This policy covers anyone who uses EPWT — buyers, guests, and paid members. EPWT is the data controller for the information described here.

We collect only what we need to run the marketplace:

• Account & sign-in: your phone number, or the email/name from Google or Apple sign-in, depending on how you sign in. We use these to identify your account.
• Profile: your name and a contact email if you provide one, and an optional profile photo.
• Delivery: the addresses you save — recipient name, phone, street, and state — used to deliver your orders and to calculate delivery fees.
• Orders: the items you buy, order amounts, delivery and status history, and any disputes or cancellations.
• Membership & earnings (members): your membership status, referral code, referral relationships, earnings ledger, and — for withdrawals — your bank details (bank, account number, resolved account name).
• Preferences & notifications: your privacy toggles and the in-app notifications generated by your activity.
• Technical: basic device/app information needed to deliver the service securely (for example, to keep you signed in).

We do not collect or store your full card details — card payments are handled by Paystack (see section 4). We do not ask buyers or members for NIN or BVN; that is part of vendor verification, which is not yet live (see section 9).

• To create and secure your account and keep you signed in.
• To take payment, fulfil and deliver your orders, and provide support.
• To calculate pricing and delivery fees, and to show member pricing to active members.
• To operate membership, referrals, earnings and withdrawals for members.
• To send you order, payment, and account notifications, and — only where you allow it — promotional messages.
• To detect and prevent fraud and abuse, and to meet legal and regulatory obligations.

We rely on the lawful bases of performing our contract with you (fulfilling your orders), your consent (for optional marketing and push notifications), our legitimate interests (security and fraud-prevention), and legal obligation, as applicable.

Payments and refunds are processed by Paystack. When you pay, you interact with Paystack directly, and Paystack processes your card or bank details under its own privacy terms — EPWT does not receive or store your full card number. For member withdrawals, we share your bank account number and name with Paystack to verify the account and to send the transfer. Refunds are always returned to your original payment channel through Paystack, never to an in-app balance.

We do not sell your personal information. We share it only as needed to run the service:

• Paystack — to process payments, verify bank accounts, and send withdrawals.
• Google Firebase — our infrastructure provider, which hosts authentication, our database, storage and messaging on our behalf (see section 6).
• EPWT coordinators — the delivery details needed to ship and deliver your order.
• Law enforcement, banks or regulators — where we are required by law, or to investigate fraud or a breach of our Acceptable Use Policy.

Your data is stored using Google Firebase (authentication, database, file storage and messaging), which processes data on our instructions as our processor. Some of this processing may occur on servers outside Nigeria; where it does, we rely on the provider's safeguards for such transfers. We apply access controls so that only authorised EPWT systems and staff can reach your data.

We keep your information for as long as your account is active and as long as we need it to provide the service. We keep order, payment and payout records for longer where we are required to for legal, tax, accounting or fraud-prevention reasons. When data is no longer needed, we delete or anonymise it.

Subject to Nigerian data-protection law, you may ask us to access, correct, or delete your personal information, object to certain uses, or withdraw a consent you gave (for example, turning off marketing messages in your privacy settings). You can update your profile, addresses and preferences in the app, or contact us using the details in section 12. Deleting your account may be limited where we must keep certain records by law.

Third-party vendors are not live on EPWT today, and no buyer or member is asked for NIN or BVN. This section describes how we will handle vendor identity data if and when vendor onboarding is introduced, and takes effect only then.

When vendor onboarding goes live, a prospective vendor will be verified through a licensed identity provider. This will involve a live NIN and BVN check and a liveness/selfie match, and resolving their payout bank account name against their verified identity.

We will not store a vendor's full NIN or BVN. We will retain only the identity provider's verification reference, the last few digits, the legal name returned by the check, and the timestamps — the minimum needed to prove a vendor was verified. The full identifiers pass through to the licensed provider and are not kept by EPWT. Full details will be set out here before vendor onboarding is enabled.

EPWT is intended for adults who can enter a binding contract under Nigerian law. We do not knowingly collect data from children. If you believe a child has provided us information, contact us and we will remove it.

We may update this policy from time to time. When we do, we will update the "last updated" date above and, for significant changes, notify you in-app.

For any question about your data, or to exercise a right above, contact us at support@epwt.org or through the Support section in the app.