Privacy Policy

1. Overview

EazyStock ("EAZYDEV", "we") helps businesses manage stock, sales, finances and teams. This policy explains what personal and business data we handle and how we protect it. We design our privacy practices around the Nigeria Data Protection Act (NDPA) and NDPC guidance. For a plain-English summary of our security controls, see our Security & Trust page.

2. What we collect

• Account data: username, email, optional name and phone, password (stored only as a salted PBKDF2 hash), and 2FA settings.
• Business data: business name, address and contact details, plus the products, stock movements, sales, customers, suppliers, expenses, salaries and audit history you enter.
• Transaction data: subscription plan, billing interval and payment records (amount, currency, provider reference).
• Payment provider data: provider transaction IDs only — full card numbers are processed by the payment provider and are never stored on our servers.
• Technical metadata: IP address, browser type and login times, used to keep your account secure and detect abuse.

3. How we use it

• To provide and operate the service.
• To bill you for paid plans via our payment providers.
• To secure your account and detect and block abuse.
• To send transactional email (verification, password reset, 2FA codes, receipts) and, where you opt in, summaries.
• To improve the product using anonymous, aggregated metrics. We never sell your data.

4. Who can access data

Inside your business, access is controlled by role (Owner, Manager, Staff, Viewer) and every business is isolated from every other. On our side, access is limited to authorised personnel who need it to operate or support the service, under confidentiality obligations. We never expose payment secret keys in the browser, and our logs are kept free of passwords, tokens and payment secrets.

5. Third-party processors

We share the minimum data needed with trusted processors:

• Stripe, Paystack and Flutterwave — to process card and bank payments for paid plans.
• Brevo (SMTP) — to deliver transactional email such as verification, password reset, 2FA codes and receipts.
• Our hosting provider — to run the application and database servers that store your data.
• Law enforcement — only where we are legally required to disclose.

6. Data retention

We keep your account and business data for as long as your account is active so the service works as expected. When you delete your account, we remove or anonymise your data within a reasonable period, and operational backups roll off on a defined schedule (typically within 90 days). Some records may be retained longer where the law requires (for example, billing records).

7. Your rights

• You can view and edit your profile at any time.
• You can export your products, movements, sales and reports at any time as CSV, Excel or PDF.
• You can request correction or deletion of your account and personal data.
• You can withdraw optional cookie consent at any time from Cookie settings.

8. Breach notification

We maintain an incident-response plan. In the event of a personal-data breach that is likely to affect your rights, we will investigate promptly and notify affected users and the relevant supervisory authority where the law requires, within the applicable timeframe.

9. Cookies

We use essential cookies to keep you logged in and protect form submissions, and optional cookies only with your consent. We do not run advertising or tracking profiles. See the full Cookie Policy.

10. NDPC alignment

Our privacy program is built around NDPA / NDPC principles — consent, data minimisation, access control, retention limits, user rights and breach-response planning. We describe this as NDPC-aligned. Formal NDPC registration is part of our compliance roadmap and is not yet complete; we will update this page when our status changes. See our compliance roadmap.

11. Contact

Privacy questions or data requests: contact us.