Privacy Policy

1. What we collect

Your name, email, phone number and delivery address; your orders, reviews and messages; for sellers, business details and payout bank account; for drivers, an ID photo, a face photo, plate number and payout bank account. Card details are handled by Paystack, Moniepoint or Flutterwave and never reach our servers.

2. Why

To run your account, process orders and payments, deliver orders, handle refunds and problem reports, prevent fraud, and send you order updates by email and in the app.

3. Who sees it

Sellers see only what they need to deliver their part of your order: your first name, phone number, delivery address, area and order note. They don't see your email or other orders.

NsukMarket drivers see the same for the stops on their trip. The seller and buyers of a trip see the driver's name, face photo, phone number, rating and plate number, so they know it's really them. A driver's ID photo is seen only by NsukMarket.

Paystack, Moniepoint and Flutterwave process payments, refunds and payouts. Our email provider sends order emails. We share data with authorities only when the law requires.

4. How long we keep it

Account data while your account is open. Order and payment records as long as tax and accounting law requires. Problem-report photos until the case is closed and the refund window has passed.

5. Your rights

Under the Nigeria Data Protection Act 2023 you can ask for a copy of your data, correct it, or ask us to delete your account (we keep what the law requires). Contact us through the Contact page.

6. Cookies

We only use cookies the site needs to work. We don't use advertising or tracking cookies, and we don't sell or share what you do on the site with advertisers.

Signing in (nsm_session in the shop, nsm_driver in the driver app): keeps you signed in. If you don't use the site for 7 days you're signed out and need to sign in again. Signing out removes it.

Cart (nsm_cart): remembers what's in your cart.

Continue with Google (nsm_google, nsm_google_signup): used for a few minutes while you sign in or sign up with Google, to make sure the answer from Google is for you.

Cloudflare's “not a bot” check on sign-in and sign-up forms runs in its own box and may use its own cookies to tell people from bots.

You can delete cookies in your browser settings at any time. If you block them, you won't be able to sign in or keep a cart.

7. Security

Passwords are stored as one-way hashes. Admin accounts need two-step sign in. Payouts can only go to a seller's registered account, and changes are logged and emailed to the seller.