Privacy Policy

01Introduction & Who We Are

Welcome to SleeKnit (“we,” “us,” or “our”), a premium multi-vendor eCommerce marketplace that connects shoppers, independent vendors, and delivery drivers across global and African markets. SleeKnit is available as a mobile application on the Apple App Store and the Google Play Store.

We are committed to protecting your privacy and handling your personal data responsibly, transparently, and in compliance with applicable data protection laws — including, but not limited to, the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), the Nigeria Data Protection Act (NDPA), the Kenya Data Protection Act, the Ghana Data Protection Act, the South Africa Protection of Personal Information Act (POPIA), and the Children's Online Privacy Protection Act (COPPA).

This Privacy Policy governs your use of the SleeKnit mobile application and any related websites, services, or features we operate (collectively, the “Service”). By downloading, registering, or using the Service, you acknowledge that you have read, understood, and agree to the practices described herein.

02Age Restriction & Children's Privacy (COPPA)

By creating an account or using the Service, you represent and warrant that you are at least 18 years of age. If you are under 18, you must immediately cease using SleeKnit and must not provide us with any personal information.

If we discover or are notified that a user under the age of 18 has provided us with personal data, we will immediately deactivate the relevant account and permanently delete all associated personal data from our systems. Parents or legal guardians who believe their minor child has inadvertently created an account may contact us at support@sleeknit.com to request immediate removal.

03Personal Data We Collect

We collect different categories of personal data depending on your role within SleeKnit. We collect only the minimum data necessary to provide, secure, and improve the Service (data minimisation principle).

3.1 Customer Data

When you register as a shopper or customer on SleeKnit, we collect:

• Full Name: To personalise your account and delivery communications.
• Email Address: For account creation, login, order confirmations, and service notifications.
• Password (Encrypted): Stored exclusively as a securely hashed value using industry-standard algorithms (e.g., bcrypt). We never store plaintext passwords.
• Purchase History: A record of orders placed, items bought, and transaction statuses, used to provide order tracking, receipts, and dispute resolution.
• Shipping & Delivery Address: Entered voluntarily by you to facilitate product delivery.
• Payment Method Information: We do not store raw credit or debit card numbers, CVV codes, or full bank account details on our servers. All payment data is tokenised and handled exclusively by our certified third-party payment processors. We retain only a transaction reference ID and the last four digits of a card (where provided by the processor) for your records.
• Preferred Currency & Region: Stored to provide a localised shopping experience across supported currencies (NGN, KES, GHS, ZAR, USD, and others).

3.2 Vendor Data

When you register as a vendor or seller on SleeKnit, we collect the following in addition to standard account data:

• Full Name and Business / Store Name: Displayed publicly on your vendor storefront within the app.
• Business Details: Including your business type, registered address, tax identification number (where required by local law), and bank or mobile money account details for receiving payouts.
• Phone Number (Mandatory — OTP Verified): Vendor accounts are subject to mandatory phone number verification via SMS One-Time Password (OTP). This measure is required for identity assurance and fraud prevention. The phone number is retained on your account for ongoing security verification.
• User-Generated Content (UGC): Product images, listing descriptions, promotional media, and any other content you upload to the platform.
• Sales & Transaction Records: Order fulfilment data, payout history, and customer interaction records where relevant to dispute resolution.

3.3 Driver / Delivery Agent Data

Delivery drivers and logistics partners are subject to enhanced data collection requirements due to the nature of their role:

• Full Name, Email Address, and Encrypted Password: Standard account credentials.
• Phone Number (Mandatory — OTP Verified): Required for identity verification and real-time delivery coordination.
• Real-Time Location Data (GPS): When you are actively logged in and on a delivery assignment, we collect your precise GPS coordinates. This data is used exclusively to enable live delivery tracking visible to customers and to optimise routing. Location tracking is disabled when you are not on an active delivery or when the app is not in use in delivery mode. You will receive an in-app notification and must provide explicit consent before location tracking is activated.
• Government-Issued Identity Documents: For KYC (Know Your Customer) and identity verification purposes, we may collect images of government-issued ID documents (e.g., national ID, driver's licence, or passport). These documents are processed by our KYC verification provider and are treated with the highest level of data security.
• Vehicle Information: Including vehicle registration details, where applicable, for logistics management purposes.

