Legal

Privacy Policy

Last updated: April 2026 · Version 1.1

This policy explains what data ChopDispatch collects from vendors, how it is used, how long it is kept, and the controls available to you. It applies to all users of the ChopDispatch Vendor Portal at vendor.chopdispatch.com and should be read alongside our Vendor Terms of Service.

1. Who We Are

ChopDispatch operates the vendor portal as a marketplace intermediary connecting food and product vendors with customers across Nigeria. References to “ChopDispatch”, “we”, “us”, or “our” in this policy refer to ChopDispatch and its operating entity. Questions about this policy can be directed to our support team through the dashboard inbox or via the contact details in your onboarding correspondence.

2. Data We Collect

We collect the following categories of data when you use the vendor portal:

Account & Identity

Your name, email address, and profile photo provided via Google or Apple Sign-In. If you register a passkey, your WebAuthn credential identifier is stored server-side; biometric data never leaves your device.

Application & KYC

Business name, type, address, operating region, contact details, and any supporting documentation submitted during vendor onboarding.

Store & Catalogue

Store profile (name, description, operating hours, banner image, logo), product listings (names, prices, images, add-on groups), and inventory records (stock items, quantities, categories). Your store profile and published policies are publicly visible to customers.

Orders & Transactions

Order details including items ordered, quantities, prices, timestamps, delivery addresses, and customer identifiers. Financial records including earnings, commission deductions, withdrawal requests, and your registered Nigerian bank account (NUBAN) details. POS hold carts (customer name, phone, items, payment method) are stored temporarily for up to one hour to facilitate order completion.

Staff & Access

Names, email addresses, roles, and invitation records for team members you add to your vendor account.

Shifts & Time Tracking

Clock-in and clock-out timestamps, shift duration, overtime flags, number of orders handled, and revenue attributed per shift for each staff member.

Advertising

Campaign settings (objectives, budgets, schedules, targeting criteria), ad creatives (headlines, images, copy), ad wallet top-up history, and delivery statistics (impressions, clicks, attributed orders, spend).

Customer Communications

Messages exchanged between your team and customers via the platform inbox, including message templates you create for common scenarios.

Voice Calls

The platform provides internal voice calling between staff members. We log call metadata: participant identities, timestamps, duration, call type (one-to-one or group), direction (inbound/outbound), outcome (answered, missed, declined), and seen status. Call audio is not recorded or stored by ChopDispatch.

Customer Data You Access

Names, phone numbers, delivery addresses, order history, and CRM notes (tags, lead status, custom notes) that you create or review for your customers. This data belongs to your customers — you are a data processor for it under our platform rules (see Terms §11).

Session & Device Data

IP address, truncated user-agent string, browser name, operating system, approximate country (derived from your IP via Cloudflare), sign-in timestamp, and platform type (web, iOS, Android) for each authenticated session. Up to 10 recent sessions are retained for your security dashboard.

API Keys

If you create API keys for programmatic access, we store the key name, permissions, creation timestamp, last-used timestamp, and the device or platform the key was created from. The raw key value is only shown once at creation; only a hash is stored thereafter.

Notification Preferences

Your chosen notification channels (email, push, web) and per-event preferences for order updates, staff activity, ad alerts, and more.

Activity & Audit Logs

An operational audit trail of significant actions performed in your account by you or your staff — including product edits, order status changes, staff invites, and settings updates.

3. How We Use Your Data

Platform operation — routing orders, processing payouts, managing your catalogue and inventory.
Identity & access — authenticating sign-ins, maintaining active sessions, and enforcing role-based permissions for your staff.
Payments — calculating commissions, holding earnings in escrow, processing withdrawal requests to your registered bank account.
Advertising — delivering your ad campaigns to customers, tracking performance metrics, and managing your ad wallet.
Security & fraud prevention — rate limiting, CSRF protection, IP-based session tracking, and audit logging to protect your account.
Communications — sending order alerts, staff invitation emails, settlement notifications, and policy update notices.
Staff management — tracking shift hours, attributing orders and revenue to shifts, flagging overtime, and enabling authorised remote screen control for training and support.
Analytics & reporting — aggregating revenue, customer segmentation (lead scoring), staff activity summaries, and ad performance to provide actionable business insights (see Terms §12).
Legal & compliance — retaining order, financial, and KYC records as required by Nigerian law.
Platform improvement — aggregate, anonymised analytics to improve performance and features. We do not sell personal data.

