Legal & Compliance

Privacy Policy

Your privacy and data security are paramount. This policy outlines how Xmasjollof collects, manages, and protects your information across Nigeria.

Last updated: December 2026

Encrypted Auth

Google OAuth & secure Supabase Auth tokens.

PCI-DSS Payments

Card details are processed solely by Paystack.

No Selling of Data

We never sell personal contact data to third parties.

1. Information We Collect

Xmasjollof operates as a curated holiday directory connecting festive shoppers with independent merchants in Nigeria. We collect the following categories of data:

Account & Authentication Data (Supabase & Google Auth): When vendors register or log in, we authenticate identities via Supabase Auth and Google OAuth. This includes email addresses, display names, and authentication tokens.
Merchant Profile Data: Business name, phone/WhatsApp number, city, country (Nigeria 🇳🇬), store bio, and deal listings.
Fraud Prevention & Device Fingerprinting: To protect our 500-credit welcome bonus from automated abuse or duplicate merchant fraud, we capture client-side device identifiers and registration timestamps.
Transaction Metadata (Paystack): When purchasing credits or featuring deals, payments are handled directly by Paystack. We store the transaction reference ID, credit amount, payment status, and timestamp in our Supabase payments table. We never store debit/credit card numbers or CVV codes on our servers.

2. How Vendor & Shopper Data Is Used

We use collected information strictly to provide and improve the Christmas marketplace experience:

Publishing verified listings on public deal feeds and category indexes.
Enabling direct shopper-to-vendor communication via WhatsApp or official store URLs.
Managing merchant credit balances and transaction logs.
Enforcing listing moderation policies to keep our directory free of fraud and deceptive pricing.
Sending transactional notices regarding deal approval, rejection refunds, or receipt of payment.

3. Third-Party Infrastructure & Processors

To deliver high availability and compliance, Xmasjollof relies on trusted global and regional technology partners:

Supabase: Cloud database and authentication infrastructure. User data is encrypted at rest and in transit via TLS 1.3.

Paystack: Licensed payment service provider regulated by the Central Bank of Nigeria (CBN). All credit card and bank transfer checkouts occur on Paystack’s PCI-DSS Level 1 certified environment.

Vercel & Cloud Infrastructure: High-speed edge routing and serverless function execution.

4. Data Retention & Your Rights

Under the Nigeria Data Protection Act (NDPA), you have the right to inspect, update, or request the deletion of your merchant profile and listing history at any time.

To request an account export or permanent data removal, contact our privacy officer at support@xmasjollof.com.ng.

5. Contact Us Regarding Privacy

For questions or concerns regarding this policy, reach us via:

Xmasjollof Data Protection Desk

Email: support@xmasjollof.com.ng

Support Page: xmasjollof.com.ng/support

1. Information We Collect

Xmasjollof operates as a curated holiday directory connecting festive shoppers with independent merchants in Nigeria. We collect the following categories of data:

Account & Authentication Data (Supabase & Google Auth): When vendors register or log in, we authenticate identities via Supabase Auth and Google OAuth. This includes email addresses, display names, and authentication tokens.

Merchant Profile Data: Business name, phone/WhatsApp number, city, country (Nigeria 🇳🇬), store bio, and deal listings.

Fraud Prevention & Device Fingerprinting: To protect our 500-credit welcome bonus from automated abuse or duplicate merchant fraud, we capture client-side device identifiers and registration timestamps.

Transaction Metadata (Paystack): When purchasing credits or featuring deals, payments are handled directly by Paystack. We store the transaction reference ID, credit amount, payment status, and timestamp in our Supabase payments table. We never store debit/credit card numbers or CVV codes on our servers.

2. How Vendor & Shopper Data Is Used

We use collected information strictly to provide and improve the Christmas marketplace experience:

Publishing verified listings on public deal feeds and category indexes.

Enabling direct shopper-to-vendor communication via WhatsApp or official store URLs.

Managing merchant credit balances and transaction logs.

Enforcing listing moderation policies to keep our directory free of fraud and deceptive pricing.

Sending transactional notices regarding deal approval, rejection refunds, or receipt of payment.

3. Third-Party Infrastructure & Processors

To deliver high availability and compliance, Xmasjollof relies on trusted global and regional technology partners:

Supabase: Cloud database and authentication infrastructure. User data is encrypted at rest and in transit via TLS 1.3.

Paystack: Licensed payment service provider regulated by the Central Bank of Nigeria (CBN). All credit card and bank transfer checkouts occur on Paystack’s PCI-DSS Level 1 certified environment.

Vercel & Cloud Infrastructure: High-speed edge routing and serverless function execution.