Privacy Policy

Last updated: March 19, 2026

DepMi Limited ("DepMi") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

Account data: Name, email address, phone number, date of birth, profile photo, and username when you register.

Identity verification data: BVN and NIN reference tokens (we store Dojah verification reference IDs only — we never store raw BVN or NIN numbers).

Transaction data: Order details, payment references, escrow records, and Dep transaction history.

Behavioural data: In-app interactions including products viewed, feed impressions, searches made, items liked or saved, and bids placed — collected to improve the platform and personalise your experience. We collect a session identifier stored in your browser's local storage to group interactions anonymously. We do not use third-party tracking tools.

Device data: IP address, browser type, and device identifiers for security and fraud prevention.

2. Legal Basis for Processing

We process your data under the following lawful bases as defined by the Nigeria Data Protection Act 2023 (NDPA):

• Contract performance — processing necessary to operate your account, process orders, and fulfil transactions
• Legitimate interest — first-party behavioural analytics to improve the product, detect fraud, and personalise your feed. You can opt out at any time in Settings → Privacy
• Legal obligation — compliance with Nigerian financial and tax regulations
• Consent — transactional communications (you can withdraw consent at any time)

3. How We Use Your Data

• To operate the platform and process transactions securely
• To verify your identity and prevent fraud
• To send transactional notifications (order updates, bid alerts, messages)
• To personalise your feed and recommendations
• To comply with Nigerian financial regulations (CBN, FIRS)
• To improve platform performance and fix bugs

4. Data Sharing

We share your data only with:

• Flutterwave — payment processing (bound by their privacy policy)
• Dojah / Smile ID — identity verification (KYC providers)
• Resend — transactional email delivery
• Termii — SMS OTP delivery
• Cloudinary — image storage and delivery
• Neon / Vercel — infrastructure hosting

We never sell your data to third parties for advertising.

5. Data Retention

We retain account data for as long as your account is active. Transaction records are retained for 7 years as required by Nigerian financial regulations. Raw behavioural event data is automatically purged after 90 days — only aggregated summaries are kept long-term. You may request deletion of non-transaction data at any time.

6. Security

All data is encrypted in transit (TLS). Passwords are hashed with bcrypt (12+ salt rounds). Payment credentials are never stored — only tokenised references from Flutterwave. We conduct regular security audits and rate-limit sensitive endpoints.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Opt out of behavioural analytics at any time via Settings → Privacy
• Opt out of non-transactional communications
• Receive a copy of your data in a portable format

To exercise these rights, email privacy@depmi.com.

8. Cookies & Local Storage

DepMi uses session cookies for authentication and local storage for user preferences and an anonymous session identifier used in behavioural analytics. We do not use third-party advertising cookies or tracking pixels.

9. Children

DepMi is not intended for users under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact us at privacy@depmi.com.

10. Changes

We may update this policy. Material changes will be communicated by email or in-app notification. Continued use after changes constitutes acceptance.

11. Contact

Data protection queries: privacy@depmi.com