Privacy Policy

This Privacy Policy applies to both the Mayloo web application at getmayloo.com and the Mayloo Android app. We are committed to handling your information in line with the Nigeria Data Protection Act (NDPA) 2023 and the earlier Nigeria Data Protection Regulation (NDPR).

1. Information We Collect

Account and profile information

When you create a Mayloo account, we collect your name, email address, phone number, and a password for signing in, along with your business name, business type, business address, and state. If you are invited to a business by its owner, we collect the details needed to create your team member account and assign your role.

Business and operational data

Mayloo stores the data you enter and generate while running your business, including products, categories, inventory levels, stock counts and movements, customers and suppliers, sales, orders, invoices, receipts, purchase orders, payments, expenses, financial accounts, business locations, and product barcodes and images. This business data belongs to you — we process it on your behalf to provide the service.

Subscription and billing information

Paid subscriptions are processed through Google Play Billing and managed via RevenueCat. Mayloo does not collect or store your full card or bank details — those are handled directly by Google. We store your subscription status only, such as whether your plan is active, its renewal date, and which plan you are on.

Usage and diagnostic data

We collect basic usage data such as login times, feature usage, screen views, device and app version information, and crash or error reports to keep the service reliable and improve it. This is handled through PostHog (product analytics and error tracking), and we scrub known sensitive fields from this diagnostic data.

Device permissions (Android app)

The Mayloo app may request the following, always for a specific purpose:

• Camera — used only to scan product barcodes. Barcode scanning runs on your device; camera images are never uploaded to our servers or shared.
• Notifications — used to show you service and business notifications.
• Internet / network access — required to sync your data with our servers.

The Mayloo app does not request or collect your device's GPS/location. The in-app map only displays branch coordinates that you or your business owner have entered manually.

App lock

If you enable the PIN or biometric app lock, your PIN is stored securely on your device only (in the Android Keystore) and your biometric data is handled entirely by your device's operating system. This information never leaves your device and is never sent to Mayloo.

2. How We Use Your Information

We use your information to operate your account and process the data you enter; to provide, maintain, secure, and improve the Mayloo service; to process and manage your subscription; to send important service and transactional notifications (such as low-stock alerts, expiry warnings, and account, security, or billing messages); to send account owners product updates and marketing emails, as described below; and to diagnose crashes and understand feature usage so we can fix problems and improve the product. We do not sell, rent, or trade your personal or business information to third parties.

Product updates and marketing emails

If you own a Mayloo business account, we email you product updates, tips, offers, and other marketing messages. By creating a Mayloo account you agree to this Privacy Policy, which includes receiving these emails until you opt out. For them we use a limited set of account details: your name, email address, business name, business type, the state your business is in, which plan you are on, when your free trial ends, your signup date, and whether you have finished setting up your account.

Every marketing email has an unsubscribe link, and you can also opt out by emailing mayloohq@gmail.com. Opting out stops marketing emails only. We will still send the essential service emails your account depends on, such as password resets, team invitations, and billing receipts. Team members invited to a business by its owner, such as staff and accountants, do not receive marketing emails.

3. Sharing of Information

We do not sell, trade, or rent your personal or business information. We share information only with service providers who help us run Mayloo, and only to the extent necessary for them to perform their services:

• Supabase — secure database and cloud hosting for your data
• Google Play Billing — payment processing for subscriptions
• RevenueCat — subscription management
• PostHog — product analytics and error tracking
• Resend — sending transactional and service emails
• Brevo — sending product updates and marketing emails to account owners. For this, we send Brevo only the owner's name and email address, the business name, business type and state, which plan the account is on, when its free trial ends, the signup date, and whether account setup is complete. Brevo also records whether a marketing email was delivered, opened, or clicked, so that we can measure our emails and honour unsubscribes. We do not send Brevo your products, stock, customers, sales, or financial records, and we do not add invited team members to our marketing list.
• Google Maps — displaying business locations on a map
• Firebase Cloud Messaging (Google) — delivering push notifications

Data you enter is also visible to other members of your business according to the roles and permissions set by the business owner. We may disclose information where required by Nigerian law, regulation, legal process, or a valid government request.

4. Data Storage and Security

Your data is encrypted in transit (TLS) and at rest. We use industry-standard security practices and access controls to protect your business information, and host with reputable cloud providers that maintain strong security certifications. While no method of transmission or storage is completely secure, we take reasonable steps to protect your information against unauthorized access, loss, or misuse.

5. Data Retention

We keep your business and account data for as long as your account is active or as needed to provide the service. You can request deletion of your data at any time. When an account is deleted, we also remove its owner's contact record from our marketing email list. We may retain limited information where required to comply with legal, tax, or accounting obligations, after which it is deleted or anonymized.

6. Your Rights

Under the Nigeria Data Protection Act (NDPA) 2023 and the NDPR, you have the right to access your personal data, request corrections, request deletion, and object to or restrict certain processing. You can export your business data at any time from within the Mayloo app. To exercise any of these rights, contact us using the details below, and we will respond within the timeframes required by applicable law.

You also have the right to opt out of marketing emails, and to withdraw your consent to them, at any time and free of charge. Use the unsubscribe link in any marketing email, or email us using the details below. Opting out does not affect your account or the service emails we send you.

7. Children's Privacy

Mayloo is a business tool intended for use by adults (18+) operating a business. We do not knowingly collect personal information from children.

8. International Transfers

Some of our service providers may process data on servers located outside Nigeria. Where this happens, we take steps to ensure your data continues to receive an adequate level of protection consistent with the NDPA.

9. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will notify you via email or through the Mayloo app. Your continued use of the service after changes are posted constitutes your acceptance of the updated policy.

10. Contact

Questions about this privacy policy? Email us at mayloohq@gmail.com.