Privacy policy

Carryofy runs carryofy.com, a social selling platform in Lagos, Nigeria. Suppliers list products, resellers sell them from their own Carryofy stores, businesses buy wholesale, and customers buy from those stores. We take the payment, arrange delivery and pay the sellers.

For the personal data described here, Carryofy is the data controller under the Nigeria Data Protection Act 2023 (NDPA). You can reach us about anything in this policy at support@carryofy.com.

We only collect what we need to run your orders, your store or your account:

• Account details: your name, phone number, email address and the role you signed up for (reseller, supplier, business or customer).
• Order details: the delivery name, phone number and address you give at checkout, what you ordered, and the order's status, rating and any return request, including the photos or videos you send with it.
• Seller and supplier details: business name and addresses, pickup address, contact person, and the documents you upload for verification (for example a NIN slip or CAC certificate).
• Payout details: your bank name and account number, checked with Paystack before any payout.
• Security records: login codes and your password if you set one (both stored scrambled, never in plain text), and the IP address and device type used to sign in, to stop abuse and protect your account.
• Usage data: which pages are visited, through Google Analytics, only if you click Accept on our cookie banner.

We never see or store your card details. Card payments happen on Paystack's secure page.

• To deliver what you asked for: placing and delivering orders, sending login codes and order updates, handling returns and refunds, and paying suppliers and resellers. This is needed to carry out our agreement with you.
• To keep money safe: verifying sellers and bank accounts, keeping a complete record of every payment, refund and payout, and preventing fraud. This is required by law and is in our legitimate interest.
• To improve Carryofy: understanding which pages people use, only with your consent.

We do not sell your personal data, and we do not use it for advertising.

A customer's phone number and delivery address are shown only to the people who need them for that order: the store that made the sale, the delivery rider and our operations team.

We also use trusted service providers who process data for us, only for these purposes:

• Paystack: payments, refunds, bank account checks and payouts.
• Termii and Resend: sending text messages, WhatsApp messages and emails.
• Delivery partners in Lagos: picking up and delivering orders.
• Hosting and storage providers (including Vercel, Render, Neon and Cloudflare): running the website and keeping the database and uploaded files.
• Google Analytics: page visit statistics, only with your consent.
• Error tracking: technical error reports, with cookies and login details removed.

We may also share data when the law requires it, for example with tax authorities or the police acting under a lawful request.

Our database and servers are in Frankfurt, Germany, and some of our providers operate in other countries. Germany is covered by the EU's data protection law, which gives protection comparable to the NDPA. Where we use providers elsewhere, we rely on their contractual data protection commitments, as the NDPA allows.

• Your account details: for as long as your account is open.
• Orders, payments, refunds and payouts: for as long as Nigerian tax and accounting law requires. These records can't be edited or deleted early, because they prove where every naira went.
• Login codes: only minutes. Sign-in security records: a limited time, then deleted.
• Verification documents: while you sell on Carryofy and as long as the law requires after.

We use your browser's storage to keep you signed in, remember your cart and remember your cookie choice. These are needed for the site to work.

Google Analytics cookies are set only if you click Accept. Without your consent, Google receives only basic visit signals with no cookies and nothing that identifies you. If you click No thanks, nothing is sent at all. Admin pages are never tracked. You can change your choice any time: Cookie settings.

Under the NDPA you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data, unless we have to keep it by law (for example payment records);
• stop or limit how we use it, or object to a use;
• send your data to you or another service in a common format;
• withdraw your consent, such as for analytics, at any time.

Email support@carryofy.com from the email address on your account. We reply within 30 days. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

You sign in with a one-time code or, if you choose, a password. Passwords are stored only as a scrambled hash that can't be turned back into the password, and repeated wrong guesses lock password login for a while. Data is sent over encrypted connections, uploaded documents are kept in private storage, admin access is limited by role, and every money action is logged. If a breach puts your data at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

Carryofy is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us their data, email us and we will delete it.

If we change this policy, we will update the date at the top. For important changes we will also tell you by email, text message or a notice in your dashboard. Read our terms of use too.