Privacy Policy

1. Data We Collect

Trato collects the data needed to run a WhatsApp-native marketplace safely:

• Phone number: WhatsApp communication and login.
• Display name: Account and marketplace identity.
• BVN / bank verification data: Seller payout verification through Paystack where required.
• Delivery address and location pins: Only when needed for pickup, delivery, or rider matching.
• Payment information: Processed by Paystack; Trato does not store full card or bank credentials.
• Marketplace activity: Listings, offers, deals, reviews, disputes, and support messages.

2. How We Use Data

• Authenticate users and protect accounts.
• Match buyers, sellers, and riders.
• Process payments, escrow, refunds, and payouts through Paystack.
• Send WhatsApp notifications about offers, sales, delivery, reviews, and support.
• Detect fraud, prevent off-platform scams, and resolve disputes.
• Improve pricing, ranking, matching, and marketplace safety.

3. Sharing Data

We share data only when it is needed to complete a transaction, comply with law, or keep the marketplace safe.

• Paystack and banking partners: Payment, escrow, KYC, and payout processing.
• Other users: Limited marketplace details needed to complete a deal. Phone numbers are not shared by default.
• Riders: Pickup/drop-off details needed for accepted delivery tasks.
• Authorities: Only when required by law, court order, or safety investigation.

We do not sell personal data to third-party marketers.

4. Retention

• Account data is kept while the account is active.
• Transaction records may be kept for legal, tax, accounting, fraud, and dispute reasons.
• Chat and support records are kept as needed to protect users and resolve marketplace issues.
• Expired login codes are routinely removed.

5. Your Rights

You can ask us to access, correct, export, restrict, or delete your personal data, subject to legal and fraud-prevention obligations.

Contact us at privacy@trato.ng.

6. Security

• TLS encryption in transit.
• Restricted access to production systems and service-role credentials.
• Escrow and delivery PIN flows to reduce fraud.
• Rate limits and origin checks on sensitive endpoints.
• Operational logs for abuse detection and incident response.