Privacy Policy

1. Who we are

Seloira is operated by Seloira Solutions, a business name registered with the Corporate Affairs Commission of Nigeria under number RC 9919995, based in Abuja, Nigeria (“Seloira”, “we”, “us”).

This policy covers seloira.com, the Seloira app at app.seloira.com, storefronts at store.seloira.com, the emails we send and any related service (together, the “Services”). It explains what personal data we collect, why, who we share it with, how long we keep it and the rights you have.

We follow the Nigeria Data Protection Act 2023 (NDPA) and its regulations, and, where it applies to you, the EU and UK General Data Protection Regulation (GDPR). For any privacy question or request, email compliance@seloira.com. We handle these requests ourselves; there is no separate data protection officer.

2. Our two roles: controller and processor

Seloira is used by businesses that serve people (“Businesses”) to take bookings, payments and orders from their own customers (“Clients”). That gives us two different roles.

• Controller. We decide how and why personal data is used for our own purposes: running this website, managing accounts for the people who use the Seloira app (“Account Users”), billing, security and support.
• Processor. When a Business records or collects information about its Clients through Seloira (“Client Data”), the Business is the controller and we process that data only on its instructions, under the data processing terms in our Terms of Service.

If you are a Client of a Business and want to know how your information is used, or want to exercise your rights over it, please contact that Business first. If you contact us, we will pass your request to the Business and help it respond.

We remain a controller for a small amount of Client Data that we need for our own legitimate purposes: keeping the Services secure, preventing fraud and abuse, keeping a list of email addresses that have bounced or complained so we stop sending to them, and meeting our own legal obligations.

3. What we collect

Website visitors

• Preferences: your language and your cookie choice, kept in cookies described in our Cookie Policy.
• Analytics, only if you accept: the pages you view, how you arrived (referrer and campaign tags), device and browser type, approximate location derived from your IP address, a few named actions such as checking a link or clicking sign up, and session recordings of how you move through the site. Session recordings mask everything you type.
• Link checks: when you check whether a Seloira link is free, we receive the link you typed and your IP address. We use the IP address only to limit how many checks one person can make, and we do not store the link against you.
• Messages to us: anything you send when you email us or contact us on social media.

Account Users

• Identity and contact:name, email address, phone number and profile photo. If you choose “Sign in with Google”, we receive your name, email address and profile photo from Google.
• Sign-in: your password is held by our authentication provider in hashed form; we never see it. We also use one-time codes and bot-protection signals when you sign up, sign in or reset your password.
• Role and activity: the Businesses you belong to, your role (owner, manager or staff), invitations, settings such as language and theme, and a record of actions you take, such as creating, cancelling or refunding a booking.

Business information

• Business name, logo, type, country, currency, time zone, contact details, locations, working hours, storefront content and images, services, products, prices and policies.
• Payout account: bank name, account number and account name, which we share with Paystack to verify the account and create the subaccount your payments settle into.

Client Data (processed for Businesses)

• Name, phone number, email address, pronouns, date of birth, address, delivery address, other names a Client is known by, and notes a Business writes.
• Bookings, orders, payments, refunds and the time a Client accepted the Business’s booking policy.
• Sensitive data: allergy records, including the reaction and its severity, and documents a Business uploads, such as consultation forms, identity documents and before-and-after photos. These can include health data and other sensitive personal data.

Payments

Card and bank payments are processed by Paystack. We never receive or store full card numbers. We receive limited information such as the transaction reference, amount, status, payment channel and refund status.

Emails we send

We keep a log of the emails we send, including the recipient, the type of message and whether it was delivered, bounced or marked as spam.

Technical and security data

Our servers process IP addresses, request details and error logs to run, secure and debug the Services, and to rate-limit abuse. When something goes wrong in the Seloira app or API, an error report goes to Sentry: what failed and where, the page or request involved, your browser and device type, and the ID of the signed-in account. Error reports never include what you typed or uploaded, your email address, cookies or your IP address.

4. How we use it, and our lawful bases

Where we rely on legitimate interests, we have weighed them against your rights and freedoms. You can object at any time, as described below.

