you shop, we collect the contents of your cart (a snapshot of the listing at the time you added it), your full order history (items, prices, payment method, status), your shipping address (street, city, postal code, country, state, GPS coordinates, and phone number), and the payment method you used (wallet, online, cash, bank transfer, or POS). We also record any coupon codes applied, the full order status timeline, the reason and party for any cancellation, and order reports if you or a vendor files a dispute. Vendors additionally see the delivery address and contact phone number a buyer provides so they can fulfil orders placed with them.

4.6 Listing information (vendors)

For each listing you create, we collect the product name and description, price and quantity, images, and category, tags, and attributes. If your product comes in different sizes, colours, or options, we also store the price and stock level for each option, and we keep track of the listing's current review and publication status. If you use our AI description tool, we also store the AI-generated content, which is created only from the product details you provide — never from personal data.

4.7 Chat & messaging information (all users)

We store the content of messages you send within the Platform, any attachments (file name, URL, type, size, and thumbnail), references to products or orders shared in a conversation, delivery and read receipts, a flag and timestamp when a message is edited, and the list of accounts participating in each conversation.

4.8 Interaction & behavioural information (all users)

We track how you use the Platform: listings you view (and for how long), listings you bookmark or share, business profiles you visit, your search activity (keywords and categories browsed), and the listings you like or comment on. This applies to activity within the Banzaar app; see Cookie policy for how this website (separate from the app) handles tracking.

4.9 Notification & preference information (all users)

We keep a record of your notification preferences by category and channel (email, SMS, push, in-app), your subscribe/unsubscribe history, and each notification sent to you (title, message, channel, status, and timestamp) — which we automatically delete after 30 days.

4.10 Social media integration information (vendors)

If you connect your Banzaar business to Facebook, Instagram, TikTok, or WhatsApp, we collect your username, display name, and profile picture from that platform, along with the secure access details that let Banzaar act on your behalf on that platform — we treat this as sensitive data and protect it accordingly. We also record the specific permissions you've authorised, and if you've asked that platform to automatically notify us of certain activity, we store that setting too. You control these permissions at all times through the connected platform's own settings, and you can revoke Banzaar's access at any point.

4.11 Loyalty, rewards & cashback information (buyers)

We track your engagement points by activity type and month, referral records (referrer and referee, reward amount, status), cashback records (amount, type, status, reference, and when it was credited), and your monthly spend, including whether cashback has been applied.

4.12 Analytics information (vendors & admins)

We generate sales analytics (revenue, order count, average order value, profit), listing analytics(units sold, revenue, views, refunds), location analytics (orders and revenue by country, state, and city), and customer demographics, which are always aggregated and never tied to an individual buyer.

4.13 Admin & security information (admins)

For our own staff who administer the Platform, we keep a log of the actions they take (what was done, when, and by whom) so we can maintain accountability, along with basic account security information, such as whether extra login protection is turned on and whether the account has been temporarily locked after repeated failed sign-in attempts.

5. How we collect data

We collect your data in a few different ways:

• Direct submission — through registration forms, listing creation, checkout, and your profile settings.
• Automated collection — your IP address, user agent, and device information, captured whenever you log in or use the app.
• Third-party providers — profile data from Google or Apple Sign-In, and verification responses from our payment providers.
• Social media connections — profile and permission data from any platform you connect to your Banzaar business.
• Passive interaction tracking — listing views, search queries, bookmarks, and profile visits.
• Messaging — the messages you send and receive within the Platform.

We do not buy personal data about you from third-party data brokers.

