01Who we are and what this covers
My Thrift Clothing Limited, trading as My Thrift, is responsible for the personal information we determine how and why to process through our marketplace, websites, Android and iOS apps, and support services. In data-protection terms, we are the controller for those activities.
This notice covers customers, vendors, people paying for another customer, guest question senders and visitors. Payment providers, delivery partners and other independent services may also act as controllers for their own activities; their notices apply to that processing. Our Terms and Conditions explain the commercial relationship, not permission to use personal information for unrelated purposes.
Contact hello@shopmythrift.com for privacy questions or requests. Do not send passwords, payment PINs or complete card details.
02Information you provide
We collect information needed for the features you choose. Some information is necessary to create an account, verify a vendor, complete an order or resolve a case; optional preferences are not a condition of browsing.
- Account information: name, email address, phone number, account role, authentication identifiers, chosen profile image or avatar, and account settings. Sign-in providers supply the identity information you authorise them to share.
- Shopping information: saved sizes and preferences, favourites, followed stores, carts, offers, purchases, stockpiles, pickup arrangements, delivery addresses, coordinates and delivery instructions.
- Vendor information: store name, description, product listings and photos, business preferences, pickup and courier-collection addresses, identity documents submitted for review, payout bank details and verification/correction records.
- Communications: product questions, negotiation messages, replies, read/activity information, support conversations, support photos, reviews, reports, disputes and evidence you choose to provide.
- Payment information: payment references, amounts, payment status, wallet and transaction identifiers, refund and withdrawal records, and bank details where required for payouts or refunds. Payment providers collect payment credentials through their payment interfaces; do not share those credentials in chat.
03Information from devices and other sources
We receive payment confirmations and transaction updates from payment services; quotes, courier details, tracking and delivery updates from logistics services; and information supplied by a counterparty or staff member handling an order, report or support case.
When you use the service, we process technical and interaction information such as IP address, browser/device and operating-system information, app version, timestamps, session identifiers, navigation and product interactions, error references, crash diagnostics and network performance. Notification services provide device/browser push subscription identifiers and delivery information.
A person using Pay for Me or supplying a recipient address must have a proper basis to share that person's information. Shared payment links reveal the order summary needed to make the payment to someone holding the link; share them only with your intended payer.
04Why we use information and our lawful bases
We use the applicable lawful basis for each purpose under the Nigeria Data Protection Act 2023. Accepting the marketplace Terms is not blanket consent to every form of data processing.
- Contract and steps requested before a contract: creating accounts, facilitating purchases and offers, storing stockpiles, arranging pickup or delivery, processing payments and refunds, and providing requested support.
- Legitimate interests, where those interests do not override your rights: securing accounts, preventing fraud and abuse, moderating marketplace activity, resolving disputes, operating and improving the service, and providing relevant recommendations. We consider necessity, proportionality and the impact on you.
- Legal obligations: responding to valid legal requests and keeping records required by applicable law. We do not describe every identity check as legally mandatory; some checks are marketplace trust and safety measures.
- Consent where required: optional marketing, certain analytics or tracking activities, and access to device features where consent is the applicable basis. Consent must be specific and can be withdrawn; withdrawal does not invalidate earlier lawful processing.
- Vital interests in exceptional circumstances where processing is necessary to protect someone's life or safety and permitted by law.
05What other people can see
Published store profiles, listings and product images, displayed store statistics/badges, and submitted public reviews may be visible to other visitors, search engines and people viewing shared links. Your chat name/avatar and the messages you send are visible to the other participant. Do not place private contact or financial information in public content.
Vendor identity documents, payout information and private verification records are not public store content. Staff access is limited according to authorised duties, including onboarding, safety, support and review.
Vendors receive the order and customer identity information needed to prepare and identify a purchase, not general access to customers' private contact or home-delivery details. We do not provide customer phone numbers, email addresses or home-delivery addresses to vendors through the ordinary fulfilment workflow. Information customers themselves put into messages can be seen by the recipient.
For a pickup order, the customer receives the authorised pickup location and instructions. A vendor's contact number may be shared with that customer when the vendor opts to provide it for pickup assistance. Exact private pickup addresses are not intended as unrestricted public store information.
06Addresses, maps and delivery partners
We use addresses and coordinates to locate pickup/delivery points, obtain serviceable courier options, estimate charges and arrange fulfilment. If you choose a current-location feature, location permission is requested for that action; this is not a continuous background-location tracking service.
Shipbubble and the selected courier receive the information necessary to quote, collect and deliver a parcel. This may include the sender/recipient's name, contact details, pickup and destination addresses/coordinates, package details, reference numbers and delivery notes. Only put information a rider needs in a delivery note.
