Privacy Policy

Last updated: 9 October 2026

1. Who we are

PhoneVault ("we", "us") is software that helps phone dealers in Nigeria manage stock, sales, swaps, repairs, staff and customers. This policy explains what personal data we collect, why, who we share it with, and your rights under the Nigeria Data Protection Act 2023 (NDPA).

2. Two kinds of data, two roles

• Dealer account data (the shop, its owner, login details). For this data, PhoneVault is the data controller. We decide how it is used.
• Data dealers put into PhoneVault about their customers, staff and suppliers. For this data, the dealer is the data controller and PhoneVault is the data processor. We only use it to provide the service to that dealer. If you are a customer of a shop, contact that shop first. We will help them answer you.

3. What we collect

From dealers (shop owners): name, phone number, email address, shop name, market, shop address, business hours, logos, and the password you choose (stored only as a secure hash, never readable).

Business records dealers create: stock (device names, IMEI and serial numbers, cost and selling prices, photos), sales, receipts, swaps and trade-ins, returns, repairs, consignments, transfers, supplier records, expenses and notes.

About a dealer's customers: name, phone number, email, address, purchase and repair history, store credit, notes, and whether they asked not to be contacted.

About a dealer's staff: name, phone, email, login number, role and permissions, salary and commission records, activity logs, and, if the dealer chooses to add them, home address, ID type and number, ID photo, and next-of-kin details.

Device reports: IMEI or serial numbers that dealers or owners report as stolen or lost, with the report details.

Technical data: IP address, device and browser type, login sessions, and error reports when something breaks.

4. Why we use it (and our legal basis)

• To run the service you signed up for: accounts, stock, sales, receipts, staff logins, reports. Basis: contract.
• To keep the network safe: approving dealers, checking IMEIs against stolen/lost reports, preventing fraud, keeping audit logs of money changes. Basis: legitimate interests.
• To send messages you ask for: receipts, alerts, password resets, daily summaries (if you turn them on). Basis: contract.
• Marketing messages from dealers to their customers (campaigns): the dealer must have the customer's permission. Customers marked "do not contact" are skipped. Basis: consent, obtained by the dealer.
• To keep records required by law (for example tax records). Basis: legal obligation.
• To fix problems and improve PhoneVault. Basis: legitimate interests.

We do not sell personal data. We do not show adverts or use advertising trackers.

5. What other dealers can see

PhoneVault is a network, so some information is shared between dealers:

• Stock listings: by default, items in stock (device name, condition, price and your shop's public profile) appear in network search for other dealers. You can set any item to private, or hide your prices. IMEI and serial numbers are not searchable by other dealers.
• Your shop profile: shop name, market, contact number, address and business hours.
• Deals between dealers: both shops see the records of a transfer, consignment or dispute they are part of.
• Stolen/lost device reports: after approval, other dealers are warned if they check or scan a reported IMEI.
• Receipt checks: when someone checks a receipt or IMEI you sold, the lookup is logged and your shop may be notified.

Other dealers never see your customers, staff, cost prices, profits or reports.

6. Backups to your own Google Drive (optional)

A shop owner can choose to connect their Google account so PhoneVault saves a copy of their shop's records to their own Google Drive.

• What we ask Google for: only permission to create files and manage the files PhoneVault itself creates (Google's drive.file access). We cannot see, open or change any other file in your Drive. We also read your Google email address, so the app can show which account is connected.
• What we put there: backup files of your shop's records (stock, sales, customers, repairs, expenses, suppliers and similar), in a "PhoneVault Backups" folder. We delete our own older backup files so only recent copies are kept.
• What we store: an access key from Google, kept encrypted on our servers, so backups can run without you signing in each time. It is used for nothing else.
• Turning it off: disconnect in PhoneVault settings, or remove PhoneVault at myaccount.google.com/permissions. We then delete the access key. Backup files already in your Drive stay yours to keep or delete.

PhoneVault's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google data for advertising, do not sell it, and do not let people read it except where you ask us to help, for security, or where the law requires.

7. Who else we share data with

We use trusted service providers who only process data on our instructions:

• Contabo: servers where the database runs (France, EU)
• Cloudflare R2 and Backblaze B2: photo storage and encrypted backups
• Resend: sending emails (USA)
• BulkSMS Nigeria: sending SMS (Nigeria)
• Meta (WhatsApp Business): sending WhatsApp messages, when a dealer connects their own number
• Google: storing backups in a shop owner's own Google Drive, only if they connect it (see section 6)
• Sentry: error reports so we can fix bugs (USA). We turn off collection of personal details by default

We may also share data if required by law, a court order, or to protect people from fraud or harm. Stolen-device reports may be shared with the police when requested.

8. Data stored outside Nigeria

Some of our providers store data outside Nigeria (see section 7). We only use providers that protect data to a standard at least equal to the NDPA, using contracts and security safeguards, as the NDPA allows.

9. How we protect data

• All connections are encrypted (HTTPS).
• Passwords are stored as secure hashes.
• Each shop's data is kept separate from every other shop.
• Owners control what each staff member can see. Cost prices and supplier details can be hidden from staff.
• Backups are encrypted and stored off-site.
• Money changes are recorded in audit logs.
• Logins expire, and every session ends after at most 90 days.

If a data breach is likely to put people at risk, we will tell the Nigeria Data Protection Commission within 72 hours and tell affected dealers without delay.

10. How long we keep data

• While your account is active, we keep your records so your history, receipts and reports stay correct.
• When you delete something (an item, a customer, a staff member), it disappears from your view immediately. We keep a hidden copy so money records stay accurate and mistakes can be undone.
• When an account is closed, we keep business and money records for up to 6 years for legal and tax reasons, then delete or anonymise them. You can ask us to delete personal data sooner where the law allows.
• Our own backups are automatically deleted within 90 days.

11. Your rights

Under the NDPA you can ask to:

• get a copy of your personal data
• correct wrong data
• delete your data (where we don't have to keep it by law)
• limit or object to how we use it
• receive your data in a portable format
• withdraw consent at any time

Email support@phonevault.pro. We will reply within 30 days. If you are a shop's customer, we may pass your request to that shop, because they control your data. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).

12. Cookies and storage on your device

We use one essential cookie to keep you logged in securely, and your browser's storage to make the app load faster and work with a weak network. We do not use advertising or tracking cookies.

13. Age

PhoneVault is for businesses. Dealer and staff accounts are for people aged 18 or over.

14. Changes

If we make important changes to this policy, we will tell dealers in the app or by email before they take effect.