Privacy policy

Who we are

Nantty is a Nigeria-first social marketplace: the Nantty app, web app and website, and the seller, creator and advertiser tools that go with them. The data controller responsible for your personal data is [Team to replace: legal entity name, RC number, registered address] ("Nantty", "we").

Our Data Protection Officer (DPO) can be reached at dpo@nantty.com. [Team to replace: the DPO's name or office, and Nantty's registration number with the Nigeria Data Protection Commission (NDPC) once issued.]

This policy explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the NDPC's General Application and Implementation Directive 2025 (GAID). The annexes at the end add what the laws of Ghana, Kenya, South Africa, the UK, the EU and the US require.

Data we collect

Depending on how you use Nantty, we collect the following.

• Account data: email address (you sign in with email, or with Apple or Google linked to that email), date of birth, username, display name, password hash, profile photo, bio, profile type, whether your account is private, and settings. Your phone number is only used as contact data for deliveries, stores and orders, never to log in.
• Addresses and contact details you give for delivery, billing or your store.
• Location: your country and approximate location from your IP address or device, used for currency, prices, delivery options and relevance. Precise location only if you allow it in your device settings, for example to share a location in a chat. We do not upload your phone contacts.
• Content: posts, clips, stories, lives and recordings, comments, mentions, product listings, reviews and the metadata that comes with them, including whether content is labelled or detected as AI-generated.
• Live safety samples: short samples of live video frames and audio, checked automatically for severe harm and deleted after a day.
• Activity: follows and follow requests, likes, shares, saves, searches (your last 20 per search area, until you clear them), watch time, products viewed and bought, affiliate links you clicked, gifts, tips and coins sent and received, Nantty Points, and the reasons you report or hide things.
• Chat data: who is in each chat, including group chats, who sent each message and when, the message type, delivery and read status, reactions, the chat folder and the public keys your devices use for end-to-end encryption. We cannot read message content or encrypted media. Locations and polls shared in chats are not end-to-end encrypted, so we store them. Encrypted chat media is deleted from our servers after 30 days.
• Payment and wallet data: transaction references, amounts, fees, escrow status, wallet balances held by our payment partner in your name, coin balances and coins owed, ad balance and ad credit, creator earnings and affiliate commissions, payout account details and payout history. Card numbers are entered only on our payment partner's secure page; we never see or store them.
• Verification data: in Nigeria, your BVN and bank account details checked through our payment partner; your legal name, date of birth and address; ID document type and number (such as NIN, passport or driver's licence); and, for Smile ID checks, ID images, a liveness selfie and a face-match result.
• Business data for sellers, brands and advertisers: business name, registration number, documents, tax details and the people who act for the business.
• Support data: tickets, live chats with our support team (these are not end-to-end encrypted) and attachments.
• Device and network data: IP address, device model, operating system, app version, language, push token, crash data and security signals such as failed checks.
• Cookies and similar technologies, as explained in our Cookie Policy.
• Advertising data: ad impressions, clicks and conversions measured inside Nantty, your plan (which sets how many ads you see), and the interest and audience signals used to choose ads, only where you have allowed personalised ads.

Sensitive data, biometrics and ID numbers

Some data is sensitive under the NDPA, such as biometric data, or high risk, such as BVN, NIN and ID images. We collect it only for verification, fraud prevention and legal compliance, and only when you start a verification.

We ask for your explicit consent before any biometric check, and we record the version of the consent text you agreed to and when. Smile ID runs a liveness check, compares your selfie with your ID photo and returns a result. Nantty does not create or store face templates or your ID images; we keep the result, the match scores, the document type and country, and a fingerprint of the document number so it cannot be reused on another account.

If you do not want a biometric check, you can still use Nantty, but you cannot get a checkmark, and outside Nigeria you cannot sell or receive payouts.