Google Maps/Places helps search and resolve addresses. Opening directions in an external maps app also makes the selected destination available to that service under its own privacy notice. Tracking updates describe the shipment, not continuous tracking of the customer's device.
07Payments, wallets and Pay for Me
Paystack is a payment partner. Payment services process the information needed to authorise transactions, prevent fraud, settle funds, handle disputes and meet their legal obligations. My Thrift uses transaction references and outcomes to associate a payment with an order or wallet operation.
A Pay for Me payer's identity and transaction information are associated with the payment. The order creator remains the order customer. A requested bank refund for a Pay for Me payment requires verification of the original payer and payment, rather than disclosure of the payer's banking information to the order creator.
We may retain limited payment and financial-case records for reconciliation, disputes, fraud prevention and applicable legal requirements. A displayed wallet balance is not a promise that all provider records are stored only by My Thrift.
08Vendor verification and account safety
We review submitted identity and store information to assess applications, request corrections and investigate suspicious activity. Authorised reviewers may access the submitted evidence and keep review/audit records. A store approval or badge does not certify the authenticity or quality of every listing.
Verification information is kept separately from information intended for public store display. Approved vendors who need to correct identity information should contact support. We may request proportionate additional evidence when necessary, but will not ask you to disclose a password or payment PIN to support.
09Chats, questions, support and moderation
We store messages and the associated participants, timestamps, offer events, pickup context, read/activity state and reports to provide conversations and resolve issues. Chats are not represented as end-to-end encrypted or inaccessible to My Thrift. Authorised staff and automated safety checks may process relevant content to investigate reports, detect prohibited conduct, prevent fraud and provide support.
Guest questions use an email address to verify the request and deliver an answer. The vendor sees the question through the platform rather than receiving unrestricted access to the guest's private email address. We use email/device-related records to enforce guest limits and deter abuse.
Support receives the context from which you requested help, relevant account/order information and available error references. Photos you send to support are used as case evidence, not public product images. Support staff names identify who is assisting you. Resolved conversations are retained according to the applicable retention purpose; resolution is not immediate erasure.
10Personalisation, metrics and automated assistance
We use interactions such as views, searches, favourites, follows, cart activity and purchases, together with listing information and preferences, to rank products and suggest categories or stores. Recommendations are predictions, not guarantees, and may change as your interests or available inventory change.
Vendor metrics and badges use relevant marketplace activity such as orders, fulfilment, engagement and reviews. A badge is not insurance, an endorsement of every product, or a guarantee of future performance. You may contact us about inaccurate information or an account decision that you believe needs human review.
On supported mobile devices, image labelling analyses a vendor's first selected product image on the device to suggest listing details; the vendor can edit the suggestions. Smart reply may process recent support messages on the device to suggest a reply that is not sent automatically. Uploaded listing photos and recommendation feedback remain subject to the normal listing and analytics processing described here.
We use automated checks for eligibility, abuse prevention and transaction integrity. Where applicable law gives you rights concerning solely automated decisions with legal or similarly significant effects, you may request an explanation and meaningful human review.
11Analytics and crash diagnostics
We use PostHog for product analytics, including interaction events and account-associated information such as an account identifier and profile/contact attributes used to identify signed-in activity. The app also contains session-replay functionality, which can capture sequences of on-screen interactions where enabled. It is distinct from recording your camera or microphone.
We use Firebase Crashlytics on supported native apps and operational error records to investigate crashes, failed requests and performance problems. Technical diagnostics help us understand faults; do not include unnecessary personal information in an error report.
Optional analytics and replay are subject to the notices, consent and controls required by applicable law. Use the available privacy controls or contact us to exercise your rights and ask about analytics processing. This notice is not itself consent to optional tracking.
12Cookies, local storage and device permissions
We use cookies or similar browser/device storage for sign-in continuity, role preferences, cart and draft recovery, safety limits and other settings. Additional identifiers can be used for analytics as described above. Uninstalling the app or clearing browser storage is not the same as deleting account information held on our servers.
Camera/photo access lets you take or select images for the feature you use; location access supports chosen address features; notification permission allows push delivery; and a device's authentication prompt may help verify a sensitive action. Where device biometrics are used, the operating system handles them—we do not receive your fingerprint or face template from that verification.
You can manage permissions in device/browser settings. Declining an optional permission should affect the feature that needs it, not silently give access anyway. Blocking necessary storage may prevent sign-in or recovery of local drafts. We do not request microphone access for voice messages; marketplace chat is text-based, with image attachments available in support where offered.
13Service notifications and marketing
We use in-app messages, push notifications and email for relevant order, stockpile, offer, chat, support, security and account events. Device/browser push identifiers are associated with the signed-in account and notification delivery. Lock-screen previews can be visible to anyone who can see your device; use your operating-system preview controls if needed.
