1. Introduction
Welcome to Declotr ("we," "us," "our," or "Declotr"). We operate the Declotr mobile application (available on the Apple App Store and Google Play Store), the website located at declotr.com, and all related services (collectively, the "Platform").
Declotr is a social commerce marketplace that enables users to buy and sell products, participate in live selling sessions, create and view short-form video content (reels), engage in auctions, and connect with other users — all within a single mobile-first experience.
This Privacy Policy describes how we collect, use, disclose, and safeguard your personal data when you access or use our Platform. By creating an account or using any part of our Platform, you acknowledge that you have read, understood, and agree to this Privacy Policy.
If you do not agree with this Privacy Policy, please discontinue use of the Platform immediately.
2. Information We Collect
We collect information in several ways depending on how you interact with our Platform:
2.1 Information You Provide Directly
- Account Registration: When you create an account, we collect your first name, last name, email address, phone number, and password. You may also register via Google Sign-In or Apple Sign-In, in which case we receive your name, email, and a unique identifier from those services.
- Profile Information: Profile picture, bio, username, and other optional details you choose to provide.
- Seller Information: If you register as a seller, we collect business name, business address, bank account details (for payouts), identification documents, and any other information required for seller verification.
- Payment Information: When making purchases, we process payment data through our payment partners (Paystack and others). We do not store your full card number, CVV, or banking PIN. Payment tokens and transaction references are retained for order fulfilment and dispute resolution.
- Shipping Addresses: Delivery addresses you save for orders, including name, street address, city, state, zip code, and country.
- Communications: Messages you send via our in-app chat, customer support requests, feedback, and any content you submit through forms.
- User-Generated Content: Product listings, reviews, ratings, reels (video content), comments, live stream data, and any other content you create on the Platform.
- Auction Participation: Bid amounts, auction history, and related transaction data for live and manual auctions.
2.2 Information Collected Automatically
- Device Information: Device type, operating system and version, unique device identifiers, device model, screen resolution, and hardware specifications.
- Log Data: IP address, browser type, referring/exit URLs, pages viewed, access timestamps, session duration, and crash/error reports.
- Location Data: With your consent, approximate location data derived from your IP address, or more precise location data if you grant the app location permissions (used for relevant product discovery and delivery).
- Usage Data: Features used, pages visited, products viewed, search queries, interaction patterns, in-app navigation paths, and time spent on different sections.
- Push Notification Tokens: Expo Push Tokens (FCM tokens) for delivering notifications to your device. These tokens are stored and used solely for sending relevant notifications.
2.3 Information from Third Parties
- Social Login Providers: When you sign in via Google or Apple, we receive your name, email address, and a unique user ID from those services. We do not receive or store your social media passwords.
- Payment Service Providers: Transaction confirmations, payment status updates, and fraud screening results from Paystack and other integrated payment gateways.
- Analytics Providers: Aggregated usage statistics from analytics services to understand how users engage with our Platform.
3. How We Use Your Information
We use the information we collect for the following purposes:
3.1 Platform Operations & Service Delivery
- Create, manage, and authenticate your account
- Process orders, payments, refunds, and deliver products
- Facilitate buyer-seller transactions and communications
- Enable live selling sessions, auctions, and real-time bidding
- Manage your shopping cart, wishlists, and favourites
- Process seller payouts and manage seller wallets
3.2 Personalisation & Recommendations
- Display relevant products and content based on your interests and browsing behaviour
- Curate your home feed, reel recommendations, and search results
- Suggest sellers, products, and categories you may be interested in
3.3 Communication
- Send transactional notifications (order confirmations, shipping updates, payment receipts)
- Send push notifications for relevant updates (new orders, auction alerts, promotions)
- Respond to your inquiries, support requests, and feedback
- Send promotional communications (with your consent, where required by law)
3.4 Safety, Security & Legal Compliance
- Detect and prevent fraud, abuse, and unauthorised access
- Monitor and enforce compliance with our Terms of Service and community guidelines
- Verify seller identities and business legitimacy
- Comply with legal obligations, court orders, and regulatory requirements
- Resolve disputes between buyers and sellers
3.5 Improvement & Analytics
- Analyse usage patterns to improve Platform features and user experience
- Conduct A/B testing and product development research
- Generate aggregated, non-identifiable statistics and business insights
- Debug technical issues and optimise performance
4. Legal Basis for Processing
Depending on your location, we rely on the following legal bases to process your personal data:
| Legal Basis | Examples |
|---|---|
| Contractual Necessity | Processing your order, managing your account, facilitating transactions between buyers and sellers |
| Legitimate Interest | Fraud prevention, Platform security, improving our services, personalised recommendations, analytics |
| Consent | Marketing communications, precise location data, optional cookies and tracking, push notifications |
| Legal Obligation | Tax reporting, regulatory compliance, responding to lawful government requests, anti-money laundering |
For users within the European Economic Area (EEA), United Kingdom, or other jurisdictions with similar data protection laws (e.g., Nigeria Data Protection Act 2023), you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
6. Data Storage & Security
We implement industry-standard technical and organisational security measures to protect your personal data, including:
- Encryption: All data transmitted between your device and our servers is encrypted using TLS/SSL (HTTPS).