3.4 Technical & Device Data (All Users)

The following technical data is collected automatically when you use the SleeKnit app, regardless of your account role:

• Device Identifiers: Including your device's unique push notification token (FCM token for Android; APNs token for iOS), used exclusively to deliver push notifications relevant to your account activity.
• App Usage Data: Aggregate and anonymised data about features accessed, session duration, screen views, and in-app actions. This data is collected via Firebase Analytics and is used solely to improve app performance and user experience.
• Crash Reports & Diagnostics: Automated crash logs and performance data to help us identify and fix bugs. This data does not contain your personal identifying information.
• Device Type, Operating System, and App Version: Collected for compatibility and performance purposes.
• IP Address: Collected for security monitoring, fraud detection, and geographic region detection (e.g., to display appropriate currencies and languages).

04How We Use Your Personal Data

We use the personal data we collect for the following legitimate purposes:

4.1 Service Delivery

• Creating and managing your account and user profile.
• Processing orders, facilitating payments, and coordinating deliveries.
• Enabling real-time order tracking and delivery status updates.
• Connecting customers with vendors and delivery agents.
• Supporting multi-currency transactions across global and African markets.

4.2 Security & Fraud Prevention

• Verifying user identity via SMS OTP for vendor and driver accounts.
• Detecting, investigating, and preventing fraudulent, abusive, or illegal activity.
• Conducting KYC (Know Your Customer) checks on delivery agents and vendors as required by applicable regulations.
• Monitoring unusual account activity and securing user accounts.

4.3 Communication

• Sending transactional notifications (order confirmations, shipping updates, payment receipts).
• Delivering push notifications via Firebase Cloud Messaging (FCM) and Apple Push Notification service (APNs) — you may opt out of marketing push notifications at any time in your device settings.
• Responding to customer support enquiries and resolving disputes.
• Sending important service announcements and policy updates.

4.4 Analytics & App Improvement

• Analysing aggregate usage patterns to improve the app's features, design, and performance.
• Identifying technical issues and resolving bugs.
• Conducting internal research and development (using anonymised and aggregated data).

4.5 Legal & Regulatory Compliance

• Complying with applicable laws, regulations, court orders, or governmental requests.
• Enforcing our Terms of Service and other applicable agreements.
• Establishing, exercising, or defending legal claims.

05Legal Basis for Processing

For users in jurisdictions where a legal basis is required for processing personal data (including the European Economic Area, the United Kingdom, and African countries with equivalent legislation), we process your data on the following grounds:

Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

06Data Sharing & Third-Party Disclosure

We share your personal data only in the following limited and necessary circumstances:

6.1 Payment Processing Gateways

• To complete financial transactions, we transmit relevant payment information to our certified third-party payment processors. These may include services such as Paystack, Flutterwave, Stripe, mobile money operators, and similar regulated payment gateways operating across our supported markets.
• Data shared with payment processors is limited to the minimum required to authorise and complete a transaction (e.g., transaction amount, currency, and tokenised payment credentials).
• All payment processors are required to comply with the Payment Card Industry Data Security Standard (PCI DSS) and applicable financial regulations.

6.2 SMS OTP Verification Providers

• For phone number verification of vendor and driver accounts, your phone number is transmitted to our SMS delivery provider(s) — which may include Twilio or equivalent telecommunications APIs — solely for the purpose of delivering a one-time verification code.
• These providers do not receive any other personal data beyond the phone number required to send the OTP.

6.3 Firebase Services (Google LLC)

• Firebase Cloud Messaging (FCM): Your device's push notification token is shared with Firebase to enable the delivery of push notifications. Firebase does not use this token to identify you personally across other services.
• Firebase Analytics: We share anonymised and aggregated usage data with Firebase Analytics to understand how users interact with our app. This data cannot be used to identify you individually.
• Firebase is a service of Google LLC and is governed by Google's Privacy Policy. Google has committed to compliance with applicable data protection laws as a data processor on our behalf.