Where data comes from

Most data comes from you and your devices. We also receive data from:

• our payment partner (Flutterwave) about payments, wallet funding, payouts, chargebacks and bank account checks;
• Smile ID about identity and liveness checks;
• Apple and Google about in-app purchases, refunds and push notifications;
• Apple and Google, if you sign in with them;
• advertisers who upload a customer list, which we receive as hashed emails or phone numbers and match inside Nantty;
• other users, for example when they tag or mention you, report you, review an order, send you a follow or chat request, or share an affiliate link you click;
• sellers, about the fulfilment of your orders;
• public sources and authorities, for example sanctions lists and lawful requests.

Why we use your data, and our lawful basis

Section 25 of the NDPA, and Article 6 of the GDPR where it applies, require a lawful basis for each use. Where we rely on legitimate interests, we have weighed them against your rights and you can object. Where we rely on consent, you can withdraw it at any time in Settings, Privacy & Data or the cookie settings, without affecting what happened before.

Automated decisions and profiling

We use automated systems to rank content, filter spam and fake engagement, score fraud and trust risk, sample live video for severe harm, and match verification results. Some of these are profiling.

Automated systems can flag, limit or hold something for review, and can approve a verification when every check matches. They never permanently ban an account, reject a verification or decide a dispute on their own: a person does. Under section 37 of the NDPA, and Article 22 of the GDPR where it applies, you can ask for a person to review any decision about you that was made by automated means and that significantly affects you, give your view and contest it. You can see why a post was shown to you from its menu.

Who we share data with

We never sell or rent your personal data, and we do not give it to advertisers, data brokers or ad networks for their own use. Advertisers get aggregated reports only. We share data only as needed with:

• Payment partner: Flutterwave, which holds Nigerian wallets in your name, processes payments and payouts, and checks BVN and bank accounts. It acts partly as our processor and partly as a controller under its own licences and policies.
• Smile ID, for identity, document and liveness checks.
• Amazon Web Services, which hosts our systems and data (main region Ireland, backup region Germany), stores media (Amazon S3, delivered through CloudFront), sends our emails (Amazon SES), manages encryption keys (AWS KMS) and runs automated safety checks on live video and audio (Amazon Rekognition and Amazon Transcribe).
• LiveKit, which carries live video, and Cloudflare, which runs the Turnstile human check and receives technical signals from your browser to tell people from bots.
• Apple and Google, for in-app purchases, refunds, sign-in with Apple or Google and push notifications, and Expo for delivering push notifications to our apps.
• OpenStreetMap, whose map tiles load in your browser or app when you view a map, which shares your IP address with its servers.
• Creators, who see their subscribers and gift senders as the feature shows, and affiliate creators, who see sales and commission, not buyers' contact details.
• Sellers, who receive your name, delivery address and contact number to fulfil your order, and buyers, who see a seller's store and business details.
• Other users and the public, who see your public profile and content. Private profiles limit this.
• We do not use third-party analytics, crash reporting or advertising networks today. Ads are chosen and measured inside Nantty. If we add a provider, we will update this policy first and ask for your consent where the law requires it.
• Professional advisers, auditors and insurers, and a buyer or investor in Nantty under confidentiality if the business is sold or reorganised.
• Regulators, courts and law enforcement, such as the NDPC, the FCCPC, the Nigeria Police, the EFCC and the NFIU, when the law requires or to protect people from serious harm. We check that requests are lawful and share only what is needed.

International transfers

Your data is stored mainly in the European Union (Ireland, with backups in Germany) and is also processed by our providers in the United States and other countries. Sections 41 to 43 of the NDPA allow these transfers where the receiving country or arrangement gives an adequate level of protection, or where another basis applies. We rely on: written contracts with each provider that impose NDPA-standard protections (and, for data from the UK or EU, the standard contractual clauses); the EU's own data protection law in Ireland and Germany; and, for a few transfers, the need to perform our contract with you (for example, paying a seller abroad).

