Privacy Policy

Last updated: [DATE]

Draft notice: this policy is a working draft written to align with the Nigeria Data Protection Act 2023 (NDPA) and NDPR principles, based on the data TrustLock actually collects and processes as of this writing. It has not been reviewed by a lawyer. Before relying on it publicly — and before handling real users' personal data at any scale — have it reviewed by a Nigerian data-protection counsel, and register with the Nigeria Data Protection Commission (NDPC) if your data processing volume requires it under the NDPA's filing thresholds.

1. Who we are

TrustLock ("we", "us") operates an escrow platform that holds payment between a buyer and seller until agreed delivery conditions are met. This policy explains what personal data we collect, why, how long we keep it, and what rights you have over it, in line with the Nigeria Data Protection Act 2023.

2. What we collect

Account information: name, email address, and a hashed password (if you sign up with email/password) or a linked wallet address (if you sign in with a crypto wallet).
Identity verification (optional): if you choose to verify your identity, we submit your Bank Verification Number (BVN) and date of birth to our payment processor (Paystack) for one-time verification. We do not store your BVN — only the verification outcome (verified or not), the date, and the name returned by the verification.
Payout details (sellers only): bank account number, bank name, and the account name returned by our payment processor when you add a payout account.
Transaction data: what you're buying or selling, the amount, counterparty email, delivery notes, and the full history of status changes on a transaction.
Payment data: we do not store your card or bank transfer details directly — payments are processed by Paystack, a licensed payment service provider, and we retain only transaction references and outcomes.
Profile content: anything you choose to add — a bio, avatar image URL.
Technical data: IP address and basic request metadata, used only for rate-limiting and abuse prevention.

3. Why we process it (lawful basis)

Contract performance: account, transaction, and payout data are processed because they're necessary to provide the escrow service you've asked for.
Consent: identity verification (BVN check) is optional and only performed when you actively choose to initiate it.
Legitimate interest: rate-limiting/IP data is processed to prevent fraud and abuse of the platform.
Legal obligation: transaction records may be retained to meet financial record-keeping obligations under Nigerian law.

4. Who we share it with

We share the minimum data necessary with the following processors to operate the service:

Paystack — payment processing, identity (BVN) verification, and seller payouts.
Resend — sending transactional emails (verification links, transaction status notifications).
Our hosting and database providers — Vercel (application hosting) and Neon (database hosting), both of which store data on your behalf under their own security commitments.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. How long we keep it

Account and transaction data is retained for as long as your account is active, plus a reasonable period afterward for dispute resolution and financial record-keeping. Identity verification does not retain the BVN itself at any point — only the verification outcome persists. You may request account deletion at any time (see Section 7); some transaction records may be retained in anonymized or minimal form where required for legal/financial compliance even after account deletion.

6. Security

Passwords are stored hashed, never in plain text. Payment and bank details are handled by our licensed payment processor rather than stored directly on our servers. Access to administrative functions (dispute resolution, user management) is restricted to designated admin accounts.

7. Your rights

Under the Nigeria Data Protection Act, you have the right to:

Access the personal data we hold about you
Correct inaccurate data (via your profile settings, or by contacting us)
Request deletion of your account and associated data
Object to or restrict certain processing
Withdraw consent for optional processing (e.g. identity verification) at any time going forward

To exercise any of these rights, contact us at [PRIVACY CONTACT EMAIL].

8. Public profile information

Your name, avatar, bio, transaction ratings, and verification badges (email/ID/wallet) are visible to other signed-in TrustLock users as part of the platform's trust and reputation system — this is a core function of an escrow service, not optional data sharing. This information is not indexed by public search engines or visible to non-users.

9. Changes to this policy

We'll update the date at the top of this page when this policy changes, and post material changes visibly rather than silently.

10. Contact

Questions about this policy or your data can be sent to [PRIVACY CONTACT EMAIL].