6.4 KYC & Identity Verification Providers

• For driver onboarding, identity document data may be shared with a regulated third-party KYC verification service. This service acts as a data processor under a binding Data Processing Agreement (DPA) and is prohibited from using your data for any purpose other than identity verification on our behalf.

6.5 Cloud Infrastructure & Hosting

• Your data is hosted on secure cloud infrastructure provided by reputable cloud service providers (e.g., Amazon Web Services, Google Cloud Platform, or equivalent). These providers act as data processors and may store data in data centres located in various jurisdictions. All transfers are subject to appropriate safeguards as described in Section 11 (Cross-Border Data Transfers).

6.6 Vendors (for Customer Orders)

• When you place an order with a vendor on SleeKnit, we share your name, delivery address, and order details with the relevant vendor solely to enable order fulfilment. Vendors are bound by our Vendor Terms of Service and are prohibited from using this data for any purpose other than fulfilling your order.

6.7 Delivery Agents (for Active Deliveries)

• Your name, delivery address, and contact phone number may be shared with the assigned delivery agent for an active order, solely to facilitate successful delivery.

6.8 Legal & Regulatory Authorities

• We may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other governmental authorities if we are required to do so by applicable law, court order, or binding governmental directive.
• We may also disclose data where necessary to protect the legal rights, property, or safety of SleeKnit, its users, or the public.

6.9 Business Transfers

• In the event of a merger, acquisition, restructuring, or sale of all or a substantial portion of our assets, your personal data may be transferred to the acquiring entity as part of the transaction. We will notify affected users in advance via email or in-app notification and ensure that your privacy rights are preserved.

07Data Security & Encryption

In addition to encryption in transit, we implement the following security controls:

• Encryption at Rest: Sensitive personal data stored in our databases — including passwords, identity documents, and financial data — is encrypted at rest using AES-256 or equivalent algorithms.
• Password Hashing: User passwords are never stored in plaintext. They are processed through a one-way cryptographic hashing algorithm (e.g., bcrypt with an appropriate cost factor) before storage, making them unrecoverable even in the event of a data breach.
• Access Controls: Access to personal data is restricted on a strict need-to-know basis. Staff with access to user data are subject to confidentiality obligations and background checks where applicable.
• Authentication & OTP: Vendor and driver accounts require multi-factor authentication via SMS OTP, significantly reducing the risk of unauthorised account access.
• Secure Payments: We do not store raw payment card numbers (PANs), CVV/CVC codes, or full bank account details. Payment processing is handled entirely by PCI DSS-compliant third-party processors, and we store only non-sensitive transaction references.
• Regular Security Audits: We conduct periodic security assessments and vulnerability scans to identify and remediate potential security risks.
• Incident Response: In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authorities and affected individuals in accordance with applicable law (within 72 hours where required by GDPR or equivalent legislation).

While we take all reasonable and commercially appropriate steps to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We therefore cannot guarantee absolute security, and you use the Service at your own risk for matters beyond our reasonable control.

08User-Generated Content (UGC)

SleeKnit allows certain users — primarily vendors — to upload content to the platform, including product images, listing descriptions, and promotional media. In addition, all users may submit support attachments via our help and support channels. The following policies apply to all user-generated content:

8.1 Content You Upload

• You retain ownership of any original content you upload to SleeKnit. By uploading content, you grant SleeKnit a non-exclusive, worldwide, royalty-free licence to store, display, and use that content solely for the purpose of operating and improving the Service.
• You are solely responsible for ensuring that any content you upload does not violate applicable laws, third-party intellectual property rights, or our Community Standards and Vendor Terms of Service.

8.2 Content Moderation & Monitoring

• SleeKnit reserves the right to review, moderate, and — where necessary — remove any user-generated content that violates our policies, including content that is illegal, offensive, deceptive, or harmful.
• We may employ both automated tools (including AI-assisted moderation) and human review processes to monitor uploaded content.
• Content moderation activities are conducted by authorised SleeKnit personnel who are bound by strict confidentiality obligations.

