Privacy Policy

1. Introduction

This Privacy Policy explains how Bizthom Services Ltd ("Bizthom", "we", "us", "our") collects, uses, stores, discloses, and protects your personal information when you use our website at https://bizthom.com, our mobile applications, and our services (collectively, the "Services").

This Privacy Policy is incorporated by reference into our Terms of Service and Acceptable Use Policy .

By using the Services, you consent to the collection and use of your information as described in this policy. If you do not agree with this policy, please do not use the Services.

As used in this policy, "Vendor" or "Merchant" means any person or business that creates a store on Bizthom. "Customer" or "Buyer" means any person who purchases products from a vendor's store. "User" means any person who accesses or uses the Services in any capacity.

2. Information We Collect

2.1 Information Vendors Provide

When you register as a vendor, we collect:

• Account information: Full name, email address, phone number (WhatsApp), and business name
• Identity verification: Bank Verification Number (BVN), which is verified through our licensed payment processing partners. BVN verification returns your legal name, date of birth, and phone number
• Financial information: Bank account details (bank name, account number, account name) for withdrawal purposes, verified through our payment processing partners
• Store content: Product listings, descriptions, images, pricing, and other content you upload
• Business information: Business stage, product categories, and goals (collected during onboarding for platform personalisation)

2.2 Information Customers Provide

When customers purchase products through vendor stores, we collect:

• Order information: Name, delivery address, phone number, email address
• Payment information: Payment details are processed directly by our licensed payment processing partners (Paystack, Nomba). Bizthom does not store credit card numbers, debit card numbers, or bank login credentials

2.3 Information Collected Automatically

When you use the Services, we may automatically collect:

• Usage data: Pages visited, features used, actions taken, time spent on the platform
• Device information: Browser type, operating system, device type, screen resolution
• Log data: IP address, access times, referring URLs, error logs
• Cookies and similar technologies: See Section 7 below

2.4 Information from Third Parties

We may receive information about you from:

• Payment processing partners (Paystack, Nomba): Transaction status, verification results, chargeback notifications
• Identity verification services: BVN verification results, bank account verification results
• Analytics providers: Aggregated usage and traffic data
• Google (when you connect Google Contacts): see Section 2.6 below
• Zoho (when you connect Zoho Books): see Section 2.7 below

2.5 AI Tools

Bizthom provides AI-powered tools (including Ejiro AI) to assist vendors with sales, customer engagement, and business operations. When you use these tools:

• We process the information you input (product details, customer queries, conversation history) to generate responses and recommendations
• AI-generated content and interactions may be stored to improve the quality of the tools
• We do not share individual AI interactions with third parties for their own purposes

2.6 Google User Data (Optional Integrations)

If you choose to connect your Google account to Bizthom (via "Connect Google Contacts" or similar features), we access specific Google user data only with your explicit consent during the Google OAuth flow:

• Data accessed: Your Google Contacts (read and write access via the Google People API), under the scope https://www.googleapis.com/auth/contacts .
• What we do with it: When a new customer is added to your Bizthom account — whether they message you on WhatsApp, place an order on your storefront, are imported from a spreadsheet or another platform, or are added by your team — Bizthom writes that customer as a new entry in your Google Contacts so their name appears in your phone book and WhatsApp chats. We read existing Google Contacts only to the extent necessary to avoid creating duplicates.
• Storage: We store the Google OAuth access token and refresh token encrypted in our database, scoped to your Bizthom business account. We do not store a copy of your Google Contacts on our servers — writes are made directly to your Google account via the People API.
• Sharing: We never share Google user data with third parties, advertisers, or AI/ML training systems. Google user data is not used for any purpose other than the integration feature you connected it for.
• Retention and deletion: You can disconnect Google at any time from Extensions → Google Contacts. On disconnect, we immediately revoke and delete the stored tokens. Contacts already written to your Google account remain in your Google account and are subject to Google's own retention rules; you can delete them directly in Google Contacts.
• Compliance: Bizthom's use of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements.

2.7 Zoho Books Data (Optional Integration)

If you connect Zoho Books, you authorise Bizthom to exchange the accounting information required to keep your selected Zoho Books organization current.

• Data sent to Zoho: Customer contact details, products, sales invoices, payments, refunds, expenses, fees and settlement transfers from the cutover date you choose.
• Data received from Zoho: Organization settings, chart of accounts, currencies, taxes and expenses. Only expenses are imported back into Bizthom.
• Storage: Zoho OAuth tokens are encrypted. We retain Zoho record identifiers, mappings and sync audit history to prevent duplicate accounting entries and explain sync failures.
• Control and deletion: You can disconnect from Extensions → Zoho Books. We revoke and delete the stored tokens immediately; records already created in Zoho Books remain under your control in Zoho.

