Privacy Policy
Last updated 27 September 2026 · Effective 27 September 2026
This policy explains what personal information Swepty collects as you shop, sell, and create, why, and the control you keep. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and, for users elsewhere, the EU and UK GDPR. Read it with our Cookie Policy and Terms of Service.
1. Who we are
Swepty is a social-commerce platform where people discover, shop, sell, and go live, operated by Bolrach Technologies Limited (“Swepty”, “we”, “us”), the data controller for the information described here. Reach us, and exercise any right below, through our contact page.
2. What we collect
- Account information. When you sign in through auth.ng we receive your name and email, and the profile details you add.
- Content you create. Posts, videos, live streams, product listings, and comments.
- Shopping and order data. Items you view, save, and buy, your cart, orders, delivery details, and returns.
- Seller data. If you sell, your shop details, listings, sales, and the information needed to pay you.
- Payment data. Handled by our payment partners; we keep records of transactions, not your full card number.
- Device and connection data. IP address, device type, app version, language, and approximate region, for security and local recommendations.
- Cookies and similar technologies. As described in our Cookie Policy.
3. How and why we use it
| Purpose | Data used | Legal basis (NDPA / GDPR) |
|---|---|---|
| Create your account and sign you in | Account information | Contract |
| Run the feed and recommend products and creators | Content, shopping data | Legitimate interests / consent for non-essential cookies |
| Process orders, delivery, and returns | Shopping and order data | Contract |
| Pay sellers and prevent fraud | Seller and payment data | Contract / legal obligation |
| Check the links people post for safety and count clicks on them (Ruung) | The clicked address; country, device type, operating system and browser family; the referring domain | Legitimate interests |
| Keep Swepty safe and enforce our rules | Device data, content, reports | Legitimate interests |
| Comply with the law and lawful requests | As required | Legal obligation |
We do not sell your personal information, and we do not run advertising or advertising and analytics tracking against users we know to be minors.
4. Who we share it with
- Service providers. Companies that host the service, deliver media, send email, and help prevent abuse, acting on our instructions under a contract.
- Payment and delivery partners. To process payments, pay sellers, and fulfil and deliver orders.
- Sellers and buyers. To complete an order, we share the details a seller and buyer need with each other.
- Other users. Your profile, public posts, and shop are visible by design. Private data is not.
- Ruung, for links. Links in public posts, comments, bios and product descriptions go through ruu.ng, the link service of Ruung, which Bolrach runs. Ruung checks each destination for safety before a reader lands there, and it counts clicks so the person who posted the link can see how many people opened it. For each click, Ruung records the link, the time and the destination, the country, the type of device, the operating system and browser family, and the domain of the referring site. It never stores the IP address; a one-way salted hash of it serves only to avoid counting a repeat click twice. Individual clicks are deleted after 90 days, and hourly totals remain for 25 months. We do not use any of this to follow anyone from site to site or to build an advertising profile, and ruu.ng sets no cookies. Ruung never receives links from private messages, subscriber-only posts, draft listings or digital downloads.
- Legal and safety. Where we must comply with the law, enforce our Terms, or protect people from harm.
5. International transfers
Our infrastructure providers may process data outside Nigeria. Where personal data is transferred abroad we rely on an adequacy decision or appropriate safeguards (such as the Standard Contractual Clauses and the UK Addendum) as required by the NDPA and GDPR, so your data stays protected wherever it is handled.
6. How long we keep it
We keep personal information while your account is active and for as long as we need it for the purposes above. Order, payment, and tax records are kept as long as the law requires. Otherwise we delete or anonymise it.
7. Your rights
You can access, correct, delete, restrict, or object to the processing of your data, receive it in a portable format, and withdraw consent where we rely on it. To exercise any of these, use our contact page and choose “Privacy and data”. You may also complain to the Nigeria Data Protection Commission (NDPC), or your local authority, though we would like the chance to help first.
8. How we protect it
We use encryption in transit, access controls, and monitoring, and we limit who can see your information. No service can promise perfect security, but we work hard to protect yours and respond quickly if something goes wrong.
9. Children
Swepty is not directed to children under the minimum age required in your country, and we do not knowingly collect their personal information. Where we know a user is a minor, we do not run advertising or advertising and analytics tracking against them.
10. Contact us
Questions, or want to exercise a right? Reach us through our contact page. Swepty is operated by Bolrach Technologies Limited.