8.3 Support Chat Attachments

• Any images, documents, or files you attach to support enquiries are used exclusively by our customer support team to investigate and resolve your reported issue.
• Support attachments are stored securely and are accessible only to authorised support staff. They are retained for a period consistent with our data retention policy (see Section 13) and are then permanently deleted.
• Please avoid submitting sensitive documents — such as full payment card numbers or government IDs — through general support channels unless specifically instructed to do so in a secure, dedicated flow.

09Location Data

9.1 Customers

• Customers are not required to share real-time GPS location. A delivery address entered manually is used for order routing.
• SleeKnit may use your approximate location (derived from IP address) to suggest relevant local vendors and display applicable currencies. This is not precise GPS tracking.

9.2 Drivers (Active Delivery Tracking)

• Precise GPS location data is collected from delivery drivers only when they are actively logged in to the app in delivery mode and have an accepted active delivery assignment.
• Before location services are activated, the app will display a clear, plain-language consent prompt explaining the purpose, scope, and duration of location collection. You must affirmatively grant permission.
• Location tracking is automatically suspended when a delivery is completed, when the driver goes offline, or when the app is closed.
• Live location data is shared in real time with the assigned customer for the sole purpose of enabling order tracking. It is not shared with any other party.
• Historical location data is retained for a limited period (see Section 13) for dispute resolution purposes and is then permanently deleted.

You can revoke location permissions for the SleeKnit app at any time through your device's operating system settings (iOS: Settings > Privacy & Security > Location Services; Android: Settings > Apps > SleeKnit > Permissions). Revoking location permissions for drivers may limit your ability to accept and fulfil delivery assignments.

10Push Notifications

SleeKnit uses Firebase Cloud Messaging (FCM) for Android devices and Apple Push Notification service (APNs) for iOS devices to deliver notifications related to your account and transactions.

10.1 Types of Notifications

• Transactional (Required): Order confirmations, payment receipts, shipping updates, delivery status alerts, account security notifications (e.g., OTP, suspicious login alerts). These are essential for the functioning of the Service.
• Marketing & Promotional (Optional): Notifications about new products, promotions, vendor spotlights, and platform features. These require your explicit consent via your device's notification permissions.

10.2 Managing Your Notification Preferences

• You can manage and disable marketing push notifications at any time via:
  • Your device settings (iOS: Settings > Notifications > SleeKnit; Android: Settings > Apps > SleeKnit > Notifications)
  • The notification preferences section within the SleeKnit app.
• Please note that disabling all notifications may result in you missing important transactional alerts related to your orders, payments, or account security.

11Cross-Border Data Transfers

SleeKnit operates across multiple regions, including global markets and African countries. As a result, your personal data may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable;
• Data Processing Agreements (DPAs) with all third-party processors that include appropriate data protection obligations;
• Transfers to countries or processors recognised as providing an adequate level of data protection by relevant supervisory authorities;
• Compliance with the requirements of applicable African data protection legislation governing cross-border transfers (e.g., NDPA, POPIA, Kenya DPA).

12Cookies & In-App Tracking Technologies

The SleeKnit mobile application does not use browser cookies. However, we use the following equivalent technologies within the app:

• Local Storage / Secure App Storage: Used to store your login session token, app preferences, and cached data to improve performance. This data remains on your device and is not transmitted unless required for authentication.
• Firebase Analytics SDK: An analytics library embedded in the app that collects anonymised behavioural and performance data. You can opt out of analytics data collection by adjusting your device's advertising settings or by contacting us to opt out at the account level.
• Crash Reporting SDK: Automatically collects technical error logs in the event of an app crash. These logs do not contain personal identifying information.

13Data Retention

We retain your personal data only for as long as is necessary for the purposes for which it was collected, as required by applicable law, or as needed to resolve disputes and enforce our agreements.

Upon the expiry of the applicable retention period, or following a confirmed account deletion request, personal data is securely and permanently deleted or anonymised in accordance with industry-standard data destruction practices.

