Privacy Policy

1. Privacy Commitment & Scope

Zilla Technologies Limited ("Zilla", "We", "Us", "Our") operates the storefront platform available at `zilla.ng`. This Privacy Policy explains how we collect, store, protect, and process personal data when you interact with our website, merchant dashboard, and storefront links.

We strictly adhere to the Nigeria Data Protection Act (NDPA), the Nigeria Data Protection Regulation (NDPR), and applicable global data protection standards.

2. Information We Collect

We collect information in three primary categories:

• Merchant Account Data: Full name, WhatsApp phone number, email address (optional), hashed account password, store handle slug, store theme preferences, and Nigerian bank account NUBAN details for direct settlements.
• Customer Order Intake Data: When a buyer places an order on a merchant's storefront link, we capture their customer name, delivery address, city, state, WhatsApp contact number, item selections, and optional delivery notes.
• Technical & Analytics Data: IP address, device model (e.g. iPhone, Android), operating system, browser type, referral URLs, and multi-touch campaign identifiers (`utm_source`, `utm_campaign`, `fbclid`, `gclid`, `ttclid`).

3. How We Use Your Information

We use collected data solely for legitimate operational purposes:

• To initialize and host your live mobile storefront at `zilla.ng/:handle`.
• To atomically update stock inventory levels and alert you when items reach low-stock thresholds.
• To construct structured WhatsApp order summary messages and transfer the order data directly to your merchant chat.
• To calculate recurring affiliate commissions (₦100/mo) and process requested bank payouts (₦1,000 threshold).
• To detect and prevent fraudulent account creation, spam bots, and counterfeit storefronts.

4. Cookies & Attribution Tracking

Zilla uses secure, first-party cookies to provide essential platform functionality and fair attribution tracking:

• Session Cookies (`zilla_token`): An encrypted HTTP-only cookie storing your authenticated merchant session.
• First-Touch Attribution (`zilla_first_touch`): A 30-day first-party cookie recording how a visitor discovered Zilla (e.g. Instagram ad, TikTok campaign, Google search) to measure marketing effectiveness.
• Affiliate Referral Cookie (`zilla_ref`): A 30-day cookie recording the affiliate code when someone clicks a merchant or influencer referral link (`zilla.ng/ref/:code` or `zilla.ng/go/:slug`).

5. Data Sharing & Zero-Sale Guarantee

We only share data with trusted infrastructure providers necessary to run the platform:

• Cloud CDN Infrastructure: ImageKit.io for high-speed image compression, WebP resizing, and secure product media delivery.
• Payment Processors: Paystack and Monnify for processing SaaS subscription fees (₦1,000/mo) and automated affiliate bank disbursements.
• Law Enforcement: Only when strictly required by a court order or legal warrant under Nigerian law.

6. Buyer & Customer Order Privacy

Customer order information is treated as confidential business data owned exclusively by the merchant. When a customer enters their delivery address and phone number, it is transmitted only to the merchant who owns the storefront. Zilla does not market to or contact your buyers.

7. Data Security & CDN Hosting

We employ industry-standard technical and organizational security controls:

• Encryption in Transit: 256-bit TLS/SSL encryption for all data exchanged between your browser and our servers.
• Password Hashing: Passwords salted and hashed with bcrypt; raw passwords are never saved or visible to Zilla staff.
• Multi-Tenant Isolation: Database queries strictly segregated by `storeId` to prevent unauthorized cross-tenant data access.
• Helmet Security Headers: Comprehensive HTTP security headers protecting against XSS, clickjacking, and MIME sniffing.

8. Data Retention & Account Deletion

We retain merchant account data for as long as your account remains active. If your account is cancelled or inactive for more than 90 days, you may request permanent deletion of your store data, product imagery, and customer history.

9. Your NDPR & Privacy Rights

Under the Nigeria Data Protection Regulation, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Correct any inaccurate or incomplete personal information in your settings.
• Erasure: Request the deletion of your personal data from our active databases.
• Restriction: Restrict or object to the processing of your personal data.
• Portability: Export your product catalog and order records in digital format.

10. Contact Our Data Protection Officer

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data rights, please contact our Data Protection Officer: