Privacy Policy

1. Who we are

Stalls (stalls.ng) is run by Stalls Ltd, a private company limited by shares registered in Nigeria, RC-9945860, Lagos, Nigeria (“Stalls”, “we”, “us”). Contact us at help@stalls.ng, which is also our data protection contact.

Stalls is a store builder. It gives independent sellers an online stall with one link. Sellers run their own stalls and are responsible for what they sell. We do not approve sellers or products in advance, and we do not scan what sellers say. We act only on reports.

2. Who this policy covers

• Buyers who order from a stall (you do not need an account).
• Sellers who open a stall, including Community members, and people who work for them.
• Visitors to stalls.ng and to individual stalls, including stalls on a seller's own domain.
• People on our early-access list and people who answer our vendor survey.
• WhatsApp group owners in our referral programme, and outreach reps who sign up at stalls.ng/outreach.
• People who leave a review, including through a review link.
• Anyone who contacts us, reports a listing, or asks for the Setup Service.
• People who appear in our videos and photos.

3. Our role: controller and processor

• Stalls is the controller (we decide why and how data is used) for: seller accounts and payout details, the early-access list, the vendor survey, the referral programme, the Setup Service, reviews, reports, support, security and server logs, our videos and photos, stall visit counting, and Stalls' own ad measurement. Sellers see the totals but don't decide how visits are counted.
• For buyer details on an order, the seller you buy from is a controller: they decide how to fulfil and follow up your order. Stalls runs checkout, order tracking and order emails for the seller, as the seller's processor. Stalls is also a controller for the parts it needs for its own purposes: payments and fee records, fraud and dispute handling, security, and our legal duties.
• For a seller's own ad pixels (Meta or TikTok), the seller chooses to switch them on and decides how to use the results. Stalls provides the code, shows the cookie notice and sends the events, so Stalls and the seller are both responsible, each for their own part.
• When a seller contacts you directly (for example on WhatsApp, or through a courier), the seller alone is responsible for that.

4. What we collect and why

4.1 Our legitimate interests

Where we rely on legitimate interests, they are: keeping Stalls secure and stopping fraud and abuse; handling disputes, refunds and chargebacks; answering support requests; acting on reports; moderating reviews; letting you reopen your order; crediting referrals; counting stall visits as daily totals so sellers can see how their stall is doing; improving the product from feedback; and keeping business statistics. We never use legitimate interests for profiling or targeted advertising; ad measurement runs only with your consent.

4.2 Data we no longer collect

We do not ask sellers for ID documents, NAFDAC numbers or CAC numbers when they sign up or open a stall. If a listing is reported, we may ask for evidence such as a registration number, a licence or proof of where a product came from. Before 28 October 2026 some sellers sent these with a seller application; that data is kept securely, visible only to the company's owners, and deleted as set out in section 8.

4.3 No sale of data, and no automated decisions

We do not sell personal data. We do not make decisions about you based only on automated processing that have legal or similarly significant effects. A person decides what happens when a listing is reported.

The assistant on our support WhatsApp is Zikora, an AI assistant and not a person. Our WhatsApp profile says so, it will tell you if you ask, and a person can take over. It answers questions and can open a ticket for our team. It can't refund you, move money, change your stall or decide anything about you.

4.4 Referrals: what a group owner or outreach rep can see

If you joined our early-access list or opened a stall through a WhatsApp group's or an outreach rep's link, they are credited. Each gets a private dashboard link. It shows how many people joined the list through their link (numbers only), and for each stall that joined through it: the stall's name, its link while it is live, whether it has opened, the date of its first sale, and each month's Stalls fee from its sales and their reward or commission. Because our fee is a share of sales, the fee gives a rough idea of how much the stall sold. They never see buyers, orders, contact details or bank details. Rewards are one level only. They also see how many people joined today and this week. Outreach reps also see how many WhatsApp group admins they introduced and how many signed as group partners (numbers only).