Please note that certain data may be retained beyond the standard retention period where required by applicable law (e.g., financial transaction records retained for statutory periods) or where the data is necessary to establish, exercise, or defend a legal claim.

14Account & Data Deletion

14.1 How to Delete Your Account & Data

You can submit a deletion request through any of the following methods:

• In-App Deletion (Recommended):
  Navigate to: Profile / Account Settings → Privacy & Security → Delete My Account. Follow the on-screen confirmation steps. Your deletion request will be initiated immediately.
• Web Deletion Form:
  Visit: https://www.sleeknit.com/delete-account and complete the account deletion request form. No login is required if you have lost access to your account.
• Email Request:
  Send a deletion request to support@sleeknit.com from the email address associated with your account, with the subject line: "Account Deletion Request".

14.2 What Happens When You Delete Your Account

• Your account will be deactivated immediately upon confirmation of your deletion request.
• All personal profile data, saved addresses, device tokens, and preferences will be permanently and irreversibly deleted within 30 days of your confirmed request.
• You will no longer be able to log in or access your account, order history, or vendor/driver profile after deletion is completed.
• Any active vendor listings will be automatically unpublished.

14.3 Data Retained After Deletion (Legal Exceptions)

• Transaction and financial records are retained for up to 7 years to comply with applicable tax, accounting, and financial regulatory obligations (e.g., AML/CFT regulations).
• KYC identity documentation for drivers may be retained for up to 5 years after account closure, as required under applicable financial and identity verification regulations.
• Data that forms part of an ongoing legal investigation, dispute, or regulatory enquiry may be preserved until the matter is resolved.
• Where data is retained for legal reasons, it will be isolated from active processing systems, accessible only for the specific legal purpose, and deleted as soon as legally permissible.

We will communicate any applicable retention exceptions to you at the time of your deletion request.

15Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal data. We are committed to honouring these rights in accordance with applicable law:

• Right of Access: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete personal data.
• Right to Erasure (“Right to be Forgotten”): You have the right to request the deletion of your personal data, subject to the exceptions described in Section 14.3.
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transfer it to another service provider.
• Right to Restriction of Processing: You have the right to request that we restrict our processing of your personal data in certain circumstances.
• Right to Object: You have the right to object to the processing of your personal data for direct marketing purposes or where processing is based on our legitimate interests.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting previous processing.
• Right to Non-Discrimination (CCPA): California residents have the right not to be discriminated against for exercising their privacy rights.

To exercise any of these rights, please contact us at support@sleeknit.com. We will respond to all legitimate requests within 30 days (or within the timeframe required by applicable law). We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence (e.g., the Office of the Information Regulator in South Africa; the National Information Technology Development Agency / NITDA in Nigeria; the Office of the Data Protection Commissioner in Kenya).

16Third-Party Links & Services

The SleeKnit app may contain links to third-party websites, vendor storefronts hosted on external platforms, or integrated services (such as payment gateways) that are governed by their own separate privacy policies. SleeKnit is not responsible for the privacy practices, content, or security of any third-party websites or services accessed via our platform.

We encourage you to review the privacy policies of any third-party services you use in connection with SleeKnit, particularly payment providers and mobile money operators.

17Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes to this policy, we will:

• Update the “Last Updated” date at the top of this document;
• Display a prominent in-app notification informing you of the update; and/or
• Send a notification to the email address associated with your account, where the changes are significant.

Your continued use of the SleeKnit Service after the updated Privacy Policy becomes effective constitutes your acceptance of the revised terms. If you do not agree with the changes, you must discontinue use of the Service and may request deletion of your account as described in Section 14.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

18Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws applicable to SleeKnit's principal place of business, without regard to conflict-of-law provisions. Where applicable data protection laws of a user's jurisdiction provide greater protections than those described herein, those laws shall additionally apply to the processing of that user's personal data.

19Contact Us & Data Protection Enquiries

If you have any questions, concerns, or complaints about this Privacy Policy, our data practices, or your personal data rights, please contact our Privacy & Support team using the details below. We are committed to resolving all enquiries promptly and transparently.