Privacy Policy

Subbyfragrance, [registered business name], [business address], Nigeria.
Contact for privacy questions: [privacy contact email].

• Account details: your name and email address. If you set a password, we store it only as a one-way hashed value; we cannot read it.
• Google sign-in: if you choose “Continue with Google”, we receive your name and email address from Google. We don't receive your Google password.
• Orders and delivery: the name, email address, phone number and delivery address you give at checkout, plus what you bought, the amount paid and delivery progress.
• Payments: payments are processed by Monnify, our payment provider. Card details are entered on Monnify's checkout page; we never see or store your card number. We keep the payment reference, amount and status for each transaction.
• Wallet: your wallet balance and a record of its top-ups, payments and refunds.
• Shopping activity: your cart, favourites and the products you view, so the site works across visits.
• Technical data: basic server logs, such as IP address, browser type and the time of each request, used to keep the site secure and to diagnose problems.

• To create and run your account, and to sign you in with a password, a one-time email code or Google.
• To take, process and deliver your orders, and to send receipts and delivery updates.
• To process payments and wallet top-ups and to issue refunds.
• To answer your questions and to contact you about your orders.
• To prevent fraud, abuse and unauthorised access, and to keep the site secure.
• To meet our legal and accounting obligations.

We don't sell your personal information, and we don't use it for third-party advertising.

We share information only with the service providers we need to run the business:

• Monnify, for payments and wallet top-ups.
• ZeptoMail, which sends our emails, such as login codes, password reset codes and receipts.
• Cloudinary, which hosts product and category images. It holds no customer personal data.
• Google, only if you use Google sign-in.
• Delivery partners, who receive your name, address and phone number to deliver your order.
• WhatsApp, if you choose to message us through the WhatsApp button. Messages go through WhatsApp's own service and are governed by WhatsApp's privacy policy.

We may also disclose information where the law requires it.

We use browser storage to keep you signed in and to remember your cart and favourites. This is essential for the site to work. We don't use advertising or tracking cookies.

• Account details stay while your account is open. You can delete your account at any time.
• Order and payment records are kept for as long as needed for accounting and tax purposes.
• One-time login and reset codes expire after 10 minutes.
• Server logs are kept for a limited period and then deleted.

We protect your information with encryption in transit (HTTPS), hashed passwords, one-time codes that expire, and access controls that limit staff to the information they need. No system is perfectly secure, so please keep your password private and tell us straight away if you suspect your account has been misused.

Under the Nigeria Data Protection Act 2023 you can ask us to access, correct or delete your personal information, and to object to or restrict certain uses of it. You can update your name and change your password from your account's Profile and Security pages, and delete your account from Profile details. For anything else, email [privacy contact email]. We'll respond within a reasonable time.

If you're not satisfied with our response, you can complain to the Nigeria Data Protection Commission.

Our site is intended for adults. We don't knowingly collect personal information from children.

We may update this policy. The date at the top shows when it last changed. Significant changes will be flagged on the site.