We keep a record of each transfer and its basis, as the NDPA and GAID require. You can ask for a copy of the safeguards from our DPO.

How long we keep data

We keep data only as long as needed for the purpose or as the law requires, then delete or anonymise it. Admins can shorten some periods but not below legal minimums.

Security and breaches

We use technical and organisational measures that fit the risk, including encryption in transit and at rest, end-to-end encryption for chats, separate encrypted storage for verification data, least-privilege staff access with separation of duties, audit logs, and regular security testing. No system is perfectly secure.

To protect accounts from unauthorised access and automated abuse, we keep security logs of refused requests (the type of page, counts, the time, a device identifier and a shortened network address, never the content you sent). Accounts that behave like automated software may be asked to complete a human check. Repeated failures can lead to a temporary suspension, which you can appeal.

If a personal data breach is likely to put your rights at risk, we notify the NDPC within 72 hours of becoming aware of it, as section 40 of the NDPA requires, and tell you without undue delay in plain language if the risk is high, with steps you can take. We also report cyber incidents to the national CERT within 72 hours as the Cybercrimes (Amendment) Act 2024 requires.

Your rights

Under sections 34 to 38 of the NDPA, and similar laws where you live, you can:

• get confirmation that we process your data and a copy of it;
• have wrong or incomplete data corrected;
• have data deleted when we no longer need it, subject to what the law makes us keep;
• restrict processing while a complaint is checked;
• withdraw consent at any time;
• object to processing based on legitimate interests and to direct marketing;
• not be subject to a decision based only on automated processing that significantly affects you;
• receive your data in a common, machine-readable format, and ask us to send it to another provider (Settings, Privacy & Data, Download your data);
• complain to the NDPC or your local data protection authority.

Children

You must be at least 13 to have an account, and we ask for your date of birth when you sign up. Under the NDPA, a child is anyone under 18, and section 31 requires consent from a parent or guardian.

Under-18 accounts and anyone whose age we do not know never receive nudity or dangerous content, are not shown ads, and cannot sell, receive payouts, join the Creator Program or run ads.

If you believe a child has given us personal data without the right consent, contact our DPO and we will delete it. Reports about child safety go to an urgent queue, and we report child sexual abuse material to the authorities.

How we record your choices

When you accept these terms or a policy, we record the version you accepted, when, and the device information sent with it (IP address and app or browser). We record each consent (analytics, personalisation, advertising and marketing) with the policy version it was given under and where you gave it. Biometric consent is recorded separately with the version of the consent text. When a policy changes materially, we ask you again and keep the earlier records as proof.

Marketing

We send marketing emails and push messages only with your consent, and you can turn them off at any time in Settings or from the message. Personalised marketing from sellers and brands comes only from verified sellers and brands, and only if you agreed to it. Service messages, such as order updates and security alerts, are not marketing and you will still get them.

Annex: Ghana

If you are in Ghana, the Data Protection Act 2012 (Act 843) applies. Nantty registers as a data controller with the Data Protection Commission and renews that registration every two years. [Team to replace: Ghana DPC registration number and the Data Protection Supervisor's contact.]

You can ask for access to your data, correction or deletion of inaccurate, irrelevant or unlawfully held data, and stop processing for direct marketing. We process data on the bases Act 843 allows, mainly contract, legal obligation, legitimate interests and consent. You can complain to the Data Protection Commission (dataprotection.org.gh).

Online purchases are also covered by the Electronic Transactions Act 2008 (Act 772), and our security practices follow the Cybersecurity Act 2020 (Act 1038).

Annex: Kenya

If you are in Kenya, the Data Protection Act 2019 and its 2021 regulations apply. Nantty registers with the Office of the Data Protection Commissioner (ODPC) as the regulations require, and renews the registration every 24 months. [Team to replace: ODPC registration certificate number.]

