Privacy Notice
Draft — pending legal review. Version 2026-10-20b. Last updated 20 October 2026.
Data controller
The data controller is the NaijaShowcase platform. Contact: [email protected].
What we collect
- Listing and ad details you enter (headline, price, general area, rooms, description).
- Photos you upload.
- Contact details (phone or email) you choose to give. These are shown publicly only if you switch on "Show contact publicly". Otherwise only the reviewer sees them.
- Your confirmations (authorization, photo rights, terms) and when you gave them.
- Reports you send, and any optional contact you add.
- A one-way hashed form of your IP address, used only for rate-limiting and spam prevention. We do not store the raw IP address.
- Referral codes in links, counted for tracking only. Referral codes are counted in aggregate; they are not linked to your identity.
- Inquiries: your name, contact and message, sent to the lister (consent; legitimate interests in preventing spam). Kept up to 12 months.
- Photo location data (GPS/EXIF) and original filenames are removed automatically when you upload.
We use no advertising trackers and no third-party analytics. If you choose the optional writing helper, the listing details you entered (not your contact details) are sent to Cloudflare Workers AI to draft a description. Cloudflare processes this on our behalf and does not use it to train models. We do not use paid AI services.
Your private edit link lets anyone who has it edit or withdraw your listing. Keep it private; ask us to reset it if it leaks. Edit links expire after 90 days. Email notifications are not active yet.
Why we use it (lawful basis)
We use your data to provide the listing you asked for (contract), to keep the service safe and prevent fraud, spam and discrimination (legitimate interests), and to show your contact publicly only where you consent. You can withdraw that consent at any time.
Who can see it
Public listings are visible to anyone with the page. Unlisted listings are visible only to people who have the link. Property-manager links are read-only. Photo downloads go only through authenticated routes, and photos are not stored in a public bucket. We do not sell your data. Our hosting provider (Cloudflare, including Cloudflare Workers AI for the optional writing helper) processes the data on our behalf.
How we share information
- Payments: if your booking is approved, we send you the platform operator’s payment details privately by WhatsApp. We record that payment details were shared and whether payment was confirmed (date, booking reference, amount confirmed). We do not collect or store your bank card details or bank login. Payment confirmation records are kept as long as needed for accounting, tax and dispute purposes.
Retention
Active listings and photos are kept while the listing is live. When a listing expires or you remove it, its published photos are deleted, and the form details are kept privately for up to 30 days as described below, then deleted. Submissions that are rejected or never approved are deleted within 90 days. Reports, inquiries and the hashed rate-limit records are kept for up to 12 months, then deleted. Withdrawn listings are hidden and kept until you ask us to delete them or for up to 30 days after you remove them.
After your listing expires. Free listings run for 30 days. When a listing expires, it is removed from search and public pages, and its published photos are deleted. We keep the details you entered in the listing form (such as the headline, description, general area, property details and your private contact) privately for 30 more days. During that time this information is not public. Only you, through your private link, and our review team can see it. We keep it only so you can restore or repost your listing without filling in the form again. At the end of the 30 days we delete it automatically. You can ask us to delete it sooner at any time: contact [email protected] or use the report form and choose "I am the lister — please remove". We will delete it within 30 days of your request, or sooner where we can. We rely on our legitimate interest in providing the service you asked for (NDPA 2023, s.25), and we keep the data no longer than needed for this purpose (s.24).
Lister accounts
Lister accounts. If we create a lister account for you, we keep your username, your display name, a scrambled (hashed) version of your password, your email address if you add one (used only for password reset links, after you confirm it), and a log of sign-ins and changes to your listings for security. We never see or store your password itself. Your account is kept while you list with us; if you close it or it is unused for 12 months, we delete it within 30 days, and your listings follow the 30-day rule above. Ask us to delete it at any time.
The email address on a lister account is optional. It is used only for account recovery and is never shown publicly. You can ask us to delete it at any time, using the report form.
Your rights
Under the Nigeria Data Protection Act 2023 (NDPA), and applicable US state privacy laws where they apply, you can ask to access, correct, delete or export your data, object to its use, or withdraw consent. Contact [email protected] or use the report form (choose "I am the lister — please remove"). We respond within 30 days. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
International transfer
Data may be processed outside Nigeria by our hosting provider, with appropriate safeguards.
Children
The service is not intended for anyone under 18.