Privacy Policy
Last updated: 5 November 2026
1. Who we are
ShopParrot is operated by Onoja's Very Own Nigeria Limited (RC 7015914), A33 Army Estate, Kubwa, FCT, Nigeria ("ShopParrot", "we", "us").
- Privacy and data protection requests: [email protected]
- General contact: [email protected] · +234 810 015 3498
ShopParrot provides a sales and service assistant that businesses ("merchants") use to talk to their customers on WhatsApp, and the website shopparrot.com.
2. Our role
- For merchant accounts, staff accounts, website enquiries and billing, we decide how and why the data is used. We are the data controller.
- For customers who message a merchant through ShopParrot, the merchant decides how and why their chats, orders and payment records are used. The merchant is the controller and we are the processor, acting on the merchant's instructions.
If you are a customer and you want to see, correct or delete what a merchant holds about you, ask that merchant. If you ask us instead, we pass your request to the merchant and tell you we have done so.
3. What we collect
Website visitors
- What you send through the Get started form: your name, your business name, your email address, what you sell, the plan you are interested in, and, if you choose to give them, your phone number and a message. Only the email address, your name, your business name and what you sell are required; the phone number and the message are optional.
- If the form cannot send your request from the page, your own email app opens with the request ready for you to send. It then reaches [email protected] directly from you, without passing through our email provider.
- Anything you write to us by email.
Merchants and their staff
- Account details: names, business details, email, phone, role, login records.
- Billing details: plan, invoices and payment references. Card details are handled by Paystack and never stored by us.
- Setup details: products, prices, services, opening hours and policies you give us.
Customers who message a merchant
- Your WhatsApp phone number and profile name.
- Messages, voice notes, photos, documents and locations you send, and the replies you receive.
- Orders, bookings, quotes and payment references (for example a Paystack transaction reference). Card and bank details are handled by Paystack.
- Your choice to stop receiving messages (opt-out).
4. Cookies and what the website stores
- The website sets no cookies of its own, and keeps nothing in your browser's local storage. It has no setting to remember about you.
- We use Cloudflare Web Analytics, which counts visits without cookies and without identifying you.
- The Get started form is protected by Cloudflare Turnstile, which checks that a form was filled in by a person and not by a bot. Cloudflare's Turnstile Privacy Addendum (18 June 2025) says it processes "a variety of client-side signals … such as client IP address, TLS Fingerprint, User-Agent Header and Sitekey and associated origin", and that the purpose of collecting them "is not to identify, profile or target any individuals but solely to detect and block bots". Cloudflare's documentation states that Turnstile "does not access, store, or transmit user communications, form entries, or other page inputs" — so what you type in the form is not sent to it. Turnstile may place a Cloudflare security cookie or similar check on your device as part of that test. We do not use it for analytics or advertising, and it runs only on the Get started form.
5. Why we use it and our legal basis
| Purpose | Legal basis (NDPA s.25) |
|---|---|
| Replying to enquiries from the website or email | Steps you asked for before a contract; legitimate interest |
| Providing the service to merchants: setup, assistant, inbox, payments, support | Contract |
| Delivering customers' conversations, orders, bookings and updates for the merchant | Performance of our contract with the merchant, and the customer's own request to be served |
| Billing and accounting records | Legal obligation (tax) |
| Keeping the service secure, preventing abuse, honouring opt-outs | Legitimate interest; legal obligation |
| Product updates and offers to merchants | Consent or legitimate interest; you can opt out any time |
We don't sell personal data. We don't use customers' conversations to advertise to them.
6. Who we share it with
We use these service providers to run ShopParrot. Each only gets what it needs.
The website now
| Provider | What for | Where |
|---|---|---|
| Cloudflare | Website hosting, analytics, and the Turnstile anti-bot check on the Get started form | Global network |
| Resend | Delivering enquiries sent through the Get started form | European Union (Ireland) |
| Google Workspace | Our email, including enquiries that reach [email protected] | Global |
When the ShopParrot service launches
| Provider | What for | Where |
|---|---|---|
| Meta Platforms (WhatsApp Business Platform) | Sending and receiving WhatsApp messages | Outside Nigeria |
| Paystack | Payments, payouts to merchants, receipts | Nigeria and other countries |
| Vercel | Hosting the app | United States and other regions |
| Neon | Database | European Union (Frankfurt) |
| Cloudflare | File storage | Global network |
| Upstash | Temporary data for message processing | European Union |
| Resend | Sending account emails | European Union (Ireland) |
The merchant you message can see your conversation, orders and payments with them. We may also share data when the law requires it, to protect our rights or users' safety, or as part of a sale or reorganisation of our business.
Meta processes WhatsApp messages under its own terms and policies.
7. Transfers outside Nigeria
Some of our providers store or process personal data outside Nigeria. Those providers are bound by contractual safeguards that protect personal data to the standard the NDPA requires, as allowed under NDPA Part VIII.
Cloudflare acts for us in two different roles on the Turnstile check described in section 4. It is our processor when it decides whether a form was sent by a person, and it is a controller in its own right when it uses the same signals to improve how Turnstile detects bots, which its Turnstile Privacy Addendum sets out. Questions about what Cloudflare does with that data can go to its Data Protection Officer at [email protected], and anything you want from us goes to [email protected].
8. How long we keep it
| Data | How long |
|---|---|
| Customer chats (messages, photos, voice notes) | 12 months after the last message |
| Orders, invoices and payment references | 6 years after the end of the financial year they relate to, because tax and accounting records must be kept for that period |
| Opt-out list | As long as we run the WhatsApp number, so we never message you again |
| Merchant account | While active; billing records 6 years; profile details deleted 90 days after leaving; chats deleted 30 days after leaving (export offered) |
| Staff logins and activity logs | 12 months |
| Emails and website enquiries | 24 months |
| Backups | Overwritten on a rolling 30-day cycle |
9. Your rights
Under the NDPA you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct it;
- delete it, unless the law requires us to keep it;
- restrict or object to how we use it;
- move it to another provider in a common format;
- withdraw consent, where we rely on consent;
- not be subject to decisions made only by automated means that significantly affect you.
Email [email protected]. We answer within 30 days. We may ask you to confirm your identity first. To stop WhatsApp messages from a merchant, reply STOP in the chat.
To have your data deleted, see Data deletion, which explains what we delete, what we keep and how long it takes.
You can also complain to the Nigeria Data Protection Commission (NDPC).
10. Security
Access is limited to people who need it, our own team's accounts are protected with two-factor authentication, and merchant and staff accounts will use two-factor authentication when the service launches. Data is encrypted in transit, and each merchant only sees its own customers. Sensitive documents should be sent through secure upload links, not in chat.
11. Children
ShopParrot is a service for businesses and is not directed at anyone under 18. If you believe a child has given us personal data, email [email protected] and we will delete it.
12. Changes
We'll post any changes here and update the date above. For a material change we give merchants 30 days' notice by email.
13. Contact
[email protected] · Onoja's Very Own Nigeria Limited, A33 Army Estate, Kubwa, FCT, Nigeria