Privacy Policy

This Policy applies to two groups of people:

• Sellers: business owners who create a SweeftMerce account to sell products through WhatsApp.
• Buyers: customers who interact with a seller's WhatsApp number powered by SweeftMerce, browse products, place orders, or make payments.

If you are a Buyer, please note that the Seller you are purchasing from is responsible for their own handling of your information outside of the SweeftMerce platform.

We use personal data for the following purposes:

SweeftMerce uses artificial intelligence to answer buyer questions and assist with placing orders on behalf of sellers. Please note:

• AI responses are generated automatically based on the seller's product catalogue and the buyer's messages.
• The AI does not make final purchase decisions. All orders, cart contents, and payments are reviewed and approved by the buyer on a secure SweeftMerce checkout page before any payment is made. The prices and details shown at checkout are authoritative.
• Conversation data used to generate responses is processed transiently and is not used to build profiles of buyers.

We share personal data only with service providers necessary to operate the platform:

• WhatsApp gateway provider: to send and receive WhatsApp messages on behalf of sellers.
• Payment processor (e.g., Korapay): to process buyer payments and seller payouts. The processor handles card/bank data under its own privacy policy and regulatory licences.
• Delivery/logistics partner (e.g., ShipBubble): to arrange delivery. They receive the delivery address and contact details needed to fulfil the order.
• Cloud hosting and infrastructure providers: our application and databases are hosted with reputable cloud providers.
• AI model providers: buyer messages and relevant catalogue context may be transmitted to third-party AI providers to generate responses. These providers are contractually restricted from using this data for other purposes.

Each of these providers acts as a data processor or independent controller under their own privacy terms, and we take reasonable steps to ensure they provide adequate data protection.

We may also disclose personal data where required by law, court order, or a competent regulatory authority.

Some of our service providers store or process data on servers located outside Nigeria. Where personal data is transferred outside Nigeria, we take steps to ensure the transfer complies with the NDPA, including using providers with adequate data protection standards and contractual safeguards.

• Seller account data is retained for as long as your account is active, and for a reasonable period afterwards as required for legal, accounting, or dispute-resolution purposes.
• Order and transaction records are retained as required by applicable financial and tax regulations.
• Conversation content is not retained beyond the real-time processing needed to respond and facilitate orders.
• Verification tokens expire automatically within minutes of issuance.

When data is no longer required, we delete or anonymise it.

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption of data in transit (HTTPS/TLS);
• Hashed storage of passwords;
• Access controls limiting who can view personal data;
• IP whitelisting and secure infrastructure for payment-related communications;
• Two-factor verification of account ownership.

No system is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights, we will notify the NDPC and affected individuals in accordance with the NDPA.

Under the NDPA, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Rectification: request correction of inaccurate or incomplete data;
• Erasure: request deletion of your data, subject to legal retention requirements;
• Restriction: request that we limit how we process your data;
• Objection: object to processing based on legitimate interest;
• Data portability: receive your data in a structured, commonly used format;
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@sweeftmerce.tech. We will respond within the timelines required by the NDPA.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Our website uses essential cookies to keep you signed in and to secure your session. We may use basic analytics to understand how the website is used. You can control cookies through your browser settings, though disabling essential cookies may affect site functionality.

SweeftMerce is intended for users who are 18 years of age or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a person under 18, we will delete it promptly.

Sellers who access buyer information (such as names, phone numbers, and delivery addresses) through SweeftMerce must handle that information lawfully and only for the purpose of fulfilling orders. Sellers must not use buyer data obtained through SweeftMerce for unsolicited marketing or share it with third parties without a lawful basis.

We may update this Privacy Policy from time to time. If we make material changes, we will notify sellers via the email or WhatsApp number associated with their account and update the “Last Updated” date above. Continued use of the platform after changes take effect constitutes acceptance of the revised Policy.

If you have questions about this Privacy Policy or how we handle your data, contact: