Privacy Policy

Vendstruct hosts many independent shops. Whose data we are looking after, and who is answerable for it, depends on which of the two you are.

Business owners and staff

If you open a Vendstruct account or work in a store as staff, we are the data controller of your account data. This policy governs it, and you can exercise your rights directly with us.

Shoppers on a store

If you bought something from a shop hosted on vendstruct.com, that business is the data controller of your details. We are only its data processor: we hold the records on their behalf and act on their instructions.

Shoppers: please contact the shop you bought from first. Their contact details are in the footer of their site. We cannot hand over, correct or delete a store's customer records on request from someone who is not that store, because they are not ours to decide about. We will pass a request on and help the business answer it.

Your account

Your name, email address, phone number if you give one, and a password we never store in readable form. Plus which stores you own or work in, and your role in each.

Your store

Everything you enter to set it up: business name, address, city and state, support email and phone, WhatsApp number, opening hours, delivery bands, branding, and the bank account details you show at your own checkout.

Your catalogue

Products, prices, stock, categories and the images you upload. Images are stored in our database rather than sent to a third party image host.

Shopper records, held for the store

Where a shopper creates an account with a shop: name, email, phone, delivery address, and a hashed password. Where they place an order: name, email, phone, delivery address, what they bought and what it cost.

Billing

Which plan a store is on, its invoices and their status. Card details are entered on Paystack's own pages and never reach us, and we do not store them.

Audit and technical data

An append only record of who changed what and when, including the IP address and browser the change came from. Sign in attempts, successful and failed, are recorded the same way.

Our audit log deliberately redacts anything that looks like a password, token, secret or card detail before it is written, so a record of a change never becomes a copy of the request that made it.

We use cookies only to keep you signed in. There is no advertising cookie, no analytics cookie and no third party tracker on Vendstruct or on any store we host.

Vendstruct account

Keeps you signed in to your console for 14 days.

Store admin

Keeps staff signed in to a store's admin for 8 hours. Deliberately short, because it reaches a live shop and its money.

Shopper account

Keeps a shopper signed in to one shop for 30 days.

Each cookie is signed, restricted to the host that set it, and marked so that scripts cannot read it. A session for one shop is worthless on another. Because all three are strictly necessary to provide a service you asked for, we do not ask for consent to set them. Your cart is kept in your own browser's storage rather than in a cookie, and never reaches us until you check out.

Under the Nigeria Data Protection Act 2023 we must have a lawful basis for each use. Ours are:

To provide the service

Running your store, showing your catalogue, taking orders, sending order and account emails. Basis: performance of our contract with you.

To take payment

Raising and settling subscription invoices. Basis: performance of our contract with you.

To keep it secure

Detecting abuse, rate limiting sign in attempts, keeping an audit trail, investigating incidents. Basis: our legitimate interest in a platform that is not defrauded or broken into, and the security duty the Act places on us.

To support and improve it

Answering your questions and understanding which parts of the product are struggling. Basis: our legitimate interests, balanced against your privacy.

To meet legal duties

Keeping financial records, and responding to a lawful request from an authority. Basis: legal obligation.

Marketing

We only send product news to business owners who asked for it, and every message has an unsubscribe link. Basis: consent. Order and account emails are not marketing and cannot be turned off while the account is open.

We do not sell personal data, we do not rent it, and we do not use your store's customer records for our own marketing.

We keep the list of processors short on purpose. Each is bound to use the data only to provide their service to us.

Neon

Our managed PostgreSQL database. Everything described above is stored here.

Resend

Sends transactional email: confirmations, verification links, staff invitations and order updates.

Paystack

Takes subscription payments from businesses. They receive the payer's email and the amount. Card details go to them directly and never pass through us.

Our hosting provider

Serves the application and keeps request logs for a short period as part of running the infrastructure.

We may also disclose data where the law requires it, to establish or defend a legal claim, or to protect someone's safety. If our business is ever sold or merged, personal data may transfer with it, and we will tell you before that happens.

A store's data is scoped to that store in every query we run. One business cannot see another's products, orders, customers or images, and a shopper account created at one shop grants nothing at another.

Some of the providers above operate outside Nigeria, so personal data may be stored or processed abroad. Where that happens we rely on the transfer conditions in the Nigeria Data Protection Act and put contractual safeguards in place with the provider, so your data keeps substantially the same protection it has here. Tell us if you would like details of the safeguards for a particular provider.

While your account is open

Your account, store, catalogue, orders and customer records are kept for as long as you keep using the service.

A closed store

Nothing is destroyed at once. A closed store sits in your recycle bin for 30 days and can be reopened exactly as it was. After that it is deleted permanently.

Deleted products and images

The same 30 day window, so a mistake is always recoverable.

Audit history

How far back a store can read is set by its plan: 60 days on Basic, twelve months on Pro, unlimited on Plus. Nothing is pruned before its window is up.

Invoices and payment records

Kept for as long as tax and company law require us to, which is longer than the account itself may last.

• Passwords are hashed with bcrypt and never stored or logged in readable form. We cannot tell you your password, only help you set a new one.
• Every database query is scoped to one store, so a bug in a page cannot reach another shop's rows.
• Roles and permissions are checked on the server for every page and every request, not merely hidden in a menu.
• Session cookies are signed, host scoped and unreadable to scripts, and a staff session lasts only eight hours.
• Payment webhooks are verified against the provider's signature on the raw body, and an amount is always confirmed against our own records before a plan moves.
• An append only audit log records who changed what, from where, so an incident can actually be reconstructed.
• Access to production data is limited to the people who need it to operate the service.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify the Nigeria Data Protection Commission and the people affected as the Act requires, and tell you what happened and what we have done.

Under the Nigeria Data Protection Act 2023 you may:

• ask what personal data we hold about you, and get a copy of it
• have inaccurate data corrected
• ask us to delete data we no longer have a reason to keep
• ask us to restrict how we use it while a concern is looked into
• object to processing we base on our legitimate interests
• receive the data you gave us in a portable form, or have it sent to another provider where that is technically feasible
• withdraw consent at any time, where consent is what we relied on
• not be subject to a decision made solely by automated means that significantly affects you. We make none.

Much of this you can do yourself: your profile is editable from your account, your store settings from its admin, and closing a store from your console.

For anything else, write to privacy@vendstruct.com. We answer within 30 days, and we may ask you to confirm who you are first so we do not hand your data to someone else. If you are unhappy with our answer you can complain to the Nigeria Data Protection Commission at ndpc.gov.ng.

You are the controller of your shoppers' data, and we process it for you. That puts some duties on you rather than on us:

• publish your own privacy notice telling your customers what you collect and why
• only collect what you actually need to fulfil an order
• answer your customers' requests about their own data, and tell us if you need our help to do it
• keep your staff accounts tidy, and revoke access the day someone leaves
• tell us promptly if you believe your store's data has been exposed

We will only act on your instructions in respect of your customers' data, we will not use it for our own purposes, and we will help you meet a request or investigate an incident.

Vendstruct is a tool for businesses and is not directed at children. You must be at least 18 to open an account. If you believe a child has given us personal data, tell us and we will delete it.

We update this policy as the product and the law change. The effective date at the top of the page always tells you which version is current, and we will give notice by email or in your console before a change that materially affects you takes effect.