5. Who can see it inside Stalls

Access is by job, and one person may hold several jobs:

• Owners: everything, including the seller applications and ID documents collected before 28 October 2026.
• Trust and safety: seller contact and stall details, reported listings, the digital product files on a stall when a report needs it, and support tickets sent to them.
• Support: order look-up and seller contact details (read-only), Setup Service requests, feedback, the support inbox, every support ticket with its conversation, and support WhatsApp.
• Finance: orders and fees (read-only), business totals, referral statements and payouts, outreach reps' bank details, fee discounts, and support tickets sent to them.
• Referral programme: referral groups, outreach reps and their statements, reps' bank details, fee discounts, and support tickets sent to them.
• Growth: the early-access list, survey results, business totals, Setup Service leads, fee discounts, and support tickets sent to them.
• Content moderators: reviews, review links and review forms, and support tickets sent to them.
• Founders: business totals, the company books, and referral groups' and outreach reps' names, numbers and statements, read-only. They don't get buyers' details, orders, account numbers, ID documents or support messages.
• Technicians: one stall at a time, only after the seller asked for the Setup Service and agreed to the access, including that stall's digital product files. Every session and every change is logged. They also see support tickets sent to them.

A support ticket shows the summary and the conversation behind it. Support and owners see the whole chat. Anyone else a ticket is sent to sees only the part of the chat that led to that ticket or came in while it was open. Only support and owners see the WhatsApp number and name on it, unless you typed them in the chat. Staff are told about a new ticket on WhatsApp, and that alert says only what kind of ticket it is, never your details.

Staff are bound by confidentiality. Changes to who holds which job are logged. Staff see only the last 4 digits of an outreach rep's account number unless they choose to show it or export the month's payments, and each time is logged with who and when.

6. Who we share it with

We check that a request from an authority is lawful before we answer it, and we share only what it needs.

7. Moving data outside Nigeria

Some of our providers store or process data outside Nigeria: our website host (Vercel; server functions in Dublin, Ireland, with pages delivered through its worldwide network) and database (Supabase, Ireland), our email provider (Resend) in the United States, WhatsApp (Meta) for messages, Anthropic in the United States for our support assistant, and the server that runs the assistant (Truehost), which may be outside Nigeria. Their protection may not be the same as under Nigerian law. Where we send your data abroad, we rely on what the NDPA allows: for example, it may be needed to carry out your order or our contract with you, or you may have consented. We also use our providers' contract terms as an extra protection. When you open a stall, your request is handled in Ireland like any other web page, and the visit counted there.

If you accept the cookie notice, Meta (and TikTok, on stalls that use it) receive ad events from your browser, and, if we switch on our own ad measurement, Meta receives your purchase from our server with your email and phone hashed. They process this outside Nigeria, including in the United States. We rely on your consent for this, and the notice tells you before you choose. If you press to watch a YouTube or TikTok video on a product page, that service may also process your data outside Nigeria.

8. How long we keep it

Numbers stay. We keep sales, amounts, dates, stalls, items, checkouts, stall visit totals and survey answers after the personal details above are removed, so we can run the business and report totals. If something you typed still identifies you, tell us and we'll remove it.

Where no law sets a period, we remove or anonymise data no later than 6 months after the purpose is finished. We may keep data longer only where we need it for an actual legal claim. When time is up we delete or anonymise the data.

Once your details are removed we can't find your record, so we can't give you a copy of it or link it to you.

9. Your rights and how to use them

You can ask us to:

• confirm whether we hold your data and give you a copy, with what we use it for, who gets it, where it goes outside Nigeria, how long we keep it and where we got it;
• correct it (free where the mistake is ours);
• delete it when we no longer need it or have no lawful reason to keep it;
• restrict its use while we deal with a request or a dispute;
• object to use based on legitimate interests; we will stop unless we have strong reasons that override yours;
• stop direct marketing at any time; we will always stop;
• withdraw consent at any time, as easily as you gave it (“Stop reminders”, or after a free download “Stop [the seller] contacting me”, on your order tracking page, the stop link in each reminder or review email, “STOP” on WhatsApp, “Cookie choices” on a stall or at the bottom of our pages). Earlier use stays lawful;
• receive data you gave us under consent or contract in a common machine-readable format, or have it sent to someone else where we can;
• not be subject to decisions made only by automated means with legal or similarly significant effects.

How: email help@stalls.ng or message our support WhatsApp. Sellers can also correct most details in their dashboard. We may ask you to confirm who you are before we act. We aim to answer within 30 days, and will tell you if we need longer. For buyer data, because the seller also controls your order details, we may pass your request to the seller and help them answer it; we will tell you if we do. We may refuse or limit a request where the law requires us to keep the data (for example tax records) or we need it for a legal claim, and we will tell you why.