6. Why we use your data

We use your data for the following purposes, and no others:

• To create and manage your account — using your name, email, phone, and password (contract performance).
• To verify your identity (KYC) — using your business information and bank details (legal obligation / contract).
• To process and fulfil orders — using your shipping address, order details, and payment information (contract performance).
• To process payments and payouts — using your bank account, wallet, and transaction records (contract performance).
• To send transactional notifications — using your email, phone, and device information (contract performance).
• To send marketing communications — using your email and phone, only where you've opted in (consent — you may opt out at any time).
• To deliver push notifications to your device — using your device information (consent).
• To detect fraud and abuse — using your IP address, device information, and transaction patterns (legitimate interest).
• To moderate listings and content — using listing data and user reports (legitimate interest / legal obligation).
• To provide analytics to vendors — using their own order and listing data (legitimate interest).
• To improve platform performance — using anonymised interaction data (legitimate interest).
• To comply with legal obligations — using financial records and identity data (legal obligation).
• To generate AI-powered descriptions — using product name, category, and features only, never personal data (consent).

We only use your data for the purposes above, or for a new purpose that is compatible with them. If we ever want to use it for something materially different, we will ask for your consent first where required by law.

7. Who we share data with

We do not sell your personal data. We share it only in the following circumstances:

• Payment processors. We share your account number, bank code, and transaction amounts with Paystack, Monnify, or Flutterwave — whichever you've chosen — so they can verify your bank account and process your payments. Your banking data goes only to the provider you personally select, and only for that purpose.
• Push notification services. We share your device information and notification content with our notification provider so we can deliver alerts to your phone.
• Media storage. We share your product images, avatar, and cover photo with our media storage provider for secure hosting and fast delivery.
• AI services. We share product name, category, features, and location context — never personal information — with our AI content provider to power AI-generated listing content.
• Social media platforms. If you connect your Banzaar business to Facebook, Instagram, TikTok, or WhatsApp, we share listing data with those platforms as you've authorised. You can review or revoke this access at any time, both in the connected platform's settings and in your Banzaar account settings.
• Shipping partners. When you place an online order, we share your delivery address and contact phone number with the assigned courier or shipping company to fulfil the delivery.
• Vendors. When you place an order, we share your delivery name, address, and contact phone number with the vendor fulfilling it — and only for that purpose. Vendors are prohibited from using this data for anything else.
• Legal and regulatory authorities. We may disclose your data to law enforcement, regulators, or courts where required by applicable law or a valid legal order, or where necessary to protect the rights, property, or safety of Banzaar, our users, or the public.
• Business transfers. If Banzaar is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• Infrastructure and operations. Your data is hosted on secure cloud infrastructure, including database servers, caching layers, message queues, and email delivery services. All of these providers are contractually bound by confidentiality and data protection obligations, and act only as our processors — they may not use your data for their own purposes.

8. Automated decision-making & profiling

We use automated systems for a small number of purposes: detecting fraud and abuse by flagging unusual transaction or login patterns for review; drafting AI-generated listing content from the product details a vendor provides, with no personal data used as an input; and powering personalised recommendations and search ranking based on your activity on the Platform.

These systems support human decision-making — they do not, on their own, produce legal or similarly significant effects about you. Where a decision meaningfully affecting your account, such as a suspension, relies significantly on automated analysis, you may request human review — see Your rights.

9. International data transfers

Your data may be processed in a country other than the one you live in, including by the service providers listed in Who we share data with. Where we transfer personal data across borders, we use recognised legal safeguards, such as standard contractual clauses or equivalent mechanisms required under applicable data protection law, and we only work with providers who agree to protect your data to the standard set out in this Policy.

10. Data storage & security

10.1 Security measures

We use industry-standard technical and organisational measures to protect your data, including encryption of your information both in transit and in storage, secure handling of your password so that it is never visible even to our own staff, and processing of your bank account details only through licensed payment providers. We restrict access to sensitive data — such as identity verification documents, banking details, and precise location — to the staff who genuinely need it to do their job, and we monitor our systems for suspicious activity, including repeated failed login attempts.

No system is completely secure, and we cannot guarantee absolute security. Please help us protect your account by using a strong, unique password and keeping your login credentials confidential.

10.2 Data breach

In the event of a data breach affecting your personal data, we will notify you and relevant authorities in accordance with applicable law and within required timeframes.