2.8 Facebook Login (Optional)

If you choose to sign in with Facebook ("Continue with Facebook"), we receive, with your consent during the Facebook authorisation flow, your name, email address, profile photo, and Facebook user ID (scope email plus Facebook's default public profile). We use this information only to create or access your Bizthom account.

• Storage: We store your Facebook user ID and profile photo against your Bizthom account so we can recognise you on future sign-ins.
• Retention and deletion: You can remove this link at any time. On a Facebook data-deletion or deauthorization request, we delete the Facebook link and the profile photo we retrieved from Facebook.

2.9 Meta Ads Data (Optional Integration)

If you connect your Meta (Facebook) Ads account, we access data only with your explicit consent during the Meta authorisation flow, under the ads_read permission:

• Data accessed: your list of Meta ad accounts (account ID, name, currency); and, for the ad account you select, your campaign names and statuses and the per-campaign daily advertising spend, impressions, reach, and clicks. We do not access customer or contact data, conversions, or the contents of your ads, and we never create, edit, or manage your campaigns.
• What we do with it: We display your advertising spend and performance inside your Bizthom dashboard alongside your sales, so you can compare advertising cost to revenue.
• Storage: The Meta access token is stored encrypted at rest, scoped to your business. Your ad-account details and the performance figures above are stored against your business. We do not store a Meta refresh token.
• Sharing: We never sell or share Meta data with third parties, and never use it to train AI/ML systems.
• Retention and deletion: You can disconnect at any time from Extensions → Meta Ads. When you do, we delete the stored token, the ad-account link, and all campaign and performance records obtained from Meta. We also honour Meta's Data Deletion and Deauthorization callbacks automatically, which delete the same data.
• Compliance: Our use of data received from Meta adheres to the Meta Platform Terms and Developer Policies.

3. How We Use Your Information

3.1 Provide and Operate the Services

• Create and manage your account
• Generate and host your online store
• Process orders and track fulfillment
• Credit earnings to your wallet and process withdrawals
• Verify your identity (BVN verification, bank account verification)
• Facilitate communication between vendors and customers
• Provide AI-powered sales and engagement tools
• Write customers to your Google Contacts when you have connected Google (see Section 2.6)

3.2 Improve the Services

• Analyse usage patterns to improve features and user experience
• Develop new products and services
• Fix bugs, resolve issues, and maintain platform performance
• Conduct research and analysis (using aggregated, anonymised data)

3.3 Communicate with You

• Send order notifications, payment confirmations, and withdrawal alerts
• Send platform updates, feature announcements, and service notices
• Respond to your enquiries and support requests
• Send marketing communications (with your consent; you can opt out at any time)

3.4 Safety and Compliance

• Detect, prevent, and investigate fraud, abuse, and security threats
• Enforce our Terms of Service and Acceptable Use Policy
• Comply with legal obligations, court orders, and regulatory requirements
• Respond to lawful requests from law enforcement or government authorities

4. How We Share Your Information

Bizthom does not sell, rent, or trade your personal information to third parties. We share your information only in the following circumstances:

4.1 With Payment Processing Partners

We share necessary information with our licensed payment processing partners (currently Paystack and Nomba) to process payments, verify identities (BVN, bank accounts), create virtual accounts, and process withdrawals. Our payment partners are bound by their own privacy policies and regulatory obligations.

4.2 Between Vendors and Customers

When a customer places an order, the vendor receives the customer's name, delivery address, phone number, and order details to fulfill the order. We do not share customer payment card details with vendors.

4.3 With Service Providers

We may share information with third-party service providers who help us operate the Services, including:

• Cloud hosting and infrastructure providers
• Email and messaging service providers (for transactional communications)
• Analytics providers
• Customer support tools
• Accounting providers you explicitly connect, including Zoho Books

These providers are contractually bound to use your information only for the purposes of providing services to us and are required to maintain appropriate security measures.

4.4 With Distributors

When a vendor onboards distributors, limited order and customer information may be shared with those individuals to facilitate fulfillment. This sharing is managed by the vendor, not by Bizthom.

4.5 For Legal and Safety Reasons

We may disclose your information if we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or government request
• Enforce our Terms of Service or Acceptable Use Policy
• Detect, prevent, or investigate fraud, security issues, or technical problems
• Protect the rights, property, or safety of Bizthom, our users, or the public
• Respond to a chargeback or payment dispute

4.6 Business Transfers

If Bizthom is involved in a merger, acquisition, reorganisation, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

4.7 Google User Data

We do not share Google user data with third parties, advertisers, or AI/ML training systems. Where data must be transmitted to Google APIs to operate the feature you connected (e.g., writing a contact to your Google Contacts via the People API), it is sent directly to Google under your authorisation. See Section 2.6 for the full disclosure.

