Privacy Policy

1. Who we are

CustomerHowFar is operated by Ebofuale Victor, Lagos, Nigeria. We are the “data controller” for the personal data described here. Contact: dprogrammar@gmail.com.

2. What we collect

• Account details: your name, email address, password (stored securely by our login provider; we never see it) and, if you add it, your phone number.
• Business details: business name, category, description, services, phone and WhatsApp numbers, email, address, area, opening hours and social links. These are published on your listing.
• Photos: your logo, cover photo and photos of your work. These are public.
• ID and selfie images (business owners who complete the ID check): a photo of your government ID, an optional back photo, a selfie holding the ID, the ID type and the name as typed from the ID. We never ask for or store ID numbers.
• Payment proofs (if you pay by bank transfer): the receipt you upload, the name and bank you paid from, the amount and date.
• Contact click analytics: when someone taps WhatsApp, Call or Email on a listing we record the business, the type of contact and the time, and your account if you are logged in. We also count page views (numbers only).
• Reviews and reports you write, and messages you send us through the contact form.
• Waitlist sign-ups: if you ask us to email you when we launch in your state, we keep your email, your state, whether you're a customer or a business, your name if you give it, and when you agreed.
• Technical data: our hosting provider keeps short-lived server logs. To stop abuse (for example contact form spam) we store a one-way scrambled version of your IP address for up to two days.

3. Why we use it

• To create and run your account and let you log in.
• To publish business listings and help customers find and contact businesses.
• To review listings before they go live and keep the site safe from scams.
• To check business owners' ID and selfie visually (the “ID submitted” badge).
• To confirm listing fee payments and keep accounting records.
• To show genuine reviews and act on reports.
• To send you emails about your account and listings (for example, approval or a new review).
• To show business owners how many people viewed and contacted them.
• To email you once when we launch in your state, if you joined the waitlist, and to see which states people are waiting for.

We don't sell your personal data and we don't show third-party adverts.

4. Legal bases

• Contract: to provide the service you signed up for (accounts, listings, payments, emails about them).
• Consent: for the ID and selfie check. You give it with a checkbox before you submit, and you can withdraw it by withdrawing your submission or deleting your account.
• Consent: for the waitlist. You tick a box when you join, and every waitlist email has an unsubscribe link.
• Legitimate interests: to keep the site safe and trusted (moderation, reports, fraud prevention, rate limits) and to provide simple usage statistics.
• Legal obligation: to keep financial records of payments.

5. Who can see what

• Everyone: approved business listings, their photos, published reviews (with the reviewer's first name and last initial) and owners' replies.
• Only the CustomerHowFar admin team: ID and selfie images, payment proofs, reports and your account details. These files are stored privately and can only be opened through short-lived links. After you submit your ID, even you can't view the images again.
• Business owners: see counts of views and contact clicks, never who clicked.
• We may share data if the law requires it, for example with the police or a court.

6. Service providers

We use trusted providers that process data for us under contract:

• Supabase: database and secure login.
• Vercel: website hosting.
• Cloudinary: storing and resizing photos, ID images and payment proofs.
• Brevo: sending emails.

7. International transfers

Our servers are in Europe (Ireland and the European Union), and some providers may process data in other countries. These providers protect data with security measures and contractual safeguards that meet the standards required by the NDPA for transfers outside Nigeria.

8. How long we keep it

• ID and selfie images: deleted 90 days after our team reviews them, and straight away if you withdraw a submission or delete your account. We keep a short record that a check happened (type of ID and the decision).
• Account and listings: until you delete them, or we remove them under our Terms of Service.
• Payment records: kept for accounting. When you delete your account they are anonymized: we keep only the amount, date, reference, payment method and business name, and delete the receipt and your name, email and phone.
• Waitlist sign-ups: until you delete your account. If you unsubscribe we keep only a record so we don't email you again; deleting your account removes your waitlist sign-ups completely.
• Scrambled IP addresses for rate limiting: up to two days.

9. Your rights

Under the NDPA you can:

• Access the personal data we hold about you.
• Correct it. You can change your name and phone on your account page and your business details from your dashboard.
• Delete it. Use “Delete my account” on your account page. It deletes your profile, login, listings, photos, reviews and ID images straight away (anonymous payment records are kept, as explained above).
• Object to or ask us to restrict some uses of your data.
• Get a copy of data you gave us in a common format.
• Withdraw consent for the ID check at any time.

Email dprogrammar@gmail.com to use any of these rights. We may need to confirm it's you, and we reply within 30 days.

10. Cookies

We only use cookies that are needed for the site to work:

• Login cookies (from Supabase) keep you signed in. Without them you can't log in.
• Counting cookies: small, short-lived cookies (2 minutes to 6 hours) so a page view or contact tap is counted once. They hold no personal data.

We don't use advertising or third-party tracking cookies, so there's nothing to opt out of.

11. Security

• All traffic uses encrypted connections (HTTPS).
• ID images and payment proofs are private files, viewable only by admins through links that expire after 5 minutes.
• Database access is restricted to our servers; admin pages are protected and actions are logged.
• Passwords are handled by our login provider and never stored by us in readable form.

No system is perfectly secure. If we learn of a data breach that puts you at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

12. Children

CustomerHowFar is not for people under 18. We don't knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We will update the “Last updated” date when this policy changes, and tell account holders about important changes.

14. Contact and complaints

For privacy questions or requests, email dprogrammar@gmail.com or use our contact form. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).