How I handle your data.

When you place an order or request a quote, I collect the information you give me directly: name, email, phone, shipping address, and the product details of what you want sourced.

Payment details go through Stripe and never touch my servers. I keep a reference ID and the last four digits for receipts.

• Account info: name, email, phone, password (hashed)
• Shipping info: delivery addresses for your orders
• Order info: the items you requested and sourcing notes
• Usage info: page counts from cookieless analytics (see Cookies below)

Short list: to source your order, ship your order, answer your questions.

• Source and fulfill your request at the outlet
• Send you order updates on WhatsApp, SMS, or email based on your preference
• Process payments and issue receipts
• Improve the service (which items get requested most, which pages confuse people)
• Meet legal / tax / customs obligations

A short, specific list of third parties I use to run the service:

• Stripe: payment processing.
• Resend: transactional email delivery.
• Infobip: WhatsApp and SMS order updates.
• Cloudflare R2: storing your order photos and receipts.
• Carriers: DHL, FedEx, UPS, local last-mile for delivery.
• Sentry: error tracking (no PII by default).

Each of them has its own privacy terms, and as larger companies they carry stricter obligations than I do. None of them receive data they don’t need to do their job.

Under the Nigeria Data Protection Act 2023 and US standards you can ask me to:

• See the data I have on you
• Correct anything that is wrong
• Delete your account and the associated data (I keep order records for tax/customs reasons, anonymized where possible)
• Stop marketing messages (every broadcast has an unsubscribe)
• Export your data in a portable format

To exercise any of these, email [email protected]. I reply within a week.

If you are not happy with my answer, you can complain to the Nigeria Data Protection Commission, the regulator under the Act.

Three cookies, all of them for sign-in, and only after you sign in: bv_auth_token, bv_refresh_token and bv_csrf_token. A signed-out visitor carries none of them.

Your browser also stores eleven things for this site, listed key by key on the cookie policy page. They fall into three groups:

• Signing you in: bv_secure_token, bv_secure_session_active, bv_secure_user, bv_secure_enc_key, auth-storage, and the older token and user. These hold your sign-in pass and a copy of your name, email and account flags. The pass is sent to my API with every request you make while you are signed in, which is what signing in means. bv_secure_user is encrypted; auth-storage is not.
• Your device and your preferences: deviceFingerprint (so your security page can tell you which devices are signed in), preferredCurrency and lastKnownRate (the currency prices are shown in, and the last rate this browser saw; you are charged in USD either way).
• The install prompt: pwa-first-seen, pwa-pageviews and pwa-install-dismissed, so I do not ask you twice to install this site as an app.

If your browser refuses local storage, the sign-in values fall back to a short-lived cookie so signing in still works. Clearing site data for this domain removes every one of them.

Analytics is Cloudflare Web Analytics, which sets no cookie and records no identifier linking one visit to the next. There are no advertising cookies and no cross-site trackers, which is why you see no cookie banner. The one third-party cookie on this site is Stripe’s, on the card form when you pay, for its fraud checks. I never see your card either way.

The full list of cookies and storage keys is on the cookie policy page.

Passwords hashed with bcrypt. Payments over TLS via Stripe. All traffic behind Cloudflare with a Full Strict SSL policy. Nightly database backups, 30-day retention.

Nothing on the internet is 100% secure. I do everything reasonable to protect your information. If there is ever a breach affecting customer data, I notify you and the relevant regulators within 72 hours.

• Account data: while your account is active, plus 12 months if you request deletion so I can meet Nigerian customs retention rules
• Order data: 7 years (US and Nigerian tax law)
• Payment records: as long as Stripe requires (usually 7 years)
• Marketing preferences: until you unsubscribe
• Support tickets: 2 years

Privacy questions, data requests, complaints: [email protected]

Postal: BiddieVariety LLC, Brunswick, Maryland, USA.