Privacy policy
Last updated 9 November 2026
Draft: these terms are being finalised and may change before launch. Questions? Use the contact page.
This explains what we collect when you use Iyaloja, why, who helps us process it, and your rights. The business responsible for your data is (business name to be added before launch).
What we collect
- Account: your email address, and your name if you give it. Sign-in is handled by Supabase.
- Orders: what you bought, prices, order status, and a delivery address if a product needs one.
- Payments: handled by Paystack or Flutterwave. We receive the payment status, amount, reference and your email. We never see or store your card number.
- Support: chat messages, and your email and message if you ask to talk to a person.
- Newsletter: your email and the date you agreed, only if you sign up.
- SellerDesk: the products, customers, orders and notes you add to your workspace. You decide what goes in; we store it to run the service for you.
- Affiliates: your referral code, the audience description and payout details you give us, and which orders came through your link.
- Usage statistics: pages viewed, products viewed, items added to the bag and the website that sent you, linked to a random id that lasts only while your browser tab is open. We don't store your IP address with these. To limit abuse we keep a short-lived, scrambled (hashed) version of your IP address.
Why we use it
- To run your account, take payment, deliver downloads and handle refunds (to perform our contract with you).
- To answer your questions and keep the site secure (our legitimate interests).
- To send order emails, plus reminders about an unfinished checkout and a follow-up after purchase, each of which you can stop with one click (legitimate interests; you can object any time).
- To send the newsletter (your consent, which you can withdraw any time).
- To keep records the law requires, such as sales records for tax.
Who helps us
We share data only with services that run the shop for us:
- Supabase: database, sign-in and file storage
- Paystack and Flutterwave: payments and refunds
- Brevo: sending email
- OpenAI: answering shop-assistant questions and drafting SellerDesk content, when those features are on. Messages you type are sent to OpenAI to produce the answer, so please don't include personal details you don't need to share.
- Meta: only for posts we publish to our own Facebook Page; no customer data is sent.
Some of these providers process data outside your country. We rely on their contractual safeguards for those transfers.
Cookies and browser storage
- Sign-in cookies keep you logged in. They are necessary for the site to work.
- ml_ref remembers an affiliate link you followed, for 30 days, so the affiliate can be credited.
- Your bag is saved in your browser's local storage; the usage-statistics id lives in session storage and is cleared when you close the tab.
We don't use advertising cookies or third-party tracking.
How long we keep it
Account and SellerDesk data are kept while your account is open. Order and payment records are kept for as long as tax and accounting law requires. Usage statistics and support messages are deleted when no longer needed, normally within 24 months.
Your rights
Depending on where you live, including under Nigeria's Data Protection Act 2023 and the UK and EU GDPR, you can ask to see, correct, export or delete your data, object to or restrict how we use it, and withdraw consent. You can also complain to your data protection authority: in Nigeria, the Nigeria Data Protection Commission; in the UK, the Information Commissioner's Office. To make a request, email noreply@kelvaratech.com or use the contact page.
Changes
If we change this policy in a way that matters, we'll update the date above and, where appropriate, tell you by email.