Privacy Policy

It matters which kind of user you are, because our responsibilities differ.

• For business owners who register a store, we are the data controller. We decide how your account data is handled.
• For customers who buy a voucher from a store, the business that runs that store is the controller of its customer relationship. We process that data on the platform's behalf so the sale can complete and the voucher can be delivered.

In practice this means a question about your purchase is usually best directed to the store you bought from, though you can always contact us and we will help.

If you register a business account:

• Your business name and the store link you choose.
• Your email address and, if you provide it, your phone number.
• Your password, stored only as a scrypt hash. We never store or see the password itself.
• Your Paystack public key, and your Paystack secret key in encrypted form.
• Records of the plans, voucher codes and sales belonging to your store.

If you buy a voucher:

• Your email address, so the voucher can be sent to you and so you can prove the purchase is yours.
• The transaction record — plan bought, amount, currency, status, payment reference and time.
• Which voucher code was issued to you, and when it was issued.

Everyone:

• A session cookie, if you log in. It is httpOnly, so it cannot be read by scripts in your browser.
• Your IP address, held briefly in memory to rate-limit logins and payment attempts. It is not written to our database.

We do not collect card numbers, CVVs or bank credentials. Card details are entered on Paystack's own checkout and never reach our servers.

• To perform our contract with you — creating your account, running your store, taking payment and delivering the voucher you paid for.
• For our legitimate interests — keeping the platform secure, preventing fraud and abuse, rate-limiting attacks, and fixing faults.
• To comply with legal obligations — keeping transaction records for tax, accounting and dispute purposes.

We do not sell personal data, and we do not use it for advertising or profiling.

A business owner's Paystack secret key is encrypted with AES-256-GCM before it is stored, using a key held separately from the database. It is decrypted only in memory, on our server, at the moment it is needed to charge that store's customer.

It is never returned to any browser and never appears in any dashboard or API response. Your dashboard shows only the last four characters, so you can confirm which key is on file. It cannot be hashed, because we must be able to use it to take payments on your behalf.

We rely on a small number of service providers, each handling data only to run the platform:

• Paystack — payment processing and settlement.
• Supabase — database hosting.
• Render — backend application hosting.
• Vercel — website hosting and delivery.
• Google (Gmail SMTP) — sending voucher and receipt emails.

Some of these providers operate servers outside Nigeria. Where data is transferred abroad, we rely on providers that offer an adequate level of protection and appropriate safeguards.

We may also disclose data where we are legally required to, or to establish or defend a legal claim.

• Business account data is kept while your account is open, and deleted or anonymised on request after closure unless we must retain it.
• Transaction and voucher records are kept as business records, so that sales can be verified and disputes resolved, and to meet tax and accounting obligations.
• Encrypted gateway keys are deleted when you replace them or close your account.
• IP addresses used for rate limiting are held only briefly in memory and are not retained.

• Passwords are hashed with scrypt and compared in constant time; they are never stored in readable form.
• Payment gateway secrets are encrypted at rest with authenticated encryption.
• Sessions use httpOnly, Secure cookies and can be revoked; logging out invalidates the session on the server, not just in your browser.
• Every request is scoped to the account that made it, so one business cannot read or change another's plans, codes, keys or sales.
• Traffic is served over HTTPS, and login and payment endpoints are rate-limited.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and affected users as the law requires.

Under the Nigeria Data Protection Act 2023 you may ask us to:

• Confirm what personal data we hold about you, and give you a copy.
• Correct data that is inaccurate or incomplete.
• Delete data where there is no lawful reason for us to keep it.
• Restrict or object to certain processing.
• Provide your data in a portable format.
• Withdraw consent, where processing was based on consent.

Write to support@apexlinks.ng and we will respond within the period the law allows. You also have the right to complain to the Nigeria Data Protection Commission.

We use one cookie, and only when you log in: a session cookie that keeps you signed in. It is strictly necessary for the dashboard to work, and clearing it simply logs you out. We do not use advertising or tracking cookies.

The platform is intended for adults running or buying from a business. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as the platform changes. The date at the top shows when it was last revised, and we will give notice of material changes.

For any privacy question, or to exercise a right above, contact Evolve Media Global LTD at support@apexlinks.ng.