11. Data retention

We keep your data only as long as we genuinely need it for the purpose it was collected, plus any period required by law:

• Account profile data — until your account is deleted, plus [X] years for legal compliance.
• Order and transaction records — a minimum of 7 years, to meet financial audit requirements.
• Chat messages — until you delete them or close your account.
• Notification records — automatically deleted after 30 days.
• Analytics data — aggregated data is retained indefinitely; individual-level data is deleted after [X] months.
• AI usage records — a minimum of 7 years, as a financial record.
• Staff activity logs — a minimum of 7 years.
• Uploaded media — until the associated listing or account is deleted.
• Social media connection details — until you disconnect the integration.

Upon account deletion, your account is deactivated. Certain records are retained for the legal periods above; data that is no longer legally required is permanently purged.

12. Your rights

Depending on your jurisdiction, you may have the following rights over your personal data:

• Right to Access — request a copy of the personal data we hold about you.
• Right to Rectification — correct inaccurate or incomplete data.
• Right to Erasure — request deletion of your data, subject to legal retention requirements.
• Right to Restriction — ask us to limit how we process your data.
• Right to Portability — receive your data in a structured, machine-readable format.
• Right to Object — object to processing based on legitimate interest, including direct marketing.
• Right to Withdraw Consent — withdraw consent for processing based on consent, such as marketing emails or push notifications.
• Right to Human Review — request human review of a significant automated decision affecting you.

Nigeria Data Protection Act (NDPA)

Banzaar operates in Nigeria, and the rights above are guaranteed to you under the Nigeria Data Protection Act 2023 (NDPA). If you believe we have not handled your data lawfully, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) in addition to contacting us directly.

How to exercise your rights

Submit requests to: privacy@getbanzaar.com. We will respond within 30 days, and we may ask you to verify your identity before processing a request.

Marketing opt-out

You may opt out of marketing communications at any time — through your notification preferences in the app, by clicking “Unsubscribe” in any marketing email, or by contacting support. Opting out of marketing does not affect transactional or security notifications.

13. Cookie policy

Banzaar is currently a mobile app only — we do not operate a web platform, and this website does not use cookies or similar browser tracking technologies. This marketing website only sets what your browser requires to load the page; no analytics, advertising, or tracking cookies are used.

If we launch a web application in the future that uses cookies, we will update this section and publish a dedicated Cookie Policy before doing so.

14. Children's privacy

Banzaar is not directed at, and is not intended for use by, individuals under the age of 18. Under Nigeria's Data Protection Act and the Child's Rights Act, a “child” is anyone under 18, and processing a child's personal data generally requires the consent of a parent or legal guardian. Because Banzaar involves financial features such as wallets, payments, and payouts that a minor cannot lawfully hold under Nigerian law, we do not knowingly collect personal data from anyone under 18, and we do not offer a parental-consent pathway for registration.

If we become aware that someone under 18 has registered, we will suspend the account and delete the associated data as soon as reasonably possible.

If you believe a child has registered, please contact us at: privacy@getbanzaar.com

15. Third-party links & services

The Platform may contain links to third-party websites, products, or services. Banzaar is not responsible for the privacy practices or content of those third parties, and we encourage you to read their privacy policies before providing any personal data. Third-party services used by Banzaar that may process your data include:

• Paystack Privacy Policy
• Monnify Privacy Policy
• Flutterwave Privacy Policy
• Meta / Facebook Privacy Policy
• TikTok Privacy Policy

16. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the “Last Updated” date at the top of this document and notify you via email and/or in-app notification. Continued use of the Platform after the effective date constitutes your acceptance. If the changes materially affect how we use your data, we will seek fresh consent where required by law. We encourage you to review this Policy periodically.

17. Contact us

For privacy-related questions, data subject requests, or to report a concern, reach out to:

Banzaar Data Protection
Email: privacy@getbanzaar.com
Website: getbanzaar.com

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).