Following a store can enable updates about that store, subject to permissions and notification settings. You can unfollow the store and manage available notification controls. We distinguish operational communications from promotional marketing and honour applicable marketing-consent and unsubscribe requirements. Disabling push does not erase the underlying order or stop essential account/security communications by other appropriate channels.
14Service providers and other disclosures
Service providers process information needed for hosting, authentication, storage, messaging, diagnostics, payments, delivery and communications. Our setup uses Google/Firebase services, Google Maps/Places, PostHog, Paystack, Shipbubble and selected couriers, image-delivery services such as ImageKit, and email delivery/mailbox providers including SendPulse and Mango Mail. The information shared depends on the feature and each provider's role; an email provider does not need every item of account data.
We may disclose relevant information to professional advisers, authorities responding to a valid legal process, or another person where necessary and lawful to protect rights or safety. If the business is reorganised or transferred, relevant information may be transferred subject to lawful safeguards and appropriate notice. We do not sell personal information.
Vendors and couriers may have independent responsibilities for information lawfully received to fulfil an order. They are not authorised to use it for unrelated marketing or harassment. Contact us if a participant misuses your information.
15Processing outside Nigeria
Some providers operate internationally, so information may be processed or stored outside Nigeria. We must use an applicable lawful transfer basis and appropriate safeguards, such as recognised contractual protections or other safeguards required by the Nigeria Data Protection Act. A provider's overseas location does not remove your rights.
Contact us for information about relevant recipients, transfer arrangements and safeguards. We do not promise that all data remains in Nigeria or that every provider uses the same storage country.
16Retention and account deletion
While an account is active, we retain information for the service or purpose for which it is needed, subject to applicable legal requirements. That includes order histories, open conversations, verification and dispute records, security evidence and operational diagnostics. Local caches, backups and third-party records can follow different lifecycles; we do not promise a universal lifetime for every copy.
Customers can request deletion through Settings; vendors can use Account actions in their profile. You can also email our contact address without reinstalling the app. We verify identity proportionately before fulfilling a request. Pending paid orders, refunds, disputes, wallet settlement or a genuine legal/safety hold may need resolution before final account deletion. An unanswered general support question alone is not a reason to prevent deletion.
A deletion request restricts new marketplace activity; a vendor's store and listings become unavailable for new business. Necessary fulfilment and support continue while outstanding obligations are resolved. Uninstalling, signing out, switching accounts or requesting deletion is not confirmation that final erasure has completed.
After completed account deletion, profile and shopping information is erased through the deletion process. Necessary transaction, dispute and safety records are retained for three calendar months after deletion, unless a legal obligation, unresolved claim, safety investigation or legal hold requires relevant records for longer. At the end of the applicable period, records are deleted or anonymised, with review where evidence contains information about multiple people or requires third-party follow-up.
A deletion request does not require another participant to lose records they are lawfully entitled to retain, and payment/delivery providers may retain their own records under their obligations. We assess removal or anonymisation of shared content rather than promising immediate erasure of all correspondence, backups or copies held by others. You can ask us which categories remain and why.
17Security and incidents
We use measures appropriate to the information and risks, including authenticated access, access controls, encrypted transport, private-file protections and audit/operational records. No service can guarantee absolute security. Keep your sign-in credentials and payment PIN private, secure your device and report suspected compromise promptly.
We assess suspected personal-data breaches, take containment and remediation steps, and notify the regulator and affected people where legally required. We do not use this notice to waive those duties or describe all stored information as end-to-end encrypted.
18Your rights and how to exercise them
Subject to the conditions and exceptions in applicable law, you may request information about processing, access to your information, correction, erasure, restriction or objection to processing, portability, and withdrawal of consent. You may also exercise applicable rights concerning automated decision-making. Withdrawing consent does not prevent processing supported by another valid lawful basis.
Email hello@shopmythrift.com with your request and the account concerned, or use in-app support. We may ask for reasonable verification, explain any lawful limitation, and respond within the applicable legal timeframe. You do not have to pay for ordinary access to these rights, except where a charge is expressly permitted by law.
You may complain to the Nigeria Data Protection Commission without first giving up any other remedy. Contacting My Thrift first can help us investigate but is not a condition of contacting the regulator.
19Children and age eligibility
My Thrift accounts are for people aged 18 or older. Products for children may be sold, but that does not make the service intended for children to create accounts. We do not knowingly permit under-18 account holders. If you believe a child has provided personal information inappropriately, contact us so we can investigate and take the appropriate action.
20Changes and contact
We update this notice when services or data practices change. The version and date identify the text you are reading; material changes receive appropriate notice, and new consent is obtained where required. Continued use is not a substitute for consent where the law requires it.
My Thrift Clothing Limited — privacy and general support: hello@shopmythrift.com.