Privacy policy
How we handle your data, and your customers’ data
Maaz Buk holds two kinds of data: data about you, and data you record about your customers. This policy explains how each is handled and who is responsible for it.
Last updated 17 sections
What this policy covers
This policy covers the data we hold about you, and the data we hold on your behalf about your customers.
It applies to this website, to the Maaz Buk app, and to any message you send us. People who buy from a shop on maazbuk.shop have their own shopper privacy notice.
The two kinds of data, and who answers for them
For your own details, such as your email address, your business and your payments, we decide what is held and why, and we are responsible for it.
For your customers’ details, such as their names, phone numbers, what they bought and what they owe, you decide what is held and why. We hold it only to run the service for you, and we act on your instructions. You are responsible for it to your customers.
Under the Nigeria Data Protection Act, we are the controller of your own details and the processor of your customers’ details. We will never use your customer list for our own purposes.
What we hold about you
When you visit this website
Nothing that identifies you, unless you contact us. Our hosting and network provider sees your IP address and browser details, as every website’s provider does, to deliver the page and protect it from attack. We run no analytics or advertising scripts.
When you message us
Your email address or WhatsApp number, your name if you give it, and what you write. We use it to answer you, and for nothing else.
When you sign up
Your name, email address, phone number, business name and type of business, and a password, which is stored only as a one-way hash. If you sign in with Google, Google gives us your name and email address instead of a password.
While you use it
Your plan, the staff you invite and their roles, and a log of sign-ins and of actions taken in the account, so that each entry can be traced to the person who made it.
When you pay
A record of your payments. Card and bank details are handled by Paystack and are not stored by us.
What we hold on your behalf
Whatever you record. In practice that usually means:
- your customers’ names, phone numbers, and sometimes addresses;
- what they bought, when, at what price, and how they paid;
- what they owe you, when it is due, and the limit you have set for them;
- if you run an online shop, the details your buyers give at checkout;
- your suppliers, your products, your stock and your costs.
We do not use any of it for our own purposes. We do not analyse it to build a profile of your customers, we do not use it to train anything, and we do not share it with lenders, insurers, data brokers or advertisers, whether in full, in aggregate or anonymised.
Why we are allowed to hold it
To perform the contract
Your account details, your records and your payments, which we need to provide the service.
Because the law requires it
Payment records that have to be kept for tax and accounting purposes.
Because we have a legitimate interest
Sign-in logs and security records, kept to protect accounts from being taken over, and your messages, kept so we can answer them. We do not use them to study how you work.
Who else sees any of it
No one outside Maaz Buk, except the service providers that run the product. Each one processes data only to provide its service to us:
Cloudflare
Delivers this website and your shop pages, and protects them from attack.
Fly.io
Runs the app and its database, on servers in London, United Kingdom.
Tigris
Stores files you upload, such as product photos.
Resend
Sends the emails the service needs to send, such as sign-up messages and receipts.
Paystack
Takes your subscription payments, and the payments your customers make in your online shop.
Only if you choose to sign in with Google.
No analytics company or advertising network receives any data. If this list changes, we will update this page and, where the change affects you, tell you directly.
Where it is held
Records are stored on Fly.io’s servers in London, in the United Kingdom, so they are transferred out of Nigeria. We make that transfer with the safeguards the Nigeria Data Protection Act requires.
If we move them anywhere else, we will say so here and tell you before it happens.
How long we keep it
Your account and records
For as long as the account is open. After it closes, we keep them in case you come back or want a copy, and for as long as the law requires. Ask us and we will delete them sooner, apart from what the law requires us to keep.
Payment records
For as long as Nigerian tax and accounting law requires, even after the account closes.
Sign-in and security logs
Only as long as we need them to keep accounts secure, then deleted.
Messages you send us
For as long as we need them to answer you and deal with anything that follows.
Keeping it safe
Every connection to Maaz Buk is encrypted. Passwords are stored only as one-way hashes, so no one, including us, can read yours. Roles are enforced on our servers, so a member of staff with the sales role cannot see costs or margins.
Our staff do not look through customer records. When our support team needs to view an account to fix a problem, that access is read-only, time-limited and logged.
If something goes wrong
If a breach affects personal data we hold, we will tell the Nigeria Data Protection Commission within 72 hours of becoming aware of it, where the law requires. If it is likely to put you at risk, we will tell you directly and without delay, with what happened and what we are doing about it.
If it affects your customers’ data, we will tell you without undue delay, so you can tell them.
Your rights
Under the Nigeria Data Protection Act you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to a particular use, withdraw any consent you have given, or ask for it in a form you can take elsewhere.
Write to privacy@maazbuk.com. There is no charge and no form to fill in. We will answer within 30 days.
Your customers’ rights, and your part in them
Your customers have the same rights, and they exercise them through you, because the records are yours. If one of them writes to us, we will refer them to you and let you know.
You can find, correct or delete any customer’s record from inside the account. If you need help with a request the app cannot handle, write to privacy@maazbuk.com and we will assist.
You are responsible for telling your customers what you hold about them and how you use it.
Cookies and browser storage
This website sets no cookies of its own and loads no analytics, advertising or tracking scripts. If you choose the light or dark theme, your browser remembers that choice on your device. It is never sent to us.
The app uses one cookie to keep you signed in. It is sent only to Maaz Buk, scripts on the page cannot read it, and it ends when you sign out or it expires.
The app also keeps a few things in your browser so it opens as you left it: your name and which business you last used, entries you started but did not save, which guided tours you have already seen, and whether the side menu is open, which is remembered for seven days. None of it is sent to anyone else.
Our network provider, Cloudflare, may set a cookie to protect the site and the app from automated attacks.
All of this is needed for the site and the app to work, or remembers a choice you made. There are no advertising or analytics cookies, so there is nothing to switch off. You can clear any of it in your browser’s settings; you will then need to sign in again.
Children
Maaz Buk is for businesses, and is not directed at anyone under 18. We do not knowingly hold data about children. If you believe we have, write to privacy@maazbuk.com and we will delete it.
Who to contact
Write to privacy@maazbuk.com about anything on this page. Our data protection officer answers at the same address.
Changes to this policy
If we make a significant change to this policy, such as adding a new service provider, changing how long we keep data, or moving data to another country, we will email you before it takes effect. The date at the top of this page shows when it last changed.
Complaints
If you think we have mishandled your data, write to privacy@maazbuk.com first. You also have the right to complain to the Nigeria Data Protection Commission at any time.