Privacy policy

NEEDPLUG LIMITED (CAC registration number RC 9875324) is the data controller for Needplug. You can reach us at contact@needplug.ng. We are based in Lagos, Nigeria.

If you are a shopper, we collect:

• Your phone number. Buyers give it when a vendor needs to reach them; vendors give it when they sign up. It is how we identify a vendor across requests.
• The text of what you ask for, including anything else you type into the chat.
• The city or area you give us, so we can match you to nearby vendors. In the web chat you can also search for your street or a landmark: what you type, and the place you pick, go to Google to find it. The address you pick is saved on your own device, in your browser, and sent with your requests; change or clear it from the chat’s Menu. We keep it with your request so nearer vendors are asked first. We do not track your location.
• Request, quote and bargaining records: the item or service, quoted price, vendor, the prices you and the vendor send with the bargain buttons, any deal card you agree, your choice and any outcome you report. Needplug does not currently process escrow orders.

If you are a vendor, we also collect:

• Your full name, business name, registration type, and the state and town where your business is based.
• Your email address. We use it for vendor onboarding and account communications.
• If you sign up with Google, Google sends us your name and email address, and an ID for your Google account that lets you sign in with it later. We never see your Google password.
• Identity verification. Vendors must pass a NIN and live-selfie review. With your consent, we use your NIN, date of birth and camera selfie to verify your identity through our verification partner. We store the check result and reference, not your NIN or selfie. See Verification and payments below for details. Do not send identity documents or bank details in shopper chat.
• For business verification: your registered business name, CAC number, registration type and information confirming your connection to the business. We retain these details and the review outcome to manage your Registered business badge and a soft boost in matching.
• Your business website or portfolio link and a description of how you currently sell, if you give them.
• Verification payment references, amounts, payment status and retry history. We do not store your card details.
• Your response times, quote history and dispute record, which we use to decide who receives requests.
• Your bargaining record: the prices you send, the lowest price you set (never shown to customers), the deal cards you confirm, check, mark used or withdraw, with the reason you give, and each time you check a code.

Needplug does not collect shopper purchase payments or card details. Payment is arranged directly with the vendor. Do not include payment credentials in your request.

Needplug manages your verification and remains your point of contact. We use the following service providers to complete these checks and process verification fees:

• Prembly — identity and business checks. We send your NIN, date of birth and selfie for identity and liveness checks, and your registered business name, CAC number and registration type for business checks. Needplug reviews your connection to the business before awarding the Registered business badge. We retain the results, references and business-registration details; we do not retain raw NIN values or selfies.
• Paystack — verification payments. For optional CAC checks and earlier paid identity checks, Paystack processes your payment and card details on its secure checkout. We receive the payment reference, amount, fees and status so we can credit your verification and handle payment issues.

By giving consent in the verification form, you authorise these checks and the sharing needed to carry them out. Contact us using the details below if you have questions or want to withdraw consent.

Web chat uses a session cookie to recognise your browser and retrieve your messages. You do not need to supply a phone number to start a web request. We store web messages, a session identifier and expiry, browser user-agent information, and a hash of the connection address received by the backend. Session expiry does not itself delete message records.

The session cookie lasts 30 days, counted from the last day you used the chat: while you use it, we renew the cookie at most once a day, and a second small cookie that lasts one day records the renewal. Neither cookie holds your messages or your name.

On the website you can bargain and keep deal cards without an account. They are linked to the same browser session. Each card also has its own private link. Anyone you share the link or a saved picture of the card with can see the card, including its code, the agreed price, what it is for in your words, and the vendor’s business name and phone number, and can report a problem with it. The link does not show your name or phone number.

If you turn on browser alerts, we store your browser’s push subscription, its encryption keys, your notification preference and the account session it belongs to. We use these details to send request, message and deal updates through your browser’s push service, operated by providers such as Google, Apple, Mozilla or Microsoft. Notification text is general and does not include your name, address, message contents or deal code.

You can turn alerts off in Needplug or your phone settings. Delivery stops when the linked session expires or you sign out. Expired, inactive subscriptions without a saved opt-out are removed after 90 days; account deletion removes your subscriptions. The website does not cache private chats or dashboards for offline viewing.

• To match you with a vendor — necessary to perform the service you asked us for (NDPA s.25(1)(b)).
• To review reports about vendors and keep a record of requests and reported outcomes.
• To verify vendors and remove bad actors — our legitimate interest in running a service that buyers can trust.
• To record deal cards and look into reports about them — necessary to perform the service you asked us for, and our legitimate interest in vendors keeping the prices they agree.
• To understand visits to our public website — Google Analytics loads automatically on selected public pages and uses cookies to measure visits and general device information. It is disabled on staging and private account, chat and verification pages. We do not send names, email addresses, phone numbers, chat messages, verification details or URL query strings to Google Analytics. Advertising features are disabled. You can manage cookies through your browser settings. Analytics cookies are set for up to 90 days. See how Google uses information from sites that use its services.

We do not sell your data, and we do not use your request text to advertise to you or to anyone else.

• The vendors we match you with. A vendor receiving your request sees what you asked for and your area. Once you choose to contact a vendor, they see your phone number, because you are contacting them directly.
• The vendor on a deal card. They see the agreed price, what it is for and the deal number. A deal card does not give them your name or phone number, and we never send them your code; they see it only when you or someone you give it to shows it. If you are a vendor, your business name, verification status, rating and business phone number appear on the deal cards you agree, including the card’s link and saved picture, which the customer can share. Your address is never on the card.
• Request interpretation providers. When configured, Anthropic processes request text and collected request details that our local parser cannot understand, to identify the item or service, area and budget.
• Our hosting and infrastructure providers, who store the data on our behalf and may not use it for anything else.
• Law enforcement or regulators, where we are legally required to disclose.

Some of these providers operate servers outside Nigeria. Where data is transferred abroad we rely on the transfer conditions in Part IX of the NDPA.

• Request text and matching records: 12 months from the date of the request, then deleted.
• Order and escrow records: 6 years from completion. We are required to keep transaction records, and they are the evidence used to settle any dispute.
• Dispute records: 6 years from resolution, for the same reason.
• Vendor verification results: the outcome of each check and the provider reference, for as long as the vendor is on the platform and 12 months after removal. The NIN and BVN themselves are never stored, so there is nothing to delete.
• Bargaining records and deal cards: 12 months from the date of the request, like other matching records. The agreed terms on a deal card can’t be edited. If you delete your chat or account, your live cards are cancelled and their links stop working; the deal record itself is kept, without your name or contact details, until the 12 months are up.
• Handover codes: never stored in readable form at all. We store only a cryptographic hash, and we never send your code to a vendor.
• Deal card codes and links: unlike handover codes, these are stored in readable form, because you need to see your card again on any device. A deal code is not a payment code. It is checked only by the vendor you agreed with, and only when someone gives it to them.

Under the NDPA you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data. We will do this except where we are required to keep order or dispute records, and except for deal records, which we keep without your contact details as described above.
• Stop using your data for a particular purpose, or object to our use of it.
• Withdraw your consent, where we relied on consent.

To make any of these requests, email contact@needplug.ng from a message that lets us match you, or message us in your Needplug chat. We will respond within 30 days. We may ask you to confirm your identity first, so that someone else cannot request your data.

To ask us to stop messaging you, contact the team using the email address above.

If you think we have handled your data wrongly, tell us first at contact@needplug.ng. You also have the right to complain to the Nigeria Data Protection Commission.

Needplug is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete their data.

If we change this policy we will update the date at the top of the page. If the change is significant, we will tell you in the app before it takes effect.