1. Scope and controller
This Notice covers the Outbid Naija website, account and payment flows, public registry, moderation reports, analytics events, and support communications. The final controller identity, registered address, and Nigerian data-protection contact will be inserted after entity and counsel review and before live payments open.
The public Support route is the current contact point for privacy questions and data-subject requests. Do not place sensitive financial information in a support message.
2. Information we collect
Account information includes email address, username, display name, sign-in and verification records, account status, and an optional linked X handle. Placement information includes submitted names, statements, links, images, quote details, accepted legal version, territory, amount, timestamps, and source attribution.
Payment records include Paystack references, status, amount, currency, channel and authorization metadata returned by the provider, refund or reversal state, and fraud or reconciliation signals. We do not ask for or store your full card number, card PIN, bank password, or payment OTP.
Technical and support information may include IP and user-agent digests, security and rate-limit events, page and attribution events, cookies needed for authentication and source continuity, reports, emails, evidence, and operator actions.
3. Why we use information
We use information to create and secure accounts; issue and verify quotes; process, reconcile, refund, and evidence payments; publish the current map and append-only record; generate proof cards; attribute paid activity; prevent abuse; moderate content; answer support; comply with legal obligations; and evaluate whether the experiment should continue.
The intended legal bases include performing a contract, taking requested pre-contract steps, legitimate interests in operating and securing the service, consent where required, and compliance with law. The final basis-by-purpose mapping remains subject to Nigerian counsel review.
4. Information that becomes public
A confirmed placement can publicly show the submitted representation, patron username or display name, verification label, territory, value, timestamps, and event history. Proof-card links are designed to be shared. A removed or neutralised display may still leave a non-promotional ledger record of the confirmed event.
Do not submit personal information that you do not want associated with a public placement. Do not submit another person’s personal information without a lawful basis and any required permission.
5. Service providers and transfers
We expect to use Supabase for database and authentication infrastructure, Vercel for application hosting and platform logs, Paystack for payment processing, and an approved SMTP or email provider for sign-in and operational mail. Each provider processes information under its own security, location, and contractual arrangements.
Some providers or support personnel may process information outside Nigeria. Before live launch we will document the applicable transfer mechanism, provider terms, and safeguards required by Nigerian data-protection law.
6. Retention
Public ledger and transaction records are retained for the experiment, financial reconciliation, disputes, fraud prevention, audit, and legal obligations. Short-lived quotes, authentication attempts, rate-limit records, raw technical events, support evidence, and moderation material should follow narrower schedules proportionate to their purpose.
The final category-by-category periods, deletion process, backup treatment, and legal-hold procedure will be approved before live payments. We may retain a minimal record where deletion would undermine payment evidence, security, another person’s rights, or a legal obligation.
7. Your choices and rights
Subject to applicable law, you may ask for access, correction, deletion, restriction, objection, portability, withdrawal of consent, or information about automated handling. Some requests may be limited where records must be retained for payment evidence, fraud prevention, a legal claim, or another person’s rights.
Send a request through Support from the email connected to the account. We may verify identity before acting. You may also have the right to complain to the Nigeria Data Protection Commission; the final procedure and response timeline will be confirmed by counsel.
8. Security, children, and changes
Controls include least-privilege database roles, opaque public identifiers, hashed request diagnostics, rate limits, payment signature verification, append-only ledger rules, administrative holds, reconciliation jobs, backups, and operator runbooks. No system can guarantee absolute security.
Outbid Naija is not intended for people under 18 and does not knowingly accept paid placements from children. We may suspend an account and investigate if age or authority is in doubt.
Material changes receive a new version and date. This Notice is a pre-launch draft and live payments remain closed until Nigerian counsel approves the operative notice and data-handling schedule.