Privacy Policy

1. Information We Collect

We collect the following categories of information:

Information you provide

• Account data. Name, email, phone, business name, business type, password (hashed).
• Billing data. Subscription plan, billing address, and payment method details. Payment card data is handled by our payment processors (Paystack, Flutterwave); we do not store full card numbers on our servers.
• Workspace content. Products, customers, orders, inventory, shipments, settings, and any other data you upload or create in your workspace — this may include personal data belonging to your own customers (see Section 10).
• Support communications. Messages and attachments you send us when you contact support.

Information collected automatically

• Device & usage data. IP address, browser type, operating system, referring URL, pages viewed, features used, and timestamps.
• Log data. Authentication events, API requests, and diagnostic information.
• Cookies & similar. See the Cookie Policy for details.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, secure, and improve the Service.
• Process payments and manage subscriptions.
• Authenticate users and prevent fraud or abuse.
• Send transactional notifications (account, billing, security, product changes).
• Send marketing communications you have opted into; you can opt out at any time.
• Provide customer support and respond to your requests.
• Comply with legal obligations and enforce our Terms.

3. Our Legal Basis for Processing

Under the NDPA, we rely on one or more of the following legal bases to process personal data: performance of our contract with you (providing the Service you signed up for), our legitimate interests (such as securing the platform and improving the Service), compliance with a legal obligation, and, where applicable, your consent (such as for marketing communications, which you may withdraw at any time).

4. How We Share Information

We do not sell your personal information. We share information only as described below:

Recipient	What we share	Why
Payment processors (Paystack, Flutterwave)	Name, email, amount, reference	To process payments
Email providers (PHPMailer / SMTP relay)	Email address, message content	To send transactional and marketing email
Hosting & infrastructure providers	Data stored on our behalf	To operate the Service
Analytics providers	Aggregated, anonymized usage data	To understand and improve the Service
Law enforcement or regulators	Information required by law	To comply with valid legal process
Acquirer or successor entity	Customer data in a merger/acquisition	To continue providing the Service

Workspace owners may also direct us to share their workspace data with third-party apps they connect to.

5. Cookies & Tracking

We use cookies and similar technologies to keep you signed in, remember your preferences, and measure how the Service is used. See our full Cookie Policy.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. If you cancel, we delete or anonymize your personal data within 90 days, except where retention is required for legal, tax, or audit purposes (typically 7 years for billing records, consistent with Nigerian tax record-keeping requirements).

7. Your Rights & Choices

Under the NDPA and, where applicable, other data protection laws, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Object to or restrict certain processing.
• Port your data in a machine-readable format.
• Withdraw consent at any time (for consent-based processing).
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC), or your local data protection authority, if you believe your rights have been violated.

To exercise these rights, email privacy@archevo.com. We will respond within 30 days, or sooner where required by law.

8. Security

We use administrative, technical, and physical safeguards designed to protect your information, including encryption in transit (TLS), hashed passwords (bcrypt), CSRF protection, rate limiting, and access controls. No system is perfectly secure; we cannot guarantee absolute security.

9. Data Residency & International Transfers

We aim to host workspace and personal data on infrastructure located in, or accessible to, our primary markets. Where data is transferred outside Nigeria (for example, to a hosting, email, or analytics provider located in another country), we take steps required under the NDPA to ensure an adequate level of protection — including using providers with appropriate safeguards, contractual data protection commitments, or other lawful transfer mechanisms recognized under the NDPA's cross-border data transfer requirements.

10. Tenants, Their Customers & Joint Responsibility

If you are a business using Archevo to run your own storefront ("tenant"), you collect personal data about your own customers (names, addresses, phone numbers, order history) through the Service. With respect to that customer data:

• You act as the data controller for your customers' personal data, and are responsible for having your own lawful basis to collect and use it (for example, a privacy notice on your storefront).
• Archevo acts as a data processor, processing that data only to provide the Service to you (hosting your storefront, processing orders, sending order confirmations).
• You are responsible for ensuring your own use of the Service, and any data you collect through it, complies with applicable data protection law.

This Privacy Policy describes how we, as Archevo, handle personal data in our role as both controller (for your account and billing data) and processor (for your customers' data within your workspace).

11. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

12. Changes

We may update this Privacy Policy from time to time. If a change is material, we will notify you by email or in-product. The "Last updated" date above reflects when the policy was last revised.

13. Contact & Data Protection Officer

For privacy questions or to exercise your rights, email privacy@archevo.com.

Our Data Protection Officer can be reached at the email below. If applicable, our NDPC registration reference will be published here.