10. Marketing, reminders and messages

• Service messages we send because you used Stalls: receipts, order and delivery updates, password resets, account and policy notices. Refund updates show on your order tracking page.
• Reminder emails only if you ticked “Email me a reminder when it's time to reorder” at checkout: one before your product runs out, and one if you don't finish paying. Every reminder email has a link to stop them.
• WhatsApp reminders from the seller only if you ticked the separate box “The seller may also remind me on WhatsApp”. The seller's dashboard then lets them send you a message, from their own WhatsApp, when your product is about to run out or if you don't finish paying. Without that tick the seller gets no WhatsApp reminder button for you. To stop, use “Stop reminders” on your order tracking page, use the stop link in any reminder email, or reply STOP to the seller, who must record it. After that the seller's dashboard no longer offers you a reminder.
• Contact from the seller after a free download only if you ticked the box saying they can contact you. Without that tick the seller's dashboard doesn't show your contact details. To stop, use “Stop [the seller] contacting me” on your order page. You keep your download.
• A review email only if you ticked “Email me once after delivery to ask for a review” at checkout: one email after your order is delivered, with a link to stop review and reminder emails from that stall.
• All these boxes start unticked, and you can tick any of them or none.
• Early-access messages on WhatsApp only if you agreed on the early-access form, or left your number and ticked the box on our survey.
• We do not use our support WhatsApp number for marketing. Our assistant only answers: it doesn't start a chat with you or send broadcasts.

Sellers may contact you about your order. If a seller uses your details for anything else, that is the seller's responsibility.

11. Cookies and similar technologies

Necessary (no choice needed; the service cannot work without them). These are the only cookies and storage our pages use until you accept, or until you choose to watch a YouTube or TikTok video on a product page:

Optional (only if you choose Accept):

Where: sellers' pixels run only on stalls whose seller switched them on. Stalls' own Meta Pixel is switched off for now; if we switch it on, it would run on stalls and on our home, early-access, pricing, sign-up and survey pages, and you will be asked first. The referral cookie is only offered on a visit that came from a WhatsApp group's or an outreach rep's link. Pixels never run on our example stall or on test versions of the site, and test orders are never reported as purchases. Meta and TikTok use what they receive under their own privacy policies and may process it outside Nigeria (section 7).

Counting visits: stalls count visits as daily totals, without cookies and without anything stored on your device. To count unique visitors, and each step towards checkout once, we make a temporary daily code from your IP address, browser type and the stall. It is a one-way code, so we can't read your IP address or browser details from it, and it isn't linked to an order. It is still treated as personal data until it is deleted, within 2 days. We also keep a scrambled copy of your IP address for up to 2 days to stop abuse. We don't keep your IP address or browser details in readable form for this. Our server logs record this request like any other page request (section 8). If you reject our cookie notice, or your browser sends a privacy signal, we don't make this code. The totals are statistics, kept for good. They don't name any visitor, but on a very quiet stall a seller may be able to guess who a small number refers to. Bots, and a stall owner's or our staff's own visits where we can tell, are left out.

Product videos: sellers can add YouTube or TikTok videos to a product. The video plays from that service only if you press to watch it. The service then gets your IP address and browser details and may set its own cookies. The seller who added the video and Stalls are each responsible for their own part.

Your choice: on any page that would use an optional tool, a notice in the middle of the screen asks you to Accept or Reject before anything optional runs, and lists the tools and who is responsible for them. Reject, or not answering, means only the necessary items above are used. To change your mind, use Cookie choices (also at the bottom of any stall that uses a pixel, and of our own pages). You can also clear or block cookies in your browser; sign-in and order tracking may then stop working.

12. Security and breaches

Payments run through Paystack; we never see card details. We protect data with access by job, a log of technician work and of who sees reps' bank details, encrypted connections, and private storage; ID documents collected before 28 October 2026 are kept in a private store visible only to the company's owners. No system is perfectly secure.

If a breach is likely to put your rights at risk, we will report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it. If it is likely to put you at high risk (for example of fraud or identity theft), we will tell you straight away, in plain language, with what happened, what it may mean for you, what we are doing, what you can do, and who to contact. We keep a record of every breach.

13. Children

Stalls is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, tell us at help@stalls.ng and we will delete it unless the law requires us to keep it.

14. Complaints

Please tell us first at help@stalls.ng so we can put it right. If you are not satisfied, or you prefer not to come to us, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng). You can also go to court. Nothing in our terms stops you doing either.

15. Changes to this policy

We will post any change here with a new version and date. We will email sellers, and tell buyers and list members through the next message we send them, about material changes. If a change needs your consent, we will ask for it separately and will not assume it.

16. Contact

Stalls Ltd · RC-9945860 · Lagos, Nigeria · help@stalls.ng

See also the terms of use and the Seller Agreement.