Privacy Policy
Effective date: 12 July 2026. Last reviewed: 12 July 2026.
Okpa Hunters ("Okpa Hunters", "we", "us", or "our") operates the website, mobile web app, and related services (collectively, the "Service") that let users discover, mark, review, and share locations of okpa vendors across Nigeria. This Privacy Policy describes the categories of personal data we process, the legal bases for processing, how long we retain it, with whom we share it, the safeguards we apply, and the rights you have. It is written to be compliant with the Nigeria Data Protection Act 2023 ("NDPA"), the Nigeria Data Protection Regulation 2019 ("NDPR"), the EU General Data Protection Regulation 2016/679 ("GDPR") to the extent it applies, and the California Consumer Privacy Act 2018 ("CCPA/CPRA") to the extent it applies.
1. Data Controller & Contact
The data controller responsible for your personal data is Okpa Hunters. You can reach our privacy team at privacy@okpahunters.com. If you are located in Nigeria, you may also contact the Nigeria Data Protection Commission at ndpc.gov.ng.
2. Personal Data We Collect
2.1 Data you provide directly
- Account data: email address, password (hashed), display name, user type (customer or seller).
- Profile data: avatar, phone number (sellers only), city, LGA, verification status.
- Listing data: spot name, description, address, precise geographic coordinates (latitude / longitude), landmark, nearest bus stop, photos, price range, opening hours, seller name and contact phone.
- User-generated content: reviews, ratings, comments, chat messages, notification preferences.
- Payment data: we do not store card numbers. Paystack Payments Limited processes card and bank details on our behalf and returns to us only a reference, masked card details, plan, amount, and status.
- Support data: the contents of emails you send us and any attachments.
2.2 Data we collect automatically
- Device & log data: IP address, user-agent, device type, operating system, referring URL, pages viewed, timestamps, error diagnostics.
- Approximate location: derived from IP address to centre the map. Precise location is used only if you explicitly grant browser geolocation permission.
- Cookies and similar technologies: see our Cookie Policy.
2.3 Data from third parties
- Google Maps Platform — geocoded coordinates, place metadata and map tiles associated with search queries you submit.
- Paystack — payment status, customer code, and subscription code linked to your account.
- OAuth providers (if you sign in with a social account) — a stable user id, email, name and avatar.
3. Purposes and Legal Bases for Processing
| Purpose | Categories | Legal basis |
|---|---|---|
| Create and secure your account | Account, profile | Contract; NDPA s.25(1)(b); GDPR Art. 6(1)(b) |
| Display listings on a public map | Listing (spot coordinates, seller display name and phone if the seller chooses to publish it) | Consent of the seller; legitimate interest in operating the marketplace |
| Fraud prevention, moderation, banned-words enforcement | Log, content, device | Legitimate interest; legal obligation |
| Take payment and manage subscriptions | Payment metadata | Contract; legal obligation (tax, accounting) |
| Send transactional notifications | Contact, account | Contract |
| Send marketing communications | Contact | Consent (opt-in). Withdraw at any time. |
| Analytics and product improvement | Aggregated device/log | Legitimate interest, minimised and pseudonymised |
| Comply with lawful requests | Any | Legal obligation |
4. Sharing Your Data
We disclose personal data only to the categories of recipients below, under written data-processing agreements where required, and only for the purposes identified in this policy.
- Sub-processors (Service Providers): Supabase (database, auth, storage — hosted in the EU/US), Cloudflare (edge network), Google Maps Platform (mapping and geocoding), Paystack (payments), email delivery providers for transactional email.
- Other users: information you choose to publish on a spot listing, review, or chat message is visible to other users of the Service.
- Legal, safety, and enforcement: where compelled by valid Nigerian law, court order, or where we believe in good faith that disclosure is necessary to protect the rights, property or safety of Okpa Hunters, our users or the public.
- Business transfers: in the event of a merger, acquisition or asset sale, we will notify you and seek your consent where required.
We do not sell your personal data, and we do not engage in "cross-context behavioural advertising" as defined by the CCPA/CPRA.
5. International Data Transfers
Some of our sub-processors process data outside Nigeria (primarily in the EU and US). Where we transfer personal data internationally, we rely on: (a) an adequacy decision, (b) the Standard Contractual Clauses of the European Commission, or (c) explicit consent. A copy of the safeguards can be requested by writing to privacy@okpahunters.com.
6. Retention
- Account and profile data: for the life of your account, plus 24 months after deletion for legal claims.
- Listings, reviews, chat messages: retained while the account exists; anonymised on account deletion.
- Payment records: 7 years, as required by Nigerian tax law.
- Server access logs: 90 days.
- Marketing-consent evidence: for as long as we send you marketing, plus 24 months after withdrawal.
7. Your Rights
Subject to applicable law you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate or incomplete data.
- Erase your data ("right to be forgotten"), subject to legal retention obligations.
- Restrict or object to certain processing, including profiling.
- Data portability — receive a machine-readable copy of the data you gave us.
- Withdraw consent at any time, without affecting the lawfulness of prior processing.
- Lodge a complaint with the Nigeria Data Protection Commission or your local supervisory authority.
- Opt out of marketing at any time via the unsubscribe link or by contacting us.
To exercise any right, email privacy@okpahunters.com. We will respond within 30 days and may need to verify your identity.
8. Security
We apply technical and organisational measures appropriate to the risk, including: TLS 1.2+ in transit, encryption at rest at the database and storage layer, row-level security policies scoping data to its owner, hashed passwords (bcrypt), least-privilege access to production, mandatory two-factor authentication for operators, banned-words moderation, HMAC-verified webhooks, principle of least data (we ask sellers for the minimum contact information required to run a listing) and a written incident-response plan. No system is perfectly secure; if we become aware of a personal-data breach that is likely to result in a risk to your rights we will notify the affected users and the Nigeria Data Protection Commission within 72 hours as required by law.
9. Children
The Service is not directed to children under 13. If we learn we have collected personal data from a child under 13 without a parent's consent, we will delete it. Parents may contact us at privacy@okpahunters.com.
10. Automated Decision-Making
We do not make decisions producing legal or similarly significant effects about you based solely on automated processing. Moderation flags are always reviewed by a human before enforcement.
11. Changes to this Policy
We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect. The date at the top of this page always reflects the current version.
12. Contact
Okpa Hunters · privacy@okpahunters.com.