Privacy Policy

Stallify (https://stallify.store) is an online service that lets independent sellers create their own online store, manage products, stock and orders, and chat with customers. Shoppers use Stallify to browse stores, place orders and message sellers.Stallify is operated by Stallify. In this policy, “Stallify”, “we” and “us” mean the operator of Stallify.

Questions or requests about your privacy: email hastydaniel500@gmail.com. Website: https://stallify.store.

This policy explains what information we collect, why we collect it, how we use and share it, how long we keep it, and the choices and rights you have. We aim to comply with the Nigeria Data Protection Act 2023 and other data protection laws that apply to you.

Account information

• First name and last name (required), and an optional middle name.
• Email address (required), and an optional phone number.
• Your password. It is stored only as a secure one-way hash by our authentication provider; we never see or store it in readable form.
• Optional profile details you choose to add: gender, date of birth, country, state or region, city or town, and a profile picture.
• When you accepted our Terms of Service and this Privacy Policy.

Information from Google Sign-In

If you choose “Continue with Google”, Google shares only your name, your email address and your profile picture with us. We do not receive or ask for anything else from your Google account — no contacts, no files, no Gmail, no calendar and no other Google data. See section 4 for how we use it.

Store and product information (sellers)

• Store name, link, description, logo, banner, promotional banner, and contact details you add, such as a WhatsApp number.
• Products: names, descriptions, prices, pictures, videos, options, stock levels and categories.
• Delivery areas and fees, payment options, and pricing rates you set.
• Payout account (only if you choose to accept online payments): the bank name, the account holder's name and the last four digits of the account number. The full account number is sent securely to Paystack to set up your payouts; we do not keep it.

Referral programme

• Who signed up through your referral link, the rewards you earned and how you used them.
• If you ask for a cash withdrawal: your bank name, account name and account number, so we can pay you. Only our team can see the full account number; you see the last 4 digits.

Orders and delivery details

• The buyer's name, phone number, optional email address, delivery address, city and state, or pickup choice, and any order note.
• What was ordered, quantities, prices, delivery fee, order status and its history.
• Saved delivery addresses and shopping carts, if a signed-in buyer chooses to save them.

Messages, reviews and comments

• Chat messages and pictures exchanged between buyers and sellers, and reports of abusive messages.
• Product reviews (from real orders), comments, likes and reactions.
• Messages you send to our support team.

Payment information

Payments are processed by Paystack. Card details are entered on Paystack's secure pages and are never sent to or stored by us. We keep only the payment reference, amount, currency, payment method type (such as card or bank transfer), status and date, so we can confirm orders and subscriptions.

Security and abuse-prevention data

• Hashed IP addresses: when you create an account, we store a one-way, salted hash of your IP address (never the IP address itself) to limit how many accounts can be created from one network and to investigate abuse. A hash can't be turned back into your IP address.
• Short-lived rate-limiting records (also based on hashed identifiers) that stop repeated attempts and spam.
• Store visit counts: when someone views a store, we record a hashed visitor identifier that changes every day, so a seller can see how many people visited without anyone being identified.
• Basic technical logs (such as error messages) needed to keep the service running and secure.

Cookies and similar storage

• Sign-in session cookies, so you stay signed in securely.
• A short-lived cookie that remembers an email or phone number while you verify it.
• A referral cookie (30 days) if you arrive through someone's referral link.
• A random visitor cookie (one year) if you react to a product without signing in, so each visitor counts once; we store only a hash of it.
• Storage in your browser for your cart, recently visited store and light/dark theme preference.
• Cloudflare Turnstile may set a cookie when it checks that a form is being used by a person and not a bot.

We do not use advertising cookies or third-party tracking for advertising.

• To create and run your account (account and Google Sign-In data): signing you up and in, verifying your email or phone, keeping your account secure, and showing your name in menus and chats.
• To run stores (store and product data): publishing your store and products, managing stock, prices and delivery options, and showing your store in Explore if you allow it.
• To process orders (order and delivery data): passing the order to the seller so they can fulfil and deliver it, showing the buyer the order status, and sending order updates.
• To process payments (payment status): starting and confirming payments with Paystack, sending a seller's share to their payout account, and keeping subscription and billing records.
• To let buyers and sellers talk (chat messages): delivering messages, notifications and email reminders about unread replies, and handling reports of abuse.
• To send service emails: verification codes and links, order and payment updates, welcome and billing messages. You can turn off optional emails in your notification settings. We do not send marketing without your consent.
• To keep Stallify safe (hashed IPs, rate limits, logs): preventing fraud, spam, fake accounts and abuse, and meeting legal obligations.
• To improve the service: understanding, in aggregate, which features are used and fixing problems.

