Privacy Policy

This Privacy Policy applies to both the Mayloo web application at getmayloo.com and the Mayloo Android app. We are committed to handling your information in line with the Nigeria Data Protection Act (NDPA) 2023 and the earlier Nigeria Data Protection Regulation (NDPR).

1. Information We Collect

Account and profile information

When you create a Mayloo account, we collect your name, email address, business name, and business type. If you are invited to a business by its owner, we collect the details needed to create your team member account and assign your role.

Business and operational data

Mayloo stores the data you enter and generate while running your business, including products, categories, inventory levels, stock counts and movements, customers and suppliers, sales, orders, invoices, receipts, purchase orders, payments, expenses, financial accounts, business locations, and product barcodes and images. This business data belongs to you — we process it on your behalf to provide the service.

Subscription and billing information

Paid subscriptions are processed through Google Play Billing and managed via RevenueCat. Mayloo does not collect or store your full card or bank details — those are handled directly by Google. We store your subscription status only, such as whether your plan is active, its renewal date, and which plan you are on.

Usage and diagnostic data

We collect basic usage data such as login times, feature usage, screen views, device and app version information, and crash or error reports to keep the service reliable and improve it. This is handled through PostHog (product analytics and error tracking), and we scrub known sensitive fields from this diagnostic data.

Device permissions (Android app)

The Mayloo app may request the following, always for a specific purpose:

• Camera — used only to scan product barcodes. Barcode scanning runs on your device; camera images are never uploaded to our servers or shared.
• Notifications — used to show you service and business notifications.
• Internet / network access — required to sync your data with our servers.

The Mayloo app does not request or collect your device's GPS/location. The in-app map only displays branch coordinates that you or your business owner have entered manually.

App lock

If you enable the PIN or biometric app lock, your PIN is stored securely on your device only (in the Android Keystore) and your biometric data is handled entirely by your device's operating system. This information never leaves your device and is never sent to Mayloo.

2. How We Use Your Information

We use your information to operate your account and process the data you enter; to provide, maintain, secure, and improve the Mayloo service; to process and manage your subscription; to send important service and transactional notifications (such as low-stock alerts, expiry warnings, and account, security, or billing messages); and to diagnose crashes and understand feature usage so we can fix problems and improve the product. We do not sell, rent, or trade your personal or business information to third parties.

3. Sharing of Information

We do not sell, trade, or rent your personal or business information. We share information only with service providers who help us run Mayloo, and only to the extent necessary for them to perform their services:

• Supabase — secure database and cloud hosting for your data
• Google Play Billing — payment processing for subscriptions
• RevenueCat — subscription management
• PostHog — product analytics and error tracking
• Resend — sending transactional and service emails
• Google Maps — displaying business locations on a map
• Firebase Cloud Messaging (Google) — delivering push notifications

Data you enter is also visible to other members of your business according to the roles and permissions set by the business owner. We may disclose information where required by Nigerian law, regulation, legal process, or a valid government request.

4. Data Storage and Security

Your data is encrypted in transit (TLS) and at rest. We use industry-standard security practices and access controls to protect your business information, and host with reputable cloud providers that maintain strong security certifications. While no method of transmission or storage is completely secure, we take reasonable steps to protect your information against unauthorized access, loss, or misuse.

5. Data Retention

We keep your business and account data for as long as your account is active or as needed to provide the service. You can request deletion of your data at any time. We may retain limited information where required to comply with legal, tax, or accounting obligations, after which it is deleted or anonymized.

6. Your Rights

Under the Nigeria Data Protection Act (NDPA) 2023 and the NDPR, you have the right to access your personal data, request corrections, request deletion, and object to or restrict certain processing. You can export your business data at any time from within the Mayloo app. To exercise any of these rights, contact us using the details below, and we will respond within the timeframes required by applicable law.

7. Children's Privacy

Mayloo is a business tool intended for use by adults (18+) operating a business. We do not knowingly collect personal information from children.

8. International Transfers

Some of our service providers may process data on servers located outside Nigeria. Where this happens, we take steps to ensure your data continues to receive an adequate level of protection consistent with the NDPA.

9. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or through the Mayloo app. Your continued use of the service after changes are posted constitutes your acceptance of the updated policy.

10. Contact

Questions about this privacy policy? Email us at mayloohq@gmail.com.