Zyria.ng Legal

Privacy Policy

Effective date: 27 September 2026 · Version 2026-09-27

This Privacy Policy explains how Zyria Essential Mart (“Zyria”, “we”) collects, uses, stores, and shares personal data when you use Zyria.ng. It applies to customer accounts, seller accounts, store applications and visits to the marketplace.

1. Data we collect

  • Account data: name, email, phone, password hash, role, and legal consent timestamps.
  • Profile data you choose to add, such as an avatar URL.
  • Order and sourcing data: delivery address, product selections, budgets, and messages you submit.
  • Merchant data: store profile and settlement account details you provide for payouts.
  • Technical data: IP address, browser user-agent, session identifiers, and security audit events.
  • Payment metadata from processors (for example Paystack references). We do not store full card numbers.
  • Wallet data: your Zyria wallet balance and the history of top-ups, purchases, refunds, rewards and adjustments to it.
  • Google sign-in data, if you use it: your name, verified email address and profile picture, as shared by Google. We do not receive your Google password.
  • Referral data: your referral code, which account referred you (if any), and the rewards you have earned.
  • Wishlist data: the products you save to your wishlist.
  • For merchants, featured placement data: the weeks your store booked, amounts paid and any refunds.

2. How we use data

We use personal data to create and secure accounts, process orders and sourcing requests, verify merchants, prevent fraud and session abuse, communicate about your transactions, improve the Platform, and meet legal obligations. We do not sell your personal data.

3. Legal bases

Depending on the activity, we rely on contract performance, consent where separately requested, legitimate interests in securing the marketplace, and legal obligation. The required Privacy Policy checkbox records that you have read this notice; it is not consent to marketing or all processing.

4. Sharing

We share data with payment processors, delivery partners, and merchants only as needed to fulfil an order or quote. If you were referred, the person who referred you can see how many of their referrals have earned a reward, but not your name, contact details or orders. We may disclose information to competent authorities when required by law. Public sourcing feeds display request titles, descriptions and budgets; do not include contact information or sensitive information in those fields. Contact fields are restricted to authorised account access.

5. Cookies and sessions

We use a strictly necessary, HTTP-only session cookie to keep you signed in. We check browser user-agent information for changes, expire sessions after 30 minutes of inactivity or 12 hours, and let you revoke them from your profile. We check request origins to protect account changes. Browser information alone cannot prevent every stolen-cookie attack. If you sign in with Google, a short-lived cookie (about 10 minutes) protects that sign-in from tampering. If you open a Zyria referral link, the referral code is saved in your browser’s local storage so it can be applied if you create an account; you can clear it by clearing your browser’s site data.

If you arrive through a link from one of our campaigns, adverts or partners, the campaign’s name and source (for example “Instagram, launch”), the page you landed on and the website that sent you are saved in your browser’s local storage for up to 30 days. If you create an account in that time, we record them with your account so we can tell which campaigns bring people to Zyria. We do not record the advertising platforms’ click identifiers.

Advertising cookies: with your permission only, we use the Meta (Facebook and Instagram) Pixel, the TikTok Pixel and Google tags to measure how our adverts perform and to show relevant adverts. When you accept, these providers receive details such as the pages you view, products you add to your cart, purchases (order reference, items and amount), and that you created an account, together with identifiers those providers set in your browser. They process this under their own privacy policies. Nothing loads until you choose “Accept all” or switch on Advertising under “Manage preferences”, and you can change your choice at any time with “Cookie settings” at the bottom of every page.

With the same permission, our servers also send these events directly to TikTok through its Events API, so that adverts are measured accurately even when a browser blocks the pixel. This includes products you view, add to your cart or wishlist, your searches, purchases, account sign-ups and sourcing requests. To let TikTok match them to its users, we include your email address and phone number in hashed (scrambled, one-way) form, a hashed account ID, your IP address and browser type, and TikTok’s own cookie or ad-click identifier. For a purchase, these details are kept with your order only until the sale is reported, and are deleted if the order is never paid. If you decline advertising cookies, nothing is sent.

6. Retention and security

We retain account and transaction records for as long as needed to operate the Platform, resolve disputes, and meet tax or regulatory requirements, then delete or anonymise them. We use hashing, access control, rate limits, and audit logs. No online service is perfectly secure; please use a unique password.

You can delete your account at any time from Account → Profile → Delete my account. Your account is deactivated straight away and permanently deleted after 14 days; signing in before then cancels the request. On deletion we remove your name, email address, phone number, delivery addresses, password, profile photo, wishlist, sourcing request details and support chats. Order, payment, refund, wallet and payout records are kept in anonymised form, with your identifying details removed, where tax, accounting or dispute-resolution obligations require it. Product reviews stay published under “Former customer”. Before an account can be deleted, any wallet balance must be used, orders must be delivered, open refund requests resolved and, for sellers, all earnings paid out.

Zyria Wallet

You may credit a Zyria wallet through Paystack and use the balance to pay for orders. Wallet funds are held on our books for your use on the Platform; the wallet is not a bank account, does not earn interest, and cannot be withdrawn to a bank account or transferred to another user. Approved refunds are credited to the wallet linked to your account rather than to your original payment instrument, because we do not retain card or bank account details to reverse a charge directly. We keep a full record of wallet top-ups, purchases and refunds for accounting, fraud prevention, and dispute resolution, for as long as your account or applicable legal retention periods require.

7. Your rights

Subject to the NDPA, you may request access, correction, deletion, restriction, or portability of your personal data, and you may object to certain processing or withdraw consent where processing is consent-based. You can delete your account yourself from your profile (see section 6), or contact hello@zyria.ng. You may also lodge a complaint with the Nigeria Data Protection Commission.

International providers and contact

Our hosting, payment and other service providers may process data outside Nigeria. Where applicable, transfers must use safeguards required by the Nigeria Data Protection Act. For privacy enquiries or requests, contact hello@zyria.ng. We may verify your identity before releasing account information.

Support assistant

Zyria Support starts with approved on-site help content. If Zyria enables its optional AI support provider, questions you submit may be sent to that provider to generate an answer. Do not enter passwords, bank details, payment card details, one-time codes, delivery addresses, or identity documents in chat. We do not use chat to approve refunds or change orders.

8. Children

Zyria is not directed at children under 18. We do not knowingly create accounts for minors.

9. Changes

We will post updates on this page with a new version date and request fresh consent where legally required.

See also our Terms of Use.