Privacy Policy

Who is responsible for your data

For your own account, and for shoppers on Anvela Market, Anvela Technology Ltd is the data controller: we decide why and how that data is used.

A business that uses Anvela keeps its own records in it: its customers, suppliers, staff, sales and stock. For those records the business is the controller, and Anvela processes them on the business's behalf, only to run Anvela for it. If you are a customer of a business that uses Anvela, ask that business about your data first; we will help it answer.

What we collect

• Your account: your name, email address and password. The password is stored only in a scrambled form that nobody can read back. If you continue with Google, Google gives us your name, email address and profile picture; we never see your Google password.
• Your profile and settings: a photo if you add one, your language, appearance and notification choices, and whether two-step sign-in is on.
• Your work in a business: the businesses you belong to, your role, and what you record or do there, such as sales, stock, tasks, notes and files.
• Anvela Market: if you shop, your name, phone number, delivery addresses, orders, questions and reviews. If you sell, your shop's details, listings and photos, and the bank account your earnings are paid to.
• Payments: Paystack takes your card or bank details on its own secure page. We receive the payment reference, amount, status and receipt number. We never see or store your full card number.
• Photos and files you take or upload, such as product photos, receipts, task evidence and site-survey photos. The phone app uses the camera only when you choose to take a photo or scan a code.
• Location: only when you start a field site visit, we record where you are and how accurate the reading is, to confirm you are at the site. Anvela does not follow your location at any other time.
• Ellis, Anvela's assistant: the question you ask and the business facts needed to answer it. Conversations are not kept after your session ends; we keep only a count of questions per day, for plan limits.
• Devices and safety: the devices you sign in on, a notification token for the phone app, sign-in times, and errors that happen while you use Anvela, so we can fix them.
• What you send us: emails to support, reports about orders, and anything you share to get help.

Why we use it, and on what legal basis

Where we rely on legitimate interest, we have weighed it against your rights and freedoms, and you can object (see Your rights).

• To give you the service you signed up for: your account, your business records, Market orders, payments, receipts and notifications (contract).
• To keep Anvela safe: two-step sign-in, checking new passwords against passwords known to have leaked, spotting fraud on Anvela Market and fixing faults (legitimate interest).
• To keep payment and tax records and to answer lawful requests from authorities (legal obligation).
• To decide disputes on Anvela Market fairly: we look at the order, its updates and the evidence both sides give (contract and legitimate interest).
• To use your phone's camera, photos, location and notifications, and to send you news or offers: only with your permission (consent), which you can withdraw at any time. Anvela does not send marketing today; if we start, we will ask you first.

Ellis and other automated help

Ellis answers questions, drafts messages and suggests what to do next. To do this, your question and the relevant facts are sent to OpenAI, which runs the model. The same happens when Ellis checks a site photo, reads a receipt design you upload, or helps draft a task. We switch off OpenAI's storage of these requests; under OpenAI's business terms they are not used to train its models, and OpenAI may keep them for up to 30 days only to detect abuse.

Ellis never makes a decision about you on its own. It proposes; a person confirms. Nothing Ellis suggests changes your records until you approve it.

Who we share it with

People in a business you belong to see your name, email, role and the work you do there, as that business's settings allow. When you order on Anvela Market, the shop receives your name, phone number and delivery address so it can deliver. Reviews you write are shown publicly on the listing.

We use service providers who process data for us under contract and only on our instructions:

• Supabase: our database, sign-in and file storage.
• Vercel: hosts the website and its servers.
• Paystack: payments, refunds and payouts.
• OpenAI: runs Ellis.
• Resend: sends Anvela's emails.
• Google: Sign in with Google, if you choose it.
• Expo: delivers phone notifications and app updates.
• Mapbox: looks up an address or a map point when you search for one. Only the search text or the point is sent.
• Have I Been Pwned: checks a new password against passwords known to have leaked. Only the first five characters of a scrambled form of it are sent, never the password.

Other disclosures

We may also disclose data when Nigerian law, a court or a regulator requires it, to protect people from fraud or harm, or to a company that takes over Anvela's business, which would have to keep the promises in this policy.

Data sent outside Nigeria

Anvela's database is in Ireland, in the European Union, and several of our providers work from the United States. We send personal data outside Nigeria only as sections 41 to 43 of the NDPA allow: to providers bound by contract to protect it to the standard the NDPA requires, or where the transfer is needed to give you the service you asked for. When you create your account, or the first time you sign in after this policy took effect, we ask you to agree to this, and we keep a record of when you did. You can ask us for details of these safeguards.

How long we keep it

• Your account and its data: until you delete your account. Deleting happens at once. Our page "Delete your Anvela account" (anvela.ng/delete-account) explains exactly what is deleted and what a business you worked in keeps.
• A business's records: until its Founder deletes them. A Founder can download every record first. The law may require a business to keep its accounting records for some years; that is the business's responsibility.
• Copies in our backups are replaced within 7 days.
• After an account is deleted, we keep only a note that counts what was deleted and when, with no name or email.
• Paystack keeps its own payment records for as long as the law requires it to.

How we protect it

No system is perfectly secure. If a breach puts your data at risk, we will tell the Nigeria Data Protection Commission within 72 hours of learning of it and tell you without delay, as the NDPA requires.

• Everything travels over encrypted connections (HTTPS) and is encrypted where it is stored.
• Each business's records are walled off in the database: people see only what their role in that business allows.
• You can turn on two-step sign-in, and new passwords are checked against passwords known to have leaked.
• Anvela's own team works from counts and business names. We do not browse your business records. If you ask for help or report a Market order, we look only at what that needs.

Your rights

Most of these you can do yourself on the website or in the phone app. For anything else, email support@anvela.ng with the subject "Privacy". We reply within 7 days and complete your request within 30 days, free of charge. We may ask you to confirm that the request is yours.

If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

• To know how your data is used (this policy).
• To get a copy of your data: download it in Settings, Your data and account.
• To correct it: change your profile and settings yourself, or ask us.
• To have it deleted: delete your account in Settings, Your data and account, at any time.
• To take it elsewhere: your data downloads as a file, and a Founder can download every business record as spreadsheet files.
• To object to uses based on legitimate interest, and to any marketing.
• To ask us to limit how we use your data while a concern is looked into.
• To withdraw consent, for example by turning off camera, location or notifications in your phone's settings.
• Not to be subject to a decision made only by automated means that has legal or similarly serious effects on you.

Children

Anvela is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child is using Anvela, email us and we will delete the account.

Cookies and storage on your device

Anvela stores only what it needs to work in your browser or phone: what keeps you signed in, your basket, the business you have open, your language and your appearance setting. There are no advertising or tracking cookies and no third-party analytics.

On the sign-in page, Google's sign-in service loads from Google so it can offer "Continue with Google". Google's own privacy policy applies to it.

Phone app permissions

The app asks before it uses your camera, photos, location or notifications, and only when a feature needs them. You can turn any of these off in your phone's settings; the rest of the app keeps working.

Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in Anvela before the change takes effect. The date at the top shows the current version.

Contact

Questions about this policy: support@anvela.ng.

Anvela Technology Ltd · RC 9897476 · Lagos, Nigeria

See also: Terms of Service · Refund Policy · Delivery Policy