# DealShield — Privacy Policy

**Last Updated: August 25, 2026**

## 1. What We Collect

### Personal Information:
- Full name
- Phone number
- Email address
- National Identity Number (NIN)
- Bank Verification Number (BVN) — if you request verification
- Business registration details — if you request business verification

### Transaction Information:
- Listing details (item, price, description, location)
- Escrow transaction records
- Wallet balance and transaction history
- Payment gateway references (Paystack/Flutterwave)
- Chat messages with our AI assistant (for service improvement)

### Device Information:
- IP address
- Device type (for security and fraud prevention)

## 2. How We Use Your Data

- **To provide escrow services**: hold funds, process transactions, release payments
- **To verify identity**: NIN, BVN, and business verification for trust badges
- **To prevent fraud**: AI analysis of listings and transaction patterns
- **To resolve disputes**: review evidence and make fair decisions
- **To communicate**: transaction updates, deal status, support messages
- **To improve our service**: aggregate analytics (no individual identification)

We do NOT:
- Sell your data to third parties
- Use your data for advertising
- Share your transaction details with other users (except as needed for a deal)

## 3. Data Storage

- Your data is stored in a secure PostgreSQL database on our servers
- Payment data is handled by Paystack/Flutterwave (PCI-DSS compliant) — we do not store card numbers
- Passwords are hashed using bcrypt — we cannot see your password
- JWT tokens expire after 24 hours

## 4. Data Sharing

We share data only when:
- **Required by law**: court order, law enforcement request, or regulatory compliance
- **For a transaction**: buyer/seller see each other's names and verified badges for a specific deal
- **With payment processors**: Paystack/Flutterwave receive transaction amounts
- **With logistics partners**: rider dispatch service receives delivery address (for shipped deals)

## 5. Your Rights

You have the right to:
- **Access**: request a copy of your data
- **Correct**: fix inaccurate information
- **Delete**: request account deletion (escrow funds must be settled first)
- **Export**: download your transaction history
- **Object**: opt out of AI analysis (reduced fraud protection)

To exercise these rights, email support@dealshield.ng

## 6. Data Retention

- Active account data: kept as long as your account is active
- Closed account data: retained for 5 years for fraud prevention and legal compliance
- Transaction records: kept for 7 years (financial regulations)
- Chat logs: kept for 1 year for dispute resolution

## 7. Security Measures

- **Encryption**: All API traffic uses HTTPS/TLS
- **Authentication**: JWT tokens with 24-hour expiry
- **Rate limiting**: Prevents brute force attacks
- **Security headers**: HSTS, X-Frame-Options, X-Content-Type-Options
- **Database security**: PostgreSQL with restricted access, encrypted connections
- **Regular updates**: security patches applied promptly

## 8. NDPA Compliance

DealShield complies with the Nigeria Data Protection Act (NDPA) 2023. We are registered as a data controller and follow the principles of:
- Lawfulness, fairness, and transparency
- Purpose limitation
- Data minimization
- Accuracy
- Storage limitation
- Integrity and confidentiality

## 9. Cookies

DealShield uses localStorage (not cookies) for:
- Authentication token (JWT)
- User session (no tracking)

We do not use third-party analytics or tracking cookies.

## 10. Children's Privacy

DealShield is not available to anyone under 18. We do not knowingly collect data from minors.

## 11. Changes to This Policy

We will notify users via WhatsApp/SMS/email of any material changes to this Privacy Policy.

## 12. Contact

- Email: privacy@dealshield.ng
- Website: https://dealshield-website.vercel.app

---

© 2026 DealShield. Built for Nigeria. Trusted worldwide.