Privacy Notice
Draft — pending legal review. Version 2026-10-24. Last updated 24 October 2026.
Data controller
The data controller is the operator of NaijaShowcase, an individual sole trader based in Nigeria. NaijaShowcase is not yet a registered company. Contact: [email protected]. If you have a legal right to know the operator’s legal name and address (for example, to exercise your rights or to complain to the Nigeria Data Protection Commission), email us and we will provide them. In this notice, “we” and “us” mean the operator.
What we collect
- Listing and ad details you enter (headline, price, general area, rooms, description).
- Photos you upload.
- Contact details (phone or email) you choose to give. These are shown publicly only if you switch on "Show contact publicly". Otherwise only the reviewer sees them.
- Your confirmations (authorization, photo rights, terms) and when you gave them.
- Reports you send, and any optional contact you add.
- A one-way hashed form of your IP address, used only for rate-limiting and spam prevention. We do not store the raw IP address.
- Referral codes in links, counted for tracking only. Referral codes are counted in aggregate; they are not linked to your identity.
- Inquiries: your name, contact and message, sent to the lister (consent; legitimate interests in preventing spam). Kept up to 12 months.
- Photo location data (GPS/EXIF) and original filenames are removed automatically when you upload.
We use no advertising trackers and no third-party analytics. If you choose the optional writing helper, the listing details you entered (not your contact details) are sent to Cloudflare Workers AI to draft a description. Cloudflare processes this on our behalf and does not use it to train models. We do not use paid AI services.
Your private edit link lets anyone who has it edit or withdraw your listing. Keep it private; ask us to reset it if it leaks. Edit links expire after 90 days. Email notifications are not active yet.
Why we use it (lawful basis)
We use your data to provide the listing you asked for (contract), to keep the service safe and prevent fraud, spam and discrimination (legitimate interests), and to show your contact publicly only where you consent. You can withdraw that consent at any time.
Who can see it
Public listings are visible to anyone with the page. Unlisted listings are visible only to people who have the link. Property-manager links are read-only. Photo downloads go only through authenticated routes, and photos are not stored in a public bucket. We do not sell your data. Our hosting provider (Cloudflare, including Cloudflare Workers AI for the optional writing helper) processes the data on the operator’s behalf. Booking payment messages are sent through WhatsApp (Meta), which processes them under its own terms.
How we share information
- Payments: if your booking is approved, we send you the operator’s bank account details privately by WhatsApp. Those details include the account holder’s name, which is the operator’s legal name, and are shared with you only. You pay directly into the operator’s personal bank account; no one else on the team receives your money. We record that payment details were shared, whether payment was confirmed, and any refund (date, booking reference, amount). The operator’s bank will see your name and account as the payer. We do not collect or store your bank card details or bank login. We use this data to carry out your booking (contract) and to keep accounting and tax records (legal obligation). Booking and payment records are kept for 6 years after the booking, then deleted.
Retention
Active listings and photos are kept while the listing is live. When a listing expires or you remove it, its published photos are deleted, and the form details are kept privately for up to 30 days as described below, then deleted. Submissions that are rejected or never approved are deleted within 90 days. Reports, inquiries and the hashed rate-limit records are kept for up to 12 months, then deleted. Withdrawn listings are hidden and kept until you ask us to delete them or for up to 30 days after you remove them.
After your listing expires. Free listings run for 30 days. When a listing expires, it is removed from search and public pages, and its published photos are deleted. We keep the details you entered in the listing form (such as the headline, description, general area, property details and your private contact) privately for 30 more days. During that time this information is not public. Only you, through your private link, and our review team can see it. We keep it only so you can restore or repost your listing without filling in the form again. At the end of the 30 days we delete it automatically. You can ask us to delete it sooner at any time: contact [email protected] or use the report form and choose "I am the lister — please remove". We will delete it within 30 days of your request, or sooner where we can. We rely on our legitimate interest in providing the service you asked for (NDPA 2023, s.25), and we keep the data no longer than needed for this purpose (s.24).
Lister accounts
Lister accounts. If we create a lister account for you, we keep your username, your display name, a scrambled (hashed) version of your password, your email address if you add one (used only for password reset links, after you confirm it), and a log of sign-ins and changes to your listings for security. We never see or store your password itself. Your account is kept while you list with us; if you close it or it is unused for 12 months, we delete it within 30 days, and your listings follow the 30-day rule above. Ask us to delete it at any time.
The email address on a lister account is optional. It is used only for account recovery and is never shown publicly. You can ask us to delete it at any time, using the report form.
Your rights
Under the Nigeria Data Protection Act 2023 (NDPA), and applicable US state privacy laws where they apply, you can ask to access, correct, delete or export your data, object to its use, or withdraw consent. Contact [email protected] or use the report form (choose "I am the lister — please remove"). We respond within 30 days. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng). The operator is responsible for responding to your request.
International transfer
Data may be processed outside Nigeria by our hosting provider (Cloudflare) and messaging provider (WhatsApp), with appropriate safeguards.
Children
The service is not intended for anyone under 18.