Privacy Policy

Last updated: July 2026

1. Who we are

MerchantTech provides a unified inbox platform for Nigerian businesses — bringing WhatsApp, Instagram, and Telegram conversations into one real-time dashboard.

Under Nigeria's Data Protection Act 2023 (NDPA), MerchantTech acts as both a Data Controller and Data Processor for the personal data processed through our platform.

2. What data we collect

When you use MerchantTech, we collect:

• Account information — your name, email address, business name, and phone number when you register.
• Social account credentials — OAuth tokens and API keys for connected platforms (WhatsApp, Instagram, Telegram). These are encrypted at rest with AES-256-GCM.
• Messages — inbound and outbound conversations from your connected social accounts, stored so you and your team can view and reply.
• Usage data — IP addresses, browser user agents, and timestamps for security and audit purposes.

3. Why we collect it

All data collection serves one purpose: providing the unified inbox service you signed up for. Specifically:

• To display your conversations in one real-time dashboard
• To send replies on your behalf through connected platforms
• To maintain an immutable audit log for security and compliance
• To enforce plan limits and prevent abuse

We do not sell your data, use it for advertising, or share it with third parties except as required to provide the service (e.g., Meta APIs for message delivery).

4. How we store and protect your data

• All OAuth tokens and API keys are encrypted at rest using AES-256-GCM. Encryption keys are stored in environment variables, never in code or config files.
• Data is stored in PostgreSQL databases with access controls and encryption in transit (TLS).
• Every message access and account change is recorded in an immutable audit log.
• We conduct regular security reviews and maintain the principle of least privilege across our infrastructure.

5. Your rights under the NDPA

As a data subject under Nigerian law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data, subject to legal retention obligations.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing in certain circumstances.

To exercise any of these rights, contact us at privacy@merchanttech.co. We will respond within 30 days as required by the NDPA.

6. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 90 days, except where longer retention is required by law.

7. Data breach notification

In the event of a data breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) within the timeframe required by the NDPA.

8. Third-party services

Our platform integrates with third-party APIs (Meta, Telegram). Messages you send and receive through these platforms are subject to each platform's own privacy policies. We use only official APIs and do not employ unofficial workarounds that bypass platform security.

9. Changes to this policy

We will notify you of material changes to this policy via email or in-app notification before they take effect.

10. Contact

For privacy-related inquiries or to exercise your data rights, contact our Data Protection Officer at privacy@merchanttech.co.