Privacy Policy

1. Introduction

MyTreda, a product of MYTREDA TECHNOLOGIES LTD ("we", "our", or "us"), is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our inventory management platform designed for Nigerian traders.

This policy is compliant with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019, as administered by the Nigeria Data Protection Commission (NDPC).

2. Data Controller

MYTREDA TECHNOLOGIES LTD, operating as MyTreda, is the data controller responsible for your personal data. For any questions about this policy or your data rights, contact us at:

• Email: privacy@mytreda.com
• Address: Lagos, Nigeria

3. Personal Data We Collect

We collect the following categories of personal data:

3.1 Information You Provide

• Account Information: Full name, email address, phone number (including WhatsApp number), password
• Business Information: Business name, business type, business address
• Transaction Data: Sales records, inventory data, customer names, debt records
• Billing Data: Your subscription plan and renewal date, and a record of each payment (amount, date, how you paid, and our payment reference). Where you pay by card we also hold the last four digits, the card type, the issuing bank and the expiry date, together with a token from our payment processor that lets us charge that same card again for renewals. We never see or store your full card number, your PIN, or your CVV, those are entered on our payment processor's own page and never reach MyTreda

3.2 Information Collected Automatically

• Device Information: Device type, operating system, browser type
• Usage Data: Features used, time spent on the platform, actions taken
• Log Data: IP address, access times, pages viewed

4. Purpose and Legal Basis for Processing

We process your personal data based on the following lawful grounds under the NDPA 2023:

5. WhatsApp Notifications

We use the official WhatsApp Business API (provided by Meta Platforms, Inc.) to send you notifications. By providing your WhatsApp number and enabling notifications, you consent to:

• Receiving daily sales reports at your chosen time
• Receiving debt reminders and low stock alerts
• Your phone number being shared with Meta Platforms, Inc. for message delivery

You can withdraw consent and disable WhatsApp notifications at any time in your notification settings. Messages will be sent from our registered WhatsApp Business number.

6. Payments and Automatic Renewal

Subscription payments are handled by Paystack. When you pay, you are taken to Paystack's own secure page to enter your details, your full card number, PIN and CVV are never sent to MyTreda and are never stored on our systems.

If you pay by card, Paystack gives us a token that lets us charge that same card again when your subscription is due, so your plan renews without you having to do anything. We keep that token, along with the last four digits, card type, issuing bank and expiry date so we can show you which card is on file. By paying with a card you consent to this automatic renewal.

You can withdraw that consent at any time. "Turn off auto-renew" on your billing page deletes the saved card token immediately, your subscription continues, but you renew it by hand. Cancelling your subscription also deletes it. If you paid by bank transfer, USSD or QR, no card is saved and nothing renews automatically. We will always tell you before a renewal is due.

7. Data Sharing and Third Parties

We may share your personal data with:

• Meta Platforms, Inc.: For WhatsApp message delivery (phone numbers only)
• Cloud Service Providers: For hosting and data storage (data is encrypted)
• Paystack Payments Limited: Our payment processor, for taking subscription payments (your email address, the amount, and, if you pay by card, your card details, which you enter on Paystack's own secure page rather than ours). Paystack is a Nigerian company licensed by the Central Bank of Nigeria and is responsible for your full card details as a controller in its own right; its own privacy policy governs what it does with them
• Legal Authorities: When required by Nigerian law or court order

We do not sell your personal data to third parties. All third-party processors are bound by data processing agreements that ensure compliance with Nigerian data protection laws.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure password hashing using industry-standard algorithms
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Secure cloud infrastructure with data centers that meet international standards

9. Data Retention

We retain your personal data as follows:

• Account Data: For as long as your account is active. If you close your account or ask us to erase your data, we remove or anonymise the details that identify you within 30 days of verifying your request
• Transaction Records: 6 years (to comply with Nigerian tax and business laws). Where we have anonymised an account, these records are kept in a form that no longer identifies you
• Billing and Payment Records: 6 years, for the same tax and company law reasons. This is the record of what you paid and when, the plan, the amount, the date and our payment reference. Your saved card is treated differently and is not kept for 6 years: the token and the card details we show you are deleted as soon as you turn off auto-renew or cancel, and again whenever we close your account
• Activity and Usage Logs: For as long as your account is active. These form the audit trail of who changed what in your business records, which other members of your business rely on
• WhatsApp and Contact Numbers: For as long as your account is active. Turning notifications off stops the messages but does not by itself delete the number, contact us if you want it removed
• Downloaded Reports: When you download a debts or expenses report, we keep a copy of that exact file for 730 days (about 24 months) so you can download it again later and get the same document, not a fresh one. After that the file is deleted automatically; the underlying records stay, so you can always generate a new report covering the same period. Inventory reports are kept for longer because they are a snapshot of stock levels that cannot be recreated afterwards, and they contain no personal details

Some records cannot simply be deleted. A sale, stock movement or debt record is part of your business's own financial history, and other members of your business may depend on it. In those cases we anonymise rather than delete: the personal details are stripped out, while the underlying transaction remains.

A downloaded report is different, because it is a finished document rather than a record we can edit. We cannot strip a name out of a PDF you already have. So where someone named in a report asks us to erase their details, we delete the stored copies of the reports that could contain them and tell you we have done so. Your records are not lost: downloading that report again will generate it afresh, covering the same period, without the erased details.

10. Your Rights Under Nigerian Law

Under the NDPA 2023 and NDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data we hold
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restrict Processing: Request limitation of how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time (for consent-based processing)

To exercise any of these rights, contact us at privacy@mytreda.com. We will respond within 30 days.

To close your business account, you can also use Settings → Delete business in the app. That sends us the request; we confirm it is really from you, then erase or anonymise your data within 30 days and tell you when it is done. We verify first rather than deleting on the spot because closing a business removes records the rest of your team depends on, and it cannot be undone. Cancelling your subscription and deleting your saved card happen as part of it, so there is nothing separate for you to cancel.

11. Complaints

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC):

• Website: https://ndpc.gov.ng
• Email: info@ndpc.gov.ng

12. International Data Transfers

Some of the providers we rely on, for hosting, email, WhatsApp delivery and error monitoring, process data on servers outside Nigeria. Where that happens, we rely on the safeguards required by sections 41 to 43 of the NDPA 2023:

• Written data processing agreements with each provider, binding them to protect your data to a standard comparable to Nigerian law and to process it only on our instructions
• Transfers to countries and providers whose data protection regimes are adequate, or which are themselves subject to comparable obligations
• Encryption in transit and at rest

Your subscription payments are processed by Paystack, a Nigerian company, and your card details stay within its systems.

13. Children's Privacy

MyTreda is intended for use by business owners and traders who are 18 years of age or older. We do not knowingly collect personal data from children under 18. If you believe we have collected data from a minor, please contact us immediately.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the platform. The "Last Updated" date at the top indicates when this policy was last revised.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data:

• Email: privacy@mytreda.com
• Support: support@mytreda.com