Privacy Policy

Who is responsible for your data

This marketplace is operated by [OPERATOR: registered company name] (registration number [OPERATOR: company registration number]), of [OPERATOR: registered address]. That company is the controller of the personal data described here.

Privacy questions and requests can be sent to support@mobiledatamart.ng.

What we collect

We collect the least we need to sell you a bundle, deliver it, and answer for it afterwards. What that comes to depends on how you use the marketplace.

• Account details — if you register: your email address, a username, and a password stored only as a hash. We never store your password itself.
• Order details — the mobile number the data is delivered to, the bundle bought, the price, and the payment reference.
• Guest details — if you check out without an account: an email address and, optionally, a phone number, used for the receipt and for order tracking.
• Vendor details — if you sell: your business name, the bank account you nominate for payouts, and the upstream provider credentials you connect. Credentials are encrypted at rest and are never shown again once saved, not even to you.
• Support and dispute content — the messages you send us and the description you give of a problem with an order.
• Technical data — the pages you visit, the site you arrived from, and an approximate location derived from your IP address, used to understand which traffic turns into sales.

Why we use it

To perform the contract we have with you: taking payment, delivering the data to the number you gave us, crediting a vendor for the sale, paying a vendor out, and handling a refund or a dispute.

To meet our legal and accounting obligations: keeping records of transactions and payments, and preventing fraud and abuse of the marketplace.

For our legitimate interest in running the business: measuring which pages and campaigns produce sales, and fixing problems. You can opt out of the advertising measurement described below.

Who we share it with

We share only what each party needs for its part of the job.

• The vendor fulfilling your order sees the mobile number the data is delivered to, the bundle, and your username. They never see your email address, your phone number as an account contact, or any other account detail.
• Payment providers receive the information needed to process the payment or payout. We do not store your full card details.
• Upstream data providers receive the recipient number and the bundle, because that is the delivery itself. This happens through the vendor's own provider account.
• Advertising platforms receive measurement events — a purchase, a signup — with any email address or phone number hashed before it leaves our systems, so the value cannot be read back. This is what lets us tell whether an advert produced a sale.
• Service providers who host the platform and send our email receive data as part of providing that service.
• Authorities, where the law requires it or where it is necessary to investigate fraud or a crime.

Advertising measurement and cookies

We use cookies and similar storage to keep you signed in, to remember your cart, and to record how you arrived at the site — which advert or link brought you here — so that a sale can be credited to the right source. This first-touch information is stored with the order, which is how a campaign can be judged months later without keeping the cookie.

Where advertising measurement is enabled, a platform such as Meta may receive an event confirming that a purchase or signup happened. Email addresses and phone numbers are hashed with SHA-256 before they are sent, which is the form the platform matches against; we never send a readable identifier.

You can block or clear these cookies in your browser without losing the ability to buy. If you block them, a purchase still completes — it simply may not be attributed to the advert that led to it.

How long we keep it

Order, payment and settlement records are kept for as long as we need them to account for the money and to meet tax and record-keeping obligations. This is deliberate: a settlement has to remain explainable years after the fact, which is why the price and fee on an order are fixed when it is placed rather than recomputed later.

Analytics data about page visits is retained for a limited period and then removed automatically. It is the only collection whose growth tracks traffic rather than transactions, so it is the one with a retention limit.

Support conversations are kept while an account is open and for a period afterwards, so that a later dispute about the same order can be answered.

Your rights

You can ask for a copy of the personal data we hold about you, ask us to correct it if it is wrong, and ask us to delete it where we are not required to keep it — a completed order's financial record is an example of something we must retain.

You can close your account at any time. Closing it does not delete the transaction records we are obliged to keep, but it does stop us using your details for anything else.

To exercise any of these, contact support@mobiledatamart.ng. We may need to confirm your identity before acting, particularly for a guest order, where the order's tracking link is the evidence that the order is yours.

Security

Passwords are stored as hashes and never in readable form. Vendor provider credentials are encrypted at rest with authenticated encryption. Access to buyer contact details is restricted to the operators who need it, and every privileged action on an account or an order is recorded in an audit log that cannot be edited.

Changes

If we change how we handle personal data, we will update this page and the date at the top of it. Where a change materially affects you, we will tell you through the account or the email address on file.