How we handle your data.

When you place an order or request a quote, we collect the information you give us directly: name, email, phone, shipping address, and the product details of what you want sourced.

Payment details go through Stripe and never touch our servers. We keep a reference ID and the last four digits for receipts.

• Account info: name, email, phone, password (hashed)
• Shipping info: delivery addresses for your orders
• Order info: the items you requested and sourcing notes
• Usage info: pages visited, clicks, cookies (described below)

Short list: to source your order, ship your order, answer your questions.

• Source and fulfill your request at the outlet
• Send you order updates on WhatsApp, SMS, or email based on your preference
• Process payments and issue receipts
• Improve the service (which items get requested most, which pages confuse people)
• Meet legal / tax / customs obligations

A short, specific list of third parties we use to run the service:

• Stripe— payment processing.
• Resend— transactional email delivery.
• Infobip— WhatsApp and SMS order updates.
• Cloudflare R2— storing your order photos and receipts.
• Carriers— DHL, FedEx, UPS, local last-mile for delivery.
• Sentry— error tracking (no PII by default).

Each of these has their own privacy terms and stricter responsibilities than us by virtue of being bigger. None of them receive data they don’t need to do their job.

Under Nigerian NDPR and US standards you can ask us to:

• See the data we have on you
• Correct anything that is wrong
• Delete your account and the associated data (we keep order records for tax/customs reasons; we anonymize where possible)
• Stop marketing messages (every broadcast has an unsubscribe)
• Export your data in a portable format

To exercise any of these, email [email protected]. I reply within a week.

We use the standard ones: session cookies to keep you logged in, preference cookies so your currency / language selections persist, and analytics cookies to see which pages people use.

More detail on the cookie policy page.

Passwords hashed with bcrypt. Payments over TLS via Stripe. All traffic behind Cloudflare with a Full Strict SSL policy. Nightly database backups, 30-day retention.

Nothing on the internet is 100% secure. We do everything reasonable to protect your information. If there is ever a breach affecting customer data, we notify you and the relevant regulators within 72 hours.

• Account data: while your account is active, plus 12 months if you request deletion so we can meet Nigerian customs retention rules
• Order data: 7 years (US and Nigerian tax law)
• Payment records: as long as Stripe requires (usually 7 years)
• Marketing preferences: until you unsubscribe
• Support tickets: 2 years

Privacy questions, data requests, complaints: [email protected]

Postal: BiddieVariety LLC, Brunswick, Maryland, USA.