Privacy Policy

Nelvaca is a technology platform owned and operated by Macbay Innovative Solutions Ltd. This policy explains how we handle personal information across the platform.

For any privacy question or request, contact support@nelvaca.com.

Depending on how you use Nelvaca, we may collect:

• Account information: name, email address, phone number, and password (stored as a hash, never in plain text).
• Customer profile information: address details, and preferred currency and language, where provided.
• Vendor or supplier business information: business name, contact details, store or warehouse details, and related onboarding information, for accounts registered as a vendor or supplier.
• Cart and order information: items, quantities, order and shipping details, and order status history.
• Payment information: payment status and provider-supplied references (such as a transaction reference and status). We do not collect or store your full card number, expiry date, or CVV - card details are entered directly on our payment provider's own hosted checkout page.
• Support communications: messages you send to our support address, and their content.
• Technical and session information: authentication session data (used to keep you signed in) and, for guests, a cart identifier stored in a browser cookie so your cart persists between visits.

We collect information you provide directly (for example, when you register, complete your profile, place an order, or contact support), information generated automatically as you use the platform (for example, cart and order records, and session/cookie data described above), and information received from our payment provider once you complete a payment.

We use personal information to:

• Create and manage your account, and keep you signed in.
• Process and fulfil orders, including working with vendors and suppliers to fulfil purchased items.
• Process payments and, where applicable, refunds, through our payment provider.
• Send account-related transactional email, such as email verification and password reset messages.
• Respond to support requests, including order, payment, cancellation, and returns/refunds questions.
• Maintain the security and integrity of the platform, including detecting and preventing fraud and abuse.
• Support vendor- and operations-facing tools, including the AI-assisted functionality described in Section 9 below.

Depending on the specific processing activity and the law that applies to you, we rely on one or more of the following: performance of a contract with you (for example, to process an order you place), our legitimate interests (for example, platform security and fraud prevention), compliance with a legal obligation, and, where required, your consent. No single lawful basis applies to every use of information described in this policy.

We share personal information only where necessary to operate the platform, including with:

• Vendors and suppliers, to the extent needed to fulfil an order you place with them.
• Our payment processor, to process payments and refunds (see Section 8).
• Our email delivery provider, to send account-related transactional email (see Section 8).
• Our hosting and database infrastructure providers, who store and run the platform on our behalf.
• Law enforcement, regulators, or other third parties, where we are required to do so by law or to protect our rights, users, or the public.

We do not sell your personal information.

Payments are processed by Flutterwave. When you pay, you are directed to Flutterwave's own hosted checkout, and your payment details are handled there under Flutterwave's own terms and privacy practices - we receive payment status and reference information back from them, not your full card details. Account-related transactional email (such as email verification and password reset) is sent through Resend. Our database is hosted on Neon, and the platform itself runs on Railway.

Nelvaca uses AI-assisted tools, built on an underlying AI provider (OpenAI), to support vendor and operations workflows - for example, drafting or reviewing product listings, and assisting with pricing, fraud monitoring, or support triage. These features are intended for vendor and operations workflows and are governed by internal audit and human-oversight controls: they produce recommendations or drafts for a human to review, not autonomous, consequential decisions about individual customers, and they are not used to personalize what a customer sees.

Nelvaca currently uses essential session and guest-cart cookies for the customer web experience: an authentication session cookie, so you can stay signed in, and a guest cart cookie, so your cart is remembered between visits if you're not signed in. We do not currently operate customer-facing advertising or behavioural-personalisation features through the Nelvaca web application.

Because our infrastructure and service providers may operate in different countries, your information may be processed outside the country where you are located. Where this happens, we take reasonable steps to ensure your information continues to receive an appropriate level of protection.

We keep personal information for as long as reasonably necessary for the purposes described in this policy - for example, for as long as your account is active, for as long as needed to resolve an order, payment, or support matter, to meet accounting or legal record-keeping obligations, to resolve disputes, and to detect and prevent fraud. We don't apply a single fixed retention period to every category of information; retention depends on the purpose it was collected for.

We use reasonable technical and organizational measures designed to protect your personal information, including password hashing and access controls on sensitive data. No system can be guaranteed 100% secure, and we cannot promise that information you provide will never be accessed, disclosed, altered, or destroyed in a manner inconsistent with this policy.

Subject to applicable data protection law (including Nigerian data protection law), you may have the right to: access the personal information we hold about you; request correction of inaccurate information; request deletion or erasure; request restriction of processing; object to certain processing; request portability of information you provided; withdraw consent where processing is based on consent; and be protected against solely automated decision-making that produces legal or similarly significant effects concerning you. These rights are subject to applicable legal limitations and exceptions. You also have the right to lodge a complaint with the relevant data protection authority. To exercise any of these rights, contact support@nelvaca.com.

Nelvaca is not directed at children, and we do not knowingly collect personal information from children in a manner inconsistent with applicable law. We don't currently operate a dedicated age-verification process, so if you believe a child has provided us with personal information, please contact support@nelvaca.com so we can address it.

We may update this policy from time to time, for example to reflect changes in our practices or for legal reasons. We'll update the "Last updated" date above when we do. Material changes will be reflected on this page.

This policy is effective as of the date shown at the top of this page.

See also our Terms of Service and our Returns, Refunds & Cancellations policy.