You have the rights in section 26 of the Act, including access, correction, deletion, objection and portability. We answer access requests within 7 days, as the Data Protection (General) Regulations 2021 require. For a child, we need a parent's or guardian's consent (section 33). We notify the ODPC of a qualifying breach within 72 hours (section 43). Transfers outside Kenya follow sections 48 to 50, using appropriate safeguards. You can complain to the ODPC (odpc.go.ke).

Annex: South Africa

If you are in South Africa, the Protection of Personal Information Act 2013 (POPIA) applies. Our Information Officer is registered with the Information Regulator. [Team to replace: the Information Officer's or deputy's name and contact; POPIA requires a South African-based deputy if the Information Officer is abroad.]

You can ask what data we hold, and ask us to correct or delete it, and object to processing. We send electronic direct marketing only with your opt-in consent (section 69). For a child, we need a competent person's consent. Transfers outside South Africa follow section 72, using binding agreements or other safeguards. We notify the Information Regulator and you of a security compromise as soon as reasonably possible. Our manual under the Promotion of Access to Information Act 2000 (PAIA) is available on request. You can complain to the Information Regulator (inforegulator.org.za).

Annex: United Kingdom and European Union

If you are in the UK or the European Economic Area, the UK GDPR and Data Protection Act 2018, or the EU GDPR, apply. Nantty is the controller. Our lawful bases are in the table above. Because Nantty is not established in the UK or EU, we appoint representatives there under Article 27. [Team to replace: EU representative and UK representative names and contact details.]

You have the rights to access, rectification, erasure, restriction, portability and objection, the right to withdraw consent, and the right not to be subject to solely automated decisions with legal or similarly significant effects. We answer within one month, which we can extend by two months for complex requests and will tell you if we do. Data that leaves the UK or EU to Nigeria, the US or other countries without an adequacy decision is protected by the standard contractual clauses (with the UK addendum for UK data).

We use optional cookies only with your consent, under the UK Privacy and Electronic Communications Regulations and the EU ePrivacy rules. You can complain to the Information Commissioner's Office (ico.org.uk) or the data protection authority in your EU country.

Annex: United States

If you live in a US state with a consumer privacy law, such as California under the California Consumer Privacy Act as amended by the CPRA, you have the right to know what personal information we collect, use and disclose; to access, correct and delete it; and to opt out of its sale, of sharing for cross-context behavioural advertising, and of targeted advertising and significant profiling. We do not sell personal information for money. If we use advertising partners in the US, that may count as sharing, and you can opt out in Settings, Privacy & Data or with a Global Privacy Control signal, which we honour.

The categories we collect are those in "Data we collect": identifiers, commercial information, internet activity, approximate geolocation, audio and video content you post, financial information for payouts, and sensitive information (government ID numbers and biometric checks) used only for verification and fraud prevention, never to infer characteristics about you. We keep each category for the periods in "How long we keep data".

You can use your rights through the app or by email, and you can appeal a refusal. We verify requests by your signed-in account or by matching information we hold; an authorised agent needs your signed permission. We will not discriminate against you for using your rights. Nantty is not directed to children under 13, and we do not knowingly collect their data without verified parental consent as the Children's Online Privacy Protection Act requires.

Contact us and complaints

To use your rights or ask a question, use Settings, Privacy & Data in the app, email privacy@nantty.com, or contact our Data Protection Officer at dpo@nantty.com. The Data rights requests page explains how we handle requests and how long we take.

If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or to the data protection authority where you live, listed in the annexes below. You do not have to contact us first, but we would like the chance to fix the problem.

Updates to this policy

We post changes on this page and update the version and effective date. Earlier versions stay available. We tell you by email and in the app before a material change, and we ask for your choices again when a change affects consent.

About this document

Parts of this document are adapted from templates that General Legal, PC published under CC0 1.0. General Legal prepared those templates for general reference only. They are not legal advice, General Legal has not reviewed this document, and using it does not create a lawyer-client relationship with General Legal.