4. Data Retention

Most data you create is retained while your account is active and for a period thereafter to support dispute resolution and legal obligations. The following categories are retained regardless of account status and cannot be deleted via the self-service data controls:

Order records — required for customer dispute resolution.
Wallet & financial transactions — retained for accounting, tax, and refund purposes.
Customer message threads — retained briefly for dispute resolution and platform safety.
Application & KYC record — retained for onboarding compliance and regulatory obligations.
Call session metadata — retained for operational and security audit purposes.
Shift records — retained for labour compliance and financial attribution.

All other data categories — products, inventory, staff records, activity logs, CRM notes, ad campaigns, and your store profile — can be deleted by you at any time from the Account section of your dashboard Settings (see Terms §13 for account closure).

5. Data Export

You may request an export of your data at any time from the Account section of your dashboard Settings. Available export scopes include: your profile and store details, product catalogue, inventory, staff roster, order history, CRM notes, activity logs, ad campaigns and stats, and wallet & ledger records. Exports are provided in JSON format.

6. Third-Party Services

We use the following third-party services to operate the platform:

Google & Apple (Firebase Auth) — identity verification and sign-in. Subject to their respective privacy policies.
Cloudflare — CDN, DDoS protection, IP geolocation, and WebRTC relay for internal voice calls (Cloudflare Realtime SFU). Your IP is processed by Cloudflare on each request. Media assets (product images, store banners) are stored in Cloudflare R2.
Upstash Redis — session storage, API rate limiting, and real-time signalling for calls and remote-control requests. Session data is stored encrypted at rest.
Nigerian Payment Infrastructure — bank account verification and settlement processing via our payment partners. Your NUBAN details are shared only as required to process payouts.

We do not sell your personal data to any third party, and we do not use your data for advertising purposes outside of the ChopDispatch platform.

7. Security

We implement the following technical controls to protect your data:

All traffic is served over HTTPS with HSTS enforced.
Session tokens are stored in HTTP-only cookies, not accessible to JavaScript.
Sessions expire after 7 days of inactivity and are hard-capped at 30 days.
CSRF protection is applied to all state-mutating API requests.
Rate limiting is applied to login and all API endpoints.
WebAuthn passkeys are supported as a phishing-resistant sign-in option.
An optional 256-bit AES encryption key is available for sensitive on-device data.
All significant account actions are recorded in an audit log.
Voice call audio is relayed peer-to-peer via encrypted WebRTC; audio is never stored.

8. Your Rights

As a vendor on ChopDispatch you have the following rights with respect to your data:

Access — view your data via the dashboard or request a full export at any time.
Correction — update your profile, store details, and contact information directly in the dashboard.
Deletion — delete specific data categories (products, inventory, staff, activity logs, CRM notes, ads, store profile) from the Account settings. See Section 4 for categories that cannot be deleted due to legal obligations.
Account closure — request full account closure via ChopDispatch Support (see Terms §13). Closure is processed after identity verification, settlement of any outstanding balances, and completion of mandatory retention periods.
Session management — review and revoke any active session from the Security section of your dashboard Settings.
API key management — revoke any API key at any time from the API section of your dashboard Settings.

9. Staff Monitoring & Workplace Tools

The following monitoring features are available to account owners and managers as part of normal platform operations:

Shift tracking — clock-in/out times, shift duration, overtime flags, and per-shift order/revenue attribution are logged and visible in the analytics dashboard.
Remote screen control — authorised users may request remote view or control of a staff member's dashboard session. The recipient is always notified and may decline. See Terms §5(c).
Activity audit trail — all significant actions (product edits, order changes, settings updates) are logged with the acting user's identity and timestamp.
Analytics dashboards — aggregate staff activity, customer segmentation, and revenue metrics are available to owners and managers.

Staff members invited to a vendor account are informed of these monitoring capabilities as part of the invitation and onboarding process.

10. Customer Data (Your Responsibility)

As a vendor you have access to customer names, phone numbers, addresses, and order history for the purpose of fulfilling orders and providing support. You act as a data processor for this information under our platform rules. You must not use customer data for any purpose other than order fulfilment and support, and must not share or sell it to third parties without the customer's explicit consent. Please refer to Section 11 of the Vendor Terms of Service for the full obligations.

11. Cookies & Local Storage

The vendor portal uses a single HTTP-only session cookie (vendor_auth) for authentication. We do not use tracking cookies, advertising cookies, or third-party analytics cookies. A small amount of non-sensitive preference data (such as your last-used sign-in method) may be stored in your browser's localStorage.

12. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via your registered email address or an in-app notice at least 14 days before the new policy takes effect. Continued use of the platform after the effective date constitutes acceptance of the revised policy.

13. Governing Law

This policy is governed by the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act 2023 (NDPA). Any dispute relating to this policy shall be subject to the exclusive jurisdiction of the courts of Osun State.

← Back to Sign In Vendor Terms of Service →