We process Client Data, including sensitive data, only to provide the Services to the Business that controls it. Each Business is responsible for having a lawful basis for that data and, for sensitive data, the explicit consent of the Client or another condition the law allows.

We do not sell personal data, and we do not use it for third-party advertising.

5. Who we share it with

We share personal data only with the service providers below, who process it on our behalf under written agreements that require them to keep it secure and confidential.

Paystack and Google also act as independent controllers for some of the data they handle, under their own privacy policies. We will update this list before we add a new provider that processes Client Data.

We may also share personal data:

• with the Business a Client books or buys from, which is the purpose of Client Data;
• with professional advisers, auditors and insurers, under a duty of confidentiality;
• when required by law, court order or a lawful request from a regulator or the police, or to protect the rights, safety and property of Seloira, our users or others;
• with a buyer or successor if all or part of our business is sold, merged or reorganised, who must honour this policy; and
• with anyone else when you ask us to or give your consent.

6. International transfers

The Seloira app stores its data in the European Union. Some providers, such as our email and website hosting providers, may process data in the United States or other countries.

When personal data leaves Nigeria, or the European Economic Area or United Kingdom, we rely on the safeguards the law allows. These include transfers to countries whose protection is considered adequate, standard contractual clauses or equivalent contractual commitments, and, where appropriate, certifications such as the EU-US Data Privacy Framework. You can ask us for details of the safeguards for a particular transfer.

7. How long we keep it

• Account and Business information: while your account is open, then deleted or anonymised within 90 days of closure, except what we must keep for the reasons below.
• Client Data:for as long as the Business’s account is open and the Business keeps it, then deleted within 90 days of closure, unless the Business asks us to return it first.
• Payment and transaction records: at least six years, or longer where tax, accounting or anti-money-laundering law requires.
• Website analytics: up to 12 months; session recordings up to 30 days.
• Security logs: up to 90 days.
• Error reports: up to 90 days.
• Bounced and complaining email addresses:for as long as needed to make sure we don’t send to them again.
• Backups: deleted data can remain in encrypted backups for up to 35 days before it is overwritten.

We may keep information longer where it is needed to establish, exercise or defend legal claims, or where the law requires it.

8. How we protect it

We use encryption in transit, encryption at rest provided by our hosting providers, role-based access inside each Business, private file storage served through short-lived links, and access controls that limit who at Seloira can see personal data.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, as the NDPA requires, and tell affected people without undue delay where the law requires us to. If a breach affects Client Data, we will tell the Business without undue delay so it can meet its own obligations.

9. Your rights

Depending on where you live, you have the right to:

• be told how your personal data is used, which this policy does;
• get a copy of your personal data;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to how we use it, including for direct marketing;
• receive your data in a portable format;
• withdraw consent at any time, without affecting earlier processing; and
• not be subject to decisions based solely on automated processing.

To use any of these rights, email compliance@seloira.com with the subject “Data request”. We will check your identity before acting and reply within 30 days. If a request is complex, we may extend that period where the law allows and will tell you why. Exports and deletions are handled by our team on request; they are not yet available as buttons in the app.

If your request is about Client Data, we will pass it to the Business that controls the data and help it respond.

10. Children

Seloira accounts are only for people aged 18 or over who use Seloira for a business. We do not knowingly create accounts for anyone younger.

A Business may record information about Clients under 18. When it does, the Business is responsible for getting the consent of a parent or guardian, or another lawful basis, before doing so.

11. Automated decisions

We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

12. Complaints

If you are unhappy with how we handle your personal data, please tell us first at compliance@seloira.com. You also have the right to complain to the Nigeria Data Protection Commission (ndpc.gov.ng) or, if you are in the European Economic Area or the United Kingdom, to your local supervisory authority.

13. Changes to this policy

We will update this policy when our practices change. The date at the top shows the latest version. If a change is significant, we will tell Account Users by email or in the app before it takes effect.

14. Contact

Seloira Solutions, a business name registered with the Corporate Affairs Commission of Nigeria under number RC 9919995, based in Abuja, Nigeria. Email: compliance@seloira.com.