Legal

Privacy Policy

Last updated: 19 May 2026

This Privacy Policy explains how Buvvo Technologies Ltd (RC 1928374), based in Lagos, Nigeria ("Buvvo", "we", "us"), collects, uses, shares, and protects personal information when you visit our website, join our waitlist, subscribe to updates, or use the Buvvo product to sell on WhatsApp. By using our services you agree to the practices described here.

1. Who this policy applies to

This policy covers visitors to our marketing website and waitlist, people who subscribe to our newsletter or fill out our surveys, and vendors and their team members who use the Buvvo dashboard and WhatsApp commerce tools.

When a vendor uses Buvvo to sell to their own customers, the vendor decides why and how their customers' personal data is processed and is the data controller for that information. Buvvo processes that customer data on the vendor's behalf as a data processor. This policy describes Buvvo's own processing; vendors are responsible for providing a privacy notice to their customers and for having a lawful basis to process customer data through Buvvo.

2. Information we collect

Information you give us directly.

• Waitlist and surveys: business name, email address, phone number, online presence or social handle, and location.
• Newsletter: your name and email address.
• Account registration and onboarding: your name, work email address, password (stored only as a salted hash), business name, and business category.
• Vendor business profile: business email and phone, physical and delivery address details, business hours, delivery areas, store logo, and store policies (return, refund, and warranty text).
• Team members: email addresses, assigned roles, and account status for people you invite to your workspace.
• Support and contact: the content of messages you send us, including the email address you contact us from.

Information about your customers (processed for vendors). When you operate a store on Buvvo, we process information about your end customers so the product can function, including customer names, phone numbers, WhatsApp identifiers, delivery addresses, order and order-status details, conversation and message content (including media), and payment references.

Information we collect automatically.

• Log and device data such as IP address, browser or client user agent, and request identifiers, recorded in our security and audit logs.
• First-party product analytics, for example page views and button interactions on our website and waitlist, used to understand and improve our services. We do not use third-party advertising trackers or marketing pixels.
• Cookies and similar technologies, described in the next section.

3. Cookies and similar technologies

The Buvvo product uses strictly necessary cookies to keep you signed in and to secure your session. These include an httpOnly access-token cookie and an httpOnly refresh-token cookie (retained for up to 30 days), plus a companion access-token cookie that is readable by the app so it can make authenticated requests from your browser. We do not use these cookies for advertising. We use first-party analytics events rather than third-party tracking cookies.

4. How we use information

• Provide, operate, and maintain the Buvvo website and product, including taking orders, confirming payments, and updating customers.
• Draft and send WhatsApp replies, including using artificial intelligence to generate suggested responses from conversation content.
• Process payments and reconcile transactions through our payment provider.
• Communicate with you about your account, waitlist status, product updates, and support requests.
• Maintain security, prevent fraud and abuse, keep audit trails, and meet legal obligations.
• Analyze usage to improve and develop our services.

5. How we share information

We do not sell your personal information. We share information only as needed to run the service, with service providers who process data on our behalf under appropriate confidentiality and data-protection obligations:

• Payment processing: Paystack processes card and transfer payments. Buvvo stores payment references, amounts, and authorization codes, not full card numbers.
• Messaging: the WhatsApp Business Platform (Meta) is used to send and receive messages with customers.
• Artificial intelligence: an AI model provider is used to generate suggested replies from conversation content.
• Email delivery: transactional and marketing email providers are used to send messages such as account, onboarding, and newsletter emails.
• Cloud infrastructure: cloud hosting, database, queue, and file-storage providers (including Microsoft Azure for media storage) host and process data to run the service.
• Legal and safety: we may disclose information where required by law, to enforce our terms, or to protect the rights, safety, and security of Buvvo, our users, or the public.

Some of these providers operate outside Nigeria, so your information may be transferred to and processed in other countries. Where this happens we take reasonable steps to ensure your information remains protected consistent with this policy and applicable law.

6. Data retention

We keep personal information for as long as your account is active or as needed to provide the service, and afterward only as long as necessary for legitimate business or legal purposes. Many records are soft-deleted first and then removed. Security and audit logs are retained for a limited period and then purged on a recurring schedule (retained for at least 30 days). Waitlist and newsletter details are kept until you ask us to remove them or unsubscribe.

7. How we protect information

We use reasonable technical and organizational measures to protect personal information, including encryption of data in transit (TLS), hashing of passwords with a strong salted algorithm, encryption of sensitive integration tokens at rest, role-based access controls, and audit logging. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

Subject to applicable law, including the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation, you may have the right to access, correct, update, or delete your personal information, to object to or restrict certain processing, to withdraw consent, and to lodge a complaint with the Nigeria Data Protection Commission. To exercise these rights, contact us at hello@buvvo.ng. If your request relates to data a vendor processes about you as their customer, please contact that vendor; we will support them in responding.

9. Children

Buvvo is intended for businesses and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will take appropriate steps to delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, provide additional notice. Continued use of our services after an update means you accept the revised policy.

11. Contact us

For privacy questions or to exercise your rights, contact Buvvo Technologies Ltd at hello@buvvo.ng. For product support, you can also reach us at support@buvvo.ng.