Privacy Policy

OpenStall (openstall.ng) is operated by Mahhfaz ICT Hub, No 17 Kasuwan Yelwa Street, Palace Way, Jalingo, Taraba State, Nigeria. For the personal data described in this policy, Mahhfaz ICT Hub is the data controller.

Our Data Protection Officer can be reached at admin@mahhfaz.com.ng. You can write to us about anything in this policy, including exercising your rights.

Vendors who sell on OpenStall receive the details they need to fulfil your order (see section 5). Each vendor is responsible for how they use those details once received.

We collect only what we need to run the marketplace:

• Account details: name, email address, phone/WhatsApp number, password (stored only as a secure hash), and profile photo if you sign in with Google.
• Vendor details: store name, address, business category, products and images, and settlement bank details (bank, account number and account name) used to create your Paystack and Monnify subaccounts.
• Order details: items ordered, delivery address or pickup choice, order notes, order status and reviews you leave.
• Payment information: the payment reference, amount and status from Paystack or Monnify, and for bank transfers the one-time account you were given and the amount received. We never see or store your card details; they are handled by Paystack, a PCI-DSS certified processor.
• Instagram (vendors who choose to connect it): if you connect an Instagram Business or Creator account to import products, we receive an access token and your Instagram username, and, only when you open the import screen or import posts, your posts' photos, captions and links. We use them only to create product drafts you review before publishing. The token is stored encrypted, is never shown to anyone and is deleted when you disconnect, remove OpenStall in Instagram's settings, or ask us to delete it. Photos you import are copied into your store's product images and stay until you delete the draft or product. We never post, comment or message on your account.
• TikTok (vendors who choose to connect it): if you connect TikTok to import products, we receive access tokens and your TikTok display name, and, only when you open the import screen or import videos, your public videos' descriptions, cover pictures and links. We use them only to create product drafts you review before publishing, and to show a video you choose on a product page (played by TikTok's own player when a buyer taps it). Tokens are stored encrypted, never shown to anyone and deleted when you disconnect, remove OpenStall in TikTok's settings, or delete your account. We never post, comment or message on your account.
• Buyer protection cases: the problem you report, messages between you, the vendor and OpenStall, photos you upload (kept in private storage and shown only to the people on the case), and the outcome. For vendors, we also keep the record of upheld complaints, any penalty applied, and how quickly they replied.
• Referral programme: your referral code, who you referred, and the bank details you give us for bonus payouts.
• Technical data: IP address, browser and device type, and log data created when you use the site, used for security and troubleshooting.
• Communications: messages you send to our support channels.

Under section 25 of the Nigeria Data Protection Act 2023 (NDPA), we rely on the following lawful bases:

• Performance of a contract — creating and securing your account, processing orders and payments, sending order confirmations, receipts and status updates by WhatsApp, SMS and email (including one reminder about an order you started but didn't pay for), paying vendors and referral bonuses.
• Consent — creating your account (you tick a box at sign-up), and optional marketing messages. You can withdraw consent at any time; this does not affect processing already carried out.
• Legal obligation — keeping transaction records for tax and accounting, responding to lawful requests from regulators and law enforcement.
• Legitimate interests — preventing fraud and abuse, verifying vendors, running buyer protection (including showing each vendor's 48-hour reply rate on their store), sending vendors service announcements (each with an unsubscribe link), keeping the platform secure and improving our service. We balance these against your rights and do not rely on them where your interests override ours.

We do not sell your personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.

We share personal data only with service providers who process it on our instructions under written terms, and only as needed:

• Paystack (Nigeria) — payment processing, vendor subaccounts, payouts and transfers.
• Monnify (Moniepoint / TeamApt, Nigeria) — bank transfer collections, vendor subaccounts and settlements.
• Supabase (servers in the European Union) — database, account authentication and image storage.
• Vercel (United States / global edge network) — website hosting.
• Resend (United States) — transactional email such as receipts and order alerts.
• WhatsApp messaging — order messages are sent from OpenStall's WhatsApp number through our own messaging gateway (hosted on Railway) and delivered by WhatsApp (Meta).
• Termii (Nigeria) — SMS delivery.
• Google — only if you choose "Continue with Google", to confirm your identity.
• Instagram (Meta) — only for vendors who connect their account to import products; we read posts and captions, never your buyers' data.
• TikTok — only for vendors who connect their account to import products; we read public videos' details. If a product shows a TikTok video and a buyer taps play, TikTok's player loads from TikTok and TikTok's own privacy policy applies to that viewing.

We may also disclose data where required by law, a court order or a regulator, or to protect the rights, property or safety of our users or the public.

When you place an order, the vendor receives your name, phone number, delivery address (if any), order items and notes so they can fulfil and deliver it. If you report a problem with an order, the vendor and OpenStall staff handling the case see your report, messages and photos. Vendors must use this information only for your order and in line with the NDPA and our Terms of Service. If you have concerns about how a vendor used your data, contact the vendor and let us know at admin@mahhfaz.com.ng.

Some of our providers store or process data outside Nigeria (see section 4). Where this happens we rely on the safeguards permitted by sections 41–43 of the NDPA, such as the recipient country's adequate data protection laws, binding contractual clauses with the provider, or, where appropriate, your consent. You can ask us for details of the safeguards used.

• Account data: while your account is open. After you ask us to close it, we delete or anonymise it within 30 days, except what we must keep below.
• Orders, payments and payouts: up to six (6) years, to meet tax and accounting obligations and to handle disputes.
• Buyer protection cases (including photos): kept with the order record, as above. Vendor penalty records count for 90 days and are then kept only as part of that record.
• Technical and security logs: up to 12 months.
• Guest checkout details: kept with the order record as above.

Under sections 34–38 of the NDPA you have the right to:

• be informed about how we use your personal data;
• access a copy of your personal data;
• correct inaccurate or incomplete data;
• ask us to delete your data where there is no longer a lawful reason to keep it;
• restrict or object to certain processing, including processing based on legitimate interests and direct marketing;
• receive your data in a commonly used, machine-readable format (data portability);
• withdraw consent at any time;
• not be subject to decisions based solely on automated processing that significantly affect you.

You can download a copy of your data or delete your account yourself under "Your data" in your account's Security page (vendors: Dashboard → Settings). Deleting removes your personal details straight away and closes any stalls; order and payment records are kept as described in section 7, no longer linked to you. For anything else, email admin@mahhfaz.com.ng from the address on your account. We may need to verify your identity, and we will respond within 30 days. You can update most account details yourself in your account or dashboard settings.

If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

We use encryption in transit (HTTPS), hashed passwords, optional two-factor authentication, database row-level security so each user can only reach their own records, restricted staff access and signed payment webhooks.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the NDPC within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high, as required by section 40 of the NDPA.

We use essential cookies to keep you signed in and secure your session, and your browser's local storage to remember your cart and any referral link you followed. We do not use advertising or third-party tracking cookies. Blocking essential cookies will stop sign-in from working.

OpenStall is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has given us personal data, contact admin@mahhfaz.com.ng and we will delete it.

We may update this policy from time to time. We will post the new version here with a new effective date and, for material changes, tell you by email or in the app before they take effect.