We process information to provide the service you asked for (performance of a contract), with your consent where required, to meet legal obligations, and for our legitimate interest in keeping Stallify secure.

When you sign in with Google, we receive your name, email address and profile picture from Google. We use them only to:

• create your Stallify account, or find your existing account, and sign you in;
• fill in your name on your profile (you can change it at any time); and
• show your name and picture to you inside your account.

We do not:

• sell Google user data;
• use Google user data for advertising, or for building profiles for advertising;
• share Google user data with anyone, except the service providers in section 5 that we need to run Stallify (for example, our database and email providers), or where the law requires it;
• allow humans to read Google user data, except with your permission, for security purposes, to comply with the law, or when it has been aggregated and anonymised.

Stallify's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Stallify's access to your Google account at any time at myaccount.google.com/permissions. To delete the data we already hold, see section 7.

We do not sell personal information. We share it only as needed to run Stallify:

• Sellers and buyers: when you order, the seller receives your name, contact details, delivery details and order so they can fulfil it; buyers and sellers see the messages they exchange. Store pages, products, reviews (first name and last initial) and comments are public.
• Supabase — our database, sign-in (authentication) and file storage provider, which stores the information described above.
• Paystack — processes payments for orders and subscriptions and pays sellers. Paystack handles card details under its own privacy policy and security standards.
• Resend — delivers our emails (verification, order updates, notifications), so it receives your email address and the content of those emails.
• Vercel — hosts the Stallify website and app, so it processes the requests your browser sends.
• Cloudflare — protects forms from bots (Turnstile) and helps deliver the site securely.
• SMS provider — only if you choose to verify a phone number, your number is sent to our SMS provider to deliver the code.
• Authorities — if the law requires it, or to protect the rights, safety and property of our users or the public.

These providers process information on our instructions and only to provide their service to us. Some of them may store or process data outside Nigeria; where that happens we rely on their contractual and security safeguards for international transfers.

Your information is stored in our Supabase database and file storage. We protect it with encrypted connections (HTTPS), database rules that keep each seller's and buyer's data separate, hashed passwords, optional two-step verification, and server-side checks on every payment. No system is perfectly secure, so please use a strong, unique password.

• Account, profile and store data: kept while your account is open, and deleted when you ask us to delete your account.
• Orders and payment records: kept for as long as the law requires for accounting and tax purposes, because both the seller and we need them.
• Chat messages: kept while the conversation's accounts are open, unless deleted earlier.
• Hashed IP addresses recorded at sign-up: deleted automatically after 90 days.
• Rate-limiting records: deleted after about a day.

• Access and correct: you can see and edit your name, contact details and profile at any time in your account (Me → Profile for shoppers, or Dashboard → Account for sellers).
• Export: email hastydaniel500@gmail.com and we will send you a copy of your personal information in a common, machine-readable format.
• Delete: email hastydaniel500@gmail.com from the address on your account and ask us to delete your account. We will delete or anonymise your personal information within 30 days, except records the law requires us to keep.
• Emails: turn optional emails on or off in Me → Notifications.
• Object or withdraw consent: where we rely on consent, you can withdraw it at any time by contacting us.

We reply to privacy requests within 30 days. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission or the data protection authority where you live.

Stallify is not for children. You must be at least 13 years old (or the minimum age of digital consent where you live, if higher) to create an account. We do not knowingly collect information from children under that age; if you believe a child has given us information, email hastydaniel500@gmail.com and we will delete it.

We may update this policy from time to time. We will post the new version on this page and change the “Last updated” date at the top. If the changes are significant, we will also tell you by email or in the app before they take effect.

Stallify — https://stallify.store
Privacy contact: hastydaniel500@gmail.com