- Password Security: Passwords are hashed using bcrypt with salting, and are never stored in plain text.
- Access Controls: Role-based access controls limit employee access to personal data on a need-to-know basis.
- Secure Payment: Payment information is processed by PCI-DSS compliant payment processors. We do not store full card details.
- Database Security: Databases are firewalled and access-restricted with authentication and encryption.
- Regular Audits: We periodically review our security practices and update safeguards as necessary.
- Webhook Verification: All payment webhooks are verified using HMAC-SHA512 signatures to prevent tampering.
While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly address any data breach in accordance with applicable laws.
7. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Specifically:
- Account Data: Retained for the duration of your account's existence and for a reasonable period after account deletion to resolve disputes and comply with legal obligations.
- Transaction Data: Retained for a minimum of 6 years after the transaction for tax, accounting, and regulatory compliance purposes.
- Communication Records: Retained for as long as needed to resolve support issues and for up to 3 years for quality assurance.
- Log & Analytics Data: Typically retained for 12–24 months, then aggregated or anonymised.
- Marketing Preferences: Retained until you withdraw consent or unsubscribe.
When data is no longer needed, it is securely deleted or anonymised so that it can no longer be linked to you.
8. Your Rights
Depending on your jurisdiction, you may have some or all of the following rights regarding your personal data:
- Right of Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete personal data.
- Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
- Right to Restrict Processing: Request temporary restriction of processing while we verify accuracy or assess legitimate grounds.
- Right to Data Portability: Receive your personal data in a structured, commonly used, machine-readable format and transfer it to another service.
- Right to Object: Object to processing based on legitimate interests, including profiling and direct marketing.
- Right to Withdraw Consent: Where processing is based on consent, withdraw your consent at any time without affecting prior lawful processing.
- Right Not to Be Subject to Automated Decision-Making: Request human review of decisions made solely by automated means that significantly affect you.
To exercise any of these rights, please contact us at privacy@declotr.com. We will respond within 30 days (or sooner if required by applicable law). We may need to verify your identity before fulfilling your request.
Nigeria Data Protection Act (NDPA) 2023
If you are a Nigerian data subject, you have specific rights under the Nigeria Data Protection Act 2023 and the regulations issued by the Nigeria Data Protection Commission (NDPC). We process your data in compliance with the NDPA, including ensuring lawful processing, data minimisation, and providing adequate security measures.
Additional Rights for California Residents (CCPA/CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to delete, and the right to opt out of the sale of personal information. We do not sell personal information.
10. Third-Party Services
Our Platform integrates with or links to third-party services. These services have their own privacy policies, and we encourage you to review them:
- Paystack (Payment processing) — paystack.com/privacy
- Google Sign-In (Authentication) — policies.google.com/privacy
- Apple Sign-In (Authentication) — apple.com/legal/privacy
- Firebase / Google Cloud (Push notifications, analytics) — firebase.google.com/support/privacy
- Expo (Push notification delivery) — expo.dev/privacy
We are not responsible for the privacy practices of third-party services. Any information you provide directly to third parties is subject to their privacy policies.
11. Children's Privacy
Declotr is not intended for children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided personal information to us, please contact us at privacy@declotr.com, and we will promptly delete such information.
Users between the ages of 13 and 18 must have parental or guardian consent to use the Platform.
12. International Data Transfers
Declotr operates globally. Your personal data may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.
When we transfer data across borders, we implement appropriate safeguards including:
- Standard Contractual Clauses (SCCs) approved by relevant data protection authorities
- Ensuring receiving parties maintain equivalent levels of data protection
- Compliance with the Nigeria Data Protection Act 2023 for international transfers from Nigeria
By using the Platform, you consent to the transfer of your data to countries where our servers and service providers operate.
13. App Permissions
The Declotr mobile app may request the following device permissions. You can manage these permissions through your device settings at any time:
| Permission | Purpose | Required? |
|---|---|---|
| Camera | Take photos/videos for product listings, reels, profile pictures, and live selling | Optional |
| Microphone | Record audio for reels and live selling sessions | Optional |
| Photo Library | Select images/videos from your device for listings and content creation | Optional |
| Push Notifications | Receive order updates, auction alerts, messages, and promotional content | Optional |
| Location | Show relevant nearby products and calculate delivery estimates | Optional |
| Internet Access | Core app functionality — connecting to our servers | Required |
Denying optional permissions will not prevent you from using the core features of the app, but some functionality may be limited.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes:
- We will update the "Last Updated" date at the top of this policy
- We will notify you via email and/or in-app notification for significant changes
- We will post the revised policy on our website and within the app
Your continued use of the Platform after the revised policy becomes effective constitutes your acceptance of the updated terms. We encourage you to review this policy periodically.
15. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:
If you are not satisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with:
- The Nigeria Data Protection Commission (NDPC) — ndpc.gov.ng (for users in Nigeria)
- Your local data protection supervisory authority (for users in the EEA/UK)
- The relevant regulatory body in your jurisdiction