Privacy Policy

Privacy Policy

Last updated: 24 July 2026

These documents are provided as a starting template for Collxct / Recbot and are not legal advice. Please have them reviewed by a qualified lawyer before you rely on them, and tailor them to your final data flows.

1. Scope

This policy explains how Collxct (“we”) handles personal data through Recbot's web portal and mobile app. We aim to comply with the Nigeria Data Protection Act 2023 (NDPA) and, where it applies, the EU/UK GDPR.

2. Who we are

Collxct is the data controller for business-account data and the processor for the customer order data your business handles through Recbot. Contact: support@collxct.com.ng.

3. Information we collect

  • Account & business data: your name, email, password (hashed), business name, WhatsApp number, bank/payout details, opening hours and location.
  • Customer order data: customer phone number, name, delivery address, and order contents that pass through the ordering flow.
  • Payment data: payment references and status from our payment partner (we do not store full card details).
  • Mobile device data: a push-notification token so we can alert you to orders.
  • Technical data: logs, IP address, and basic usage needed to run and secure the service.

4. How and why we use it

To provide and operate the ordering service; to route and price orders; to send you order alerts (including push notifications); to process subscriptions and payments; to provide support; to keep the service secure; and to meet legal obligations.

5. Legal bases

Depending on the case: performance of our contract with you; your consent (e.g. push notifications, which you can withdraw); our legitimate interests in running and securing the service; and compliance with legal obligations.

6. Sharing & processors

We share data only as needed with service providers who process it on our behalf, including: Twilio (WhatsApp messaging), Paystack (payments), Google Firebase (push notifications), OpenStreetMap/Nominatim (address geocoding), our email provider, and our hosting provider. We do not sell personal data.

7. International transfers

Some processors are outside Nigeria. Where data is transferred abroad, we rely on appropriate safeguards as required by the NDPA/GDPR.

8. Retention

We keep personal data only as long as needed for the purposes above or as the law requires, then delete or anonymise it.

9. Security

We use measures such as encryption in transit, hashed passwords, access controls and optional two-factor authentication. No system is perfectly secure, but we work to protect your data.

10. Your rights

Subject to law, you may request access to, correction of, or deletion of your personal data; object to or restrict certain processing; withdraw consent; and request portability. You may also complain to the Nigeria Data Protection Commission (NDPC), or your local regulator.

11. Deleting your account & data

You can ask us to delete your account and associated personal data by emailing support@collxct.com.ng; in-app account deletion is also being added. We will action requests within the timelines the law requires, subject to any records we must keep.

12. Push notifications

The mobile app sends order alerts via push. You can turn these off in your device settings or by signing out, which removes the device from alerting.

13. Cookies

The web portal uses a strictly necessary session cookie to keep you signed in. We do not use advertising cookies.

14. Children

Recbot is for businesses and is not directed to children under 18.

15. Changes

We may update this policy; the “last updated” date will change.

16. Contact

For any privacy request, email support@collxct.com.ng. See also our Terms of Use.

Hi, I'm Ada! I'll pop up with tips as you work around Collxct.