1. Who we are
Kweek is operated by Kweek Technologies Ltd ("Kweek", "we", "us", "our"), a company based in Lagos, Nigeria. Kweek provides a dashboard that lets merchants create payment links, track orders, and manage customers. This policy explains what personal data we collect from merchants who use our dashboard ("Merchants") and from the customers who pay through a Kweek payment link ("Customers"), and what we do with it.
2. Information we collect
From merchants (account holders)
- Account details: full name, email address, phone number, password (stored as a one-way hash, never in plain text).
- Business details you provide during onboarding: business type and how you heard about us.
- Team member details, where you invite others to your account: name, email, phone, and role.
- Identity verification data, where you complete KYC: your Bank Verification Number (BVN) and the name/date of birth associated with it — see Section 3.
- Payment link and order content you create: item names, prices, descriptions, delivery zones, and any images you upload.
- Transaction and wallet data: balances, transaction history, withdrawal requests, and linked payout bank account details.
- Technical data: IP address, device/browser information, and approximate login activity, used for rate-limiting, fraud prevention, and account security (e.g. the "remember me" and session cookies described in Section 6).
From customers (people paying a merchant)
- Name, phone number, and, optionally, email address, entered on a payment page to complete an order.
- Delivery address and delivery zone, where applicable.
- Payment details are collected and processed directly by our payment gateway partner (see Section 5) — Kweek does not receive or store your full card number or bank login details.
- Messages sent through the in-page chat widget on a payment link, and a device-generated chat token used to keep your conversation with the merchant private.
3. BVN and identity verification (KYC)
To comply with Central Bank of Nigeria (CBN) and anti-money-laundering (AML) requirements, some payouts and account activity require identity verification against your Bank Verification Number (BVN). When you submit a BVN for verification:
- We send it to our licensed verification partner to confirm the name, and date of birth on file match the details on your Kweek account and, where applicable, your payout bank account.
- We store the outcome of each verification attempt (pass/fail and a partial, masked reference to the BVN used) so we can enforce attempt limits and investigate disputes — we do not store your full BVN in plain text in application logs.
- Repeated failed verification attempts may result in your payout ability being temporarily locked, consistent with our fraud-prevention obligations.
- We do not use your BVN for any purpose other than identity verification, fraud prevention, and regulatory compliance.
4. How we use your information
- To create and operate your merchant account, and the payment pages your customers use.
- To process payments, verify transactions, and settle funds to your wallet or payout account.
- To verify identity and meet our obligations under CBN, AML, and KYC regulations.
- To send you transactional notifications — new orders, payment confirmations, plan and downgrade notices, and chat messages — by email and, where you've enabled it, push notification.
- To detect and prevent fraud, abuse, and unauthorized account access (for example, rate-limiting login and password-reset attempts).
- To provide customer support when you contact us.
- To improve the reliability and usability of the dashboard.
5. Who we share information with
We do not sell personal data. We share information only where necessary to run the service:
- Payment processing: transaction and checkout details are shared with our payment gateway partner to process and settle payments. Card and bank-transfer credentials are handled directly by the gateway under its own security standards (e.g. PCI-DSS) — Kweek does not see or store full card numbers.
- Identity verification: BVN details are shared with our licensed KYC/verification partner as described in Section 3.
- Email delivery: transactional emails (verification, password reset, receipts, notifications) are sent through our email delivery provider.
- Push notifications: if you enable push notifications, your device's push subscription is registered with the browser/OS push service (e.g. Google's or Apple's push infrastructure) that delivers the notification to your device — see Section 7.
- Legal and regulatory disclosure: where required to comply with a legal obligation, court order, or a lawful request from the CBN or another regulator.
- Business transfers: if Kweek is involved in a merger, acquisition, or asset sale, customer and merchant data may be transferred as part of that transaction, subject to this policy.
6. Cookies and similar technologies
We use a small number of cookies required for the dashboard to function:
- A session cookie that keeps you signed in while you use the dashboard. It's marked HTTP-only and Secure, and is not accessible to page scripts.
- An optional "remember me" cookie, set only if you tick "Remember me" at login, that keeps you signed in for up to 30 days on that device.
- A CSRF token stored in your session, used to confirm that form submissions genuinely came from your browser.
We do not currently use third-party advertising or analytics cookies.
7. Push notifications
If you install Kweek to your home screen and opt in to notifications, your browser generates a push subscription (a unique, revocable endpoint) which we store against your account so we can deliver time-sensitive alerts — new orders, payment confirmations, and chat messages — even when the dashboard isn't open. You can withdraw this permission at any time from your device or browser notification settings, or from within Kweek's notification preferences; doing so deletes the stored subscription.
8. Data retention
We retain account and transaction data for as long as your account is active, and afterwards for as long as required to meet our legal, tax, and AML record-keeping obligations (which can extend for several years after account closure under Nigerian financial regulations). Chat messages and order details are retained for as long as the related order or account exists, unless you request earlier deletion and we are not otherwise required to keep it.
9. How we protect your information
- Passwords are hashed (bcrypt) and never stored or logged in plain text.
- All traffic to and from Kweek is encrypted in transit (HTTPS/TLS).
- Access to production data is restricted to personnel who need it to operate the service.
- We apply rate-limiting on login, registration, and password-reset flows to reduce automated abuse.
No system is 100% secure, and we can't guarantee absolute security — but we take reasonable, industry-standard steps to protect your data and will notify affected users as required by law in the event of a data breach affecting their personal information.
10. Your rights
Subject to applicable law (including the Nigeria Data Protection Act 2023), you may have the right to:
- Request a copy of the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to delete your data, subject to our legal and regulatory record-keeping obligations described in Section 8.
- Withdraw consent for optional processing (e.g. push notifications) at any time.
- Object to certain processing or ask us to restrict it.
To exercise any of these rights, contact us using the details in Section 13. We may need to verify your identity before acting on a request.
11. Children's privacy
Kweek is intended for business use by adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll update the "Last updated" date above, and where a change is material, we'll take reasonable steps to notify merchants (for example, by email or an in-dashboard notice).
Questions about this policy or how we handle your data can be sent to support@kweek.ng.