4.8 Meta / Facebook Data

We do not sell or share data obtained from Meta — whether Facebook Login profile data or Meta Ads reporting data — with third parties, and we do not use it to train AI/ML systems. See Sections 2.8 and 2.9 for the full disclosure.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Services. Specifically:

• Account data: Retained for the duration of your account, plus 2 years after account closure for legal and dispute resolution purposes
• Transaction records: Retained for 7 years as required by Nigerian tax and financial regulations
• Identity verification data: BVN verification records are retained for the duration of your account and as required by regulatory obligations
• Usage and log data: Retained for up to 2 years
• Marketing preferences: Retained until you withdraw consent
• Google OAuth tokens: Stored encrypted; deleted immediately when you disconnect Google or close your account. See Section 2.6 for details on the Google Contacts integration.
• Zoho OAuth tokens: Stored encrypted and deleted when you disconnect Zoho Books or close your account. Non-secret mappings and sync audit records are retained with your business records.
• Meta OAuth token: Stored encrypted; deleted immediately when you disconnect Meta Ads, on a Meta data-deletion or deauthorization request, or when you close your account.
• Meta Ads reporting data: The ad-account link, campaigns, and daily performance figures are deleted when you disconnect Meta Ads or on a Meta data-deletion request.

After the retention period, your data will be securely deleted or anonymised. Anonymised data (which cannot be used to identify you) may be retained and used indefinitely to improve the Services.

6. Data Security

We implement reasonable technical and organisational measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of sensitive data in transit and at rest
• Secure authentication and access controls
• Regular security assessments
• Limiting access to personal information to employees and service providers who need it

However, no method of electronic storage or transmission is 100% secure. We cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you logged in to your account
• Remember your preferences and settings
• Analyse how you use the Services
• Improve platform performance

Types of Cookies We Use

• Essential cookies: Required for the Services to function (login, security, session management)
• Analytics cookies: Help us understand how users interact with the Services (page views, feature usage)
• Marketing cookies: Used to deliver relevant advertisements (only with your consent)

Third-Party Analytics

Vendor stores may include third-party analytics tools (such as Meta Pixel, Google Analytics) configured by the vendor. The data collected by these tools is governed by the respective third party's privacy policy. Bizthom is not responsible for the data collection practices of third-party analytics tools installed by vendors.

Your Cookie Choices

You can manage your cookie preferences through your browser settings. Disabling essential cookies may affect the functionality of the Services.

8. Your Rights

Under the Nigeria Data Protection Regulation (NDPR) and the Nigeria Data Protection Act (NDPA), you have the following rights:

8.1 Right of Access

You have the right to request a copy of the personal information we hold about you.

8.2 Right to Rectification

You have the right to request that we correct any inaccurate or incomplete personal information.

8.3 Right to Deletion

You have the right to request that we delete your personal information, subject to our legal and regulatory obligations. Some information may be retained as required by law (e.g., transaction records for tax purposes).

8.4 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal information in certain circumstances.

8.5 Right to Data Portability

You have the right to request that we provide your personal information in a structured, commonly used, and machine-readable format.

8.6 Right to Object

You have the right to object to the processing of your personal information for direct marketing purposes. You can opt out of marketing communications at any time by using the unsubscribe link in our emails or contacting us.

8.7 Right to Withdraw Consent

Where we process your information based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, please contact us at support@bizthom.com . We will respond to your request within 30 days.

9. Children's Privacy

The Services are not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected information from a child under 18, we will take steps to delete that information.

10. International Data Transfers

Your information is primarily stored and processed in Nigeria. If we transfer your information to servers or service providers located outside Nigeria, we will ensure that appropriate safeguards are in place to protect your information in accordance with applicable data protection laws.

11. Third-Party Links and Services

The Services may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you interact with.

Vendors may install third-party tools (payment gateways, social media integrations, shipping providers, analytics tools) on their stores. Bizthom does not control how these third-party services use your personal information.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through a notice on the platform. The updated policy will be effective upon posting, unless otherwise stated.

We advise that you check this page regularly, referring to the "Last updated" date above.

13. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or how we handle your personal information, please contact us:

• Email:support@bizthom.com
• Website:https://bizthom.com

Bizthom Services Ltd
Federal Republic of Nigeria

If you are not satisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC).