Privacy Policy

Section 01

Introduction

SafeGate, operated by JKB Global, is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our escrow platform.

We comply with the Nigeria Data Protection Regulation (NDPR) and are committed to treating your personal data with the highest level of care. By using SafeGate, you consent to the practices described in this policy.

Plain English commitment: We only collect data that we genuinely need to operate the platform. We do not sell your data. We do not use it for advertising. We do not share it with anyone except the partners required to process your transaction.

Section 02

What We Collect

We collect different types of information depending on how you use the platform:

Identity Data

Full name, email address, phone number, and role (buyer or seller).

Financial Data

Bank name, account number, account name (sellers only). We never store card details.

Transaction Data

Product details, amounts, payment references, shipping info, and transaction history.

Uploaded Files

Dispatch proofs, dispute evidence, and verification documents you submit.

Technical Data

IP address, browser type, device info, and pages visited on the platform.

Communications

Support tickets, dispute messages, and any correspondence with our team.

We do NOT collect: Card numbers, CVV codes, or any raw payment credentials. All payment data flows directly through Paystack and is never stored on SafeGate servers.

Section 03

Why We Collect This Data

Data Type	Why We Need It	Legal Basis
Name, Email, Phone	Account creation, identity verification, notifications	Contract performance
Bank details (sellers)	Fund disbursement after transaction completion	Contract performance
Transaction data	Escrow processing, dispute resolution, audit trail	Contract performance
IP address, device info	Fraud detection, security monitoring	Legitimate interest
Uploaded files	Shipping verification, dispute evidence review	Contract performance
Support communications	Customer service, complaint resolution	Legitimate interest

Section 04

How We Use Your Data

Your data is used exclusively for operating the SafeGate platform. Specifically:

Processing and managing escrow transactions from creation to fund release.
Sending transaction notifications — payment confirmations, shipping updates, dispute alerts.
Verifying seller bank accounts before disbursing funds.
Resolving disputes by reviewing evidence submitted by both parties.
Detecting and preventing fraudulent activity on the platform.
Responding to support tickets and resolving user complaints.
Maintaining audit logs for legal and compliance purposes.
Improving platform performance and user experience.

We will never: Sell your data to third parties, use it for advertising or marketing profiling, share it with other users beyond what is necessary for a transaction, or transfer it to countries with inadequate data protection laws.

Section 05

Who We Share Your Data With

We only share personal data with trusted service providers who are essential to platform operation. All third parties are bound by data processing agreements.

Partner	What They Receive	Purpose
Paystack	Email, transaction amount, payment reference	Payment processing
Supabase	All platform data (encrypted at rest)	Database & file storage hosting
SendGrid / Email provider	Email address, notification content	Transactional emails
Dojah (future)	NIN, name (seller verification only)	Identity verification

We may also disclose personal data to Nigerian law enforcement or regulatory authorities if required by law, court order, or to prevent fraud and illegal activity.

Section 06

How We Protect Your Data

We take data security seriously. SafeGate implements multiple layers of protection to keep your information safe:

Encryption at rest: All database data is encrypted by Supabase using AES-256 encryption.
Encryption in transit: All platform traffic uses HTTPS with TLS 1.2 or higher. No HTTP connections are allowed.
Password hashing: All passwords are hashed using bcrypt with a minimum of 10 salt rounds. Plain text passwords are never stored or logged.
Access control: Role-based access ensures buyers cannot see seller data and vice versa. Admin access is restricted to JKB Global staff only.
Row-Level Security: Supabase RLS policies ensure users can only access data belonging to their own account.
Webhook verification: All Paystack webhook calls are verified using HMAC-SHA512 signature validation before any action is taken.
Rate limiting: Login and payment endpoints are rate-limited to prevent brute-force attacks.

Data breach protocol: In the unlikely event of a data breach affecting your personal information, we will notify affected users within 72 hours of becoming aware of the breach, as required by NDPR.

Section 07

Data Retention

We retain your data for as long as necessary to provide our services and comply with legal obligations:

Data Type	Retention Period	Reason
Account information	Duration of account + 2 years	Customer service, re-registration
Transaction records	7 years	Financial audit trail, legal compliance
Payment data	7 years	FIRS tax compliance requirements
Dispute evidence	3 years after resolution	Potential appeals, legal disputes
Technical logs	90 days	Security monitoring, debugging
Support tickets	2 years after closure	Quality assurance, reference

When data is no longer required, it is securely deleted or anonymised so it can no longer be linked to you personally.

Section 08

Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the following rights over your personal data. To exercise any of these rights, contact us via the support ticket system.

Right to Access

Request a copy of all personal data we hold about you.

Right to Rectification

Correct any inaccurate or incomplete personal data.

Right to Erasure

Request deletion of your data (subject to legal retention obligations).

Right to Object

Object to processing of your data for specific purposes.

Data Portability

Receive your data in a structured, machine-readable format.

Right to Restriction

Request we limit processing of your data in certain circumstances.

We will respond to all data rights requests within 30 days. Some requests may not be fulfilled if they conflict with our legal obligations (for example, we cannot delete transaction records we are legally required to retain).

Section 09

Cookies & Local Storage

SafeGate uses minimal browser storage to make the platform work correctly. We do not use advertising cookies or tracking pixels of any kind.

Storage Item	Purpose	Duration
Auth session token	Keep you logged in between page visits	Until logout
Theme preference	Remember your dark/light mode choice	Permanent (until cleared)
Supabase auth cookie	Secure session management	Session-based

We do not use Google Analytics, Facebook Pixel, or any third-party tracking scripts. The only external scripts loaded are from Paystack (for payment processing) and Tawk.to (for live support chat), both of which have their own privacy policies.

Section 10

Policy Updates

We may update this Privacy Policy from time to time to reflect changes in how we operate or new legal requirements. When we make material changes, we will:

Post the updated policy on this page with a revised effective date.
Send an email notification to all registered users explaining what changed and why.
Where required by law, request fresh consent before processing your data under new terms.

We encourage you to review this policy periodically. Your continued use of SafeGate after notification of changes constitutes acceptance of the updated policy.

Section 11

Contact & Data Requests

For privacy-related questions, data access requests, or complaints about how we handle your personal data, contact our Data Protection team through any of the channels below. We commit to responding within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB).