Privacy Policy
How Chelly ([Chelly Legal Entity Ltd], Lagos, Nigeria) collects, uses, shares and protects information to run a trusted local marketplace — under the Nigeria Data Protection Act 2023 (NDPA) and NDPR. Data controller: [Chelly Legal Entity Ltd], [Registered address, Lagos, Nigeria]. DPO/privacy contact: privacy@chelly.ng. General support: support@chelly.ng.
Version 2.0 · Last updated 17 September 2026 · Operated by [Chelly Legal Entity Ltd]
1. Information we collect
Account & identity: name, email, password (hashed), phone/WhatsApp number and verification status, profile photo, referral code. Seller/verification data: store name, business category, bio, store/pickup location, and where you provide them — payout bank details, ID/matric details for rider/student verification. Transaction data: listings, orders, escrow/payment references (Paystack/SafeNode), wallet/ TipPoint balances, withdrawals, disputes, support tickets and messages. Device & usage: device type, app settings, notification preferences (including WhatsApp alerts), crash/diagnostic data, and the chelly_return_to cookie for post-login redirects. Location: only when you provide it (store/pickup/delivery addresses) or enable location-based discovery/delivery (GPS) — see section 4. We do NOT collect card PINs, CVVs, OTPs beyond verification, or seed phrases — payment credentials are handled by our providers and never displayed publicly.
2. Lawful bases and why we use it
Contract: operate accounts, checkout, escrow, delivery, payouts, disputes and support. Consent: location/GPS, WhatsApp OTP and alerts, marketing/notifications where opt-in is required — withdraw anytime in settings or via Support. Legitimate interests: fraud prevention, safety, platform integrity, relevant discovery (we do not infer sensitive traits like religion/health from names for recommendations). Legal obligation: tax, accounting, regulatory, court/law-enforcement compliance, and NDPA record-keeping. If you do not provide required details (e.g. delivery address, payout details), we cannot fulfil orders or payouts.
3. Who can see it and who we share with
On Chelly: public profile/listing details are visible to other users. Delivery contact/address details are limited to the people fulfilling an assigned order (seller, assigned rider, buyer) — riders only ever see their assigned jobs. Providers (processors, only what they need): Paystack (payment processing), SafeNode/safenode.ng (escrow holding), Google (Google sign-in where you use it), hosting/infrastructure and email/SMS/WhatsApp delivery vendors, mapping (OpenStreetMap/Nominatim) for address search. We never sell personal data. Legal/safety: regulators, law enforcement or courts where required by Nigerian law or valid order; schools for rider verification where lawful; dispute counterparties only the minimum needed to resolve a case. Cross-border transfers (e.g. cloud/Google) use NDPA-appropriate safeguards (contracts, necessity, consent where required).
4. Location, cookies and notifications
Location: optional except where needed for delivery. GPS is used only after permission to rank nearby pickups/deliveries; you can deny it (proximity hidden) and type addresses manually. Store/pickup locations you save are used for discovery and fulfilment. Cookies/storage: essential cookies/storage (session, chelly_return_to redirect, security) are strictly necessary. Preference storage (theme, filters, cached location fix with consent) improves experience. No advertising cookies. Clear site data / use private mode to limit non-essential storage. Notifications: transactional messages (OTP, order/delivery/dispute updates) are part of the service. Marketing/WhatsApp job alerts are opt-in/out — toggle in settings (e.g. rider WhatsApp alerts) or reply STOP / contact Support.
5. Retention — how long we keep it
Active account data: kept while your account is active. Orders, escrow/payment references, wallet/withdrawal and dispute records: minimum 5 years after completion/closure for legal, tax, anti-fraud and dispute reasons (even after account closure). Support tickets/messages: up to 3 years after closure unless law requires longer. Verification/rider application data (including rejected): up to 3 years for safety/fraud prevention. Device/diagnostic logs: up to 12 months. Location fixes: cached briefly for ranking; saved addresses kept until you delete them. When retention expires and no legal hold applies, data is deleted or anonymised.
6. Your rights and how to exercise them
Under the NDPA you may request: access/portability, correction, deletion (subject to section 5 retention), withdrawal of consent, objection/restriction, and to lodge a complaint with the Nigeria Data Protection Commission (NDPC). How: email privacy@chelly.ng or open an ACCOUNT ticket in Help Centre from your account email. We verify identity, respond within 30 days (extendable once with reasons), and explain any lawful refusal (e.g. we must retain escrow records). Account/profile edits, listing deletion and notification toggles are available in-app for day-to-day control. Automated decisions: fraud/safety flags may limit actions; you may request human review via Support.
7. Security, breaches and children
Security: TLS in transit, hashed passwords, role-based access (riders see only assigned jobs), OTP verification for phones, HMAC-verified payment webhooks, and least-privilege staff access. No system is perfect — protect your sign-in, never share OTPs, and report suspected compromise immediately. Breaches: if a breach likely risks your rights, we notify you and the NDPC without undue delay (and within NDPA timelines), describing what happened, likely effects and mitigation. Children: Chelly is 18+. We do not knowingly collect under-18 data. If you believe a child uses Chelly, contact privacy@chelly.ng and we will close the account and delete or restrict the data subject to lawful retention.
8. Changes and contact
Current version v2.0, 17 September 2026. Material changes are notified in-app or by email/notice before they take effect; continued use afterwards means acceptance. Prior versions are available on request. Controller: [Chelly Legal Entity Ltd] ([RC Number]), [Registered address, Lagos, Nigeria]. Privacy/DPO: privacy@chelly.ng. Support: support@chelly.ng / Help Centre. Regulator: Nigeria Data Protection Commission (NDPC) — you may complain to the NDPC independent of contacting us.
Questions about this policy? support@chelly.ng · Contact Chelly Support.