Privacy notice
Last updated 11/10/2026 (draft)
This notice explains what personal data Business Hub keeps, why, where it is kept, for how long, and what you can ask us to do with it. It is written to meet the Nigeria Data Protection Act 2023 (NDPA).
Who we are
Business Hub is run by Mmiri28, Anambra. For anything about your data, email mmiri28mmiri@gmail.com. We aim to reply within 7 days.
Two kinds of data, two kinds of responsibility
- Your account (shop owners and their staff): we decide how this is used, so we are the data controller for it.
- What a shop records about its own customers (names, phone numbers, purchases, money owed): the shop decides what to record, so the shop is the data controller and we are its data processor. We only use it to run Business Hub for that shop. If you are a shop's customer, contact the shop first; we will help the shop answer you.
What we keep
- Shop owner: name, email, phone number, shop name.
- Staff: name, email, role. Passwords are stored only as a one-way hash; we cannot read them.
- Business records: products, prices, stock, sales, payments, returns, expenses and an activity log of who did what.
- A shop's customers: name and phone number, and their purchases and balances.
- Security records: the email and network (IP) address of failed sign-in attempts, kept for up to 24 hours to stop password guessing.
We do not use cookies for advertising or tracking. The only cookie keeps you signed in.
Why we use it (lawful basis)
- To provide the service you signed up for: contract.
- To keep accounts and shops secure (sign-in limits, error logs): legitimate interest.
- To meet a legal duty, for example a lawful request from a Nigerian authority: legal obligation.
We do not sell data, and we do not use it for advertising.
Who else handles it
These companies process data for us, under contract, only to run Business Hub:
- Neon (database), servers in the United States.
- Netlify (website hosting), servers in the United States and other countries.
- Resend (sends invite and password reset emails), servers in the United States.
Because these servers are outside Nigeria, your data is transferred abroad. We rely on [the legal basis for transfers outside Nigeria, to be confirmed in legal review].
How long we keep it
- While the shop account is open.
- When an owner deletes the shop, it is locked at once and erased for good after 30 days. During those 30 days the owner can download the data or cancel.
- Backup copies are kept for up to 8 weeks and then deleted, so erased data leaves the backups within that time.
- Failed sign-in records: up to 24 hours.
Your rights
Under the NDPA you can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong;
- erase your data, or stop or limit how we use it;
- give you your data in a form you can take elsewhere. Shop owners can do this any time with Shop Data, Export My Data;
- withdraw any consent you gave.
Email mmiri28mmiri@gmail.com. If you are not happy with our answer you can complain to the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
How we protect it
- All connections are encrypted (HTTPS, and encrypted connections to the database).
- Each shop's records are kept apart by the database itself, so one shop cannot see another's.
- Staff see cost prices and profit only if the owner allows it.
If a breach puts your data at risk we will tell the NDPC within 72 hours of finding out, and tell you without delay if the risk to you is high.
Children
Business Hub is for businesses. Accounts are not for anyone under 18.
Changes
If this notice changes in a way that matters, we will tell shop owners by email or in the app before it takes effect.