Privacy Policy

Silverlight Technologies Limited operates the Priceforte platform (the “Service”). Priceforte is a product and trading name of Silverlight Technologies Limited, not a separately registered company. For the purposes of Nigeria’s Data Protection Act, 2023 (“NDPA”) and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”), Silverlight Technologies Limited is the data controller responsible for your personal data.

We are a remote-first company and do not currently maintain a public office address. You can reach us using the contact details in Section 17. If a dedicated registered business address is published later, it will be added here.

This Policy covers the Priceforte web application, including guest browsing, buyer accounts, the crowdsourcer program, and business and sales-agent (“seller”) accounts under /workspace. It does not cover third-party websites or services we link to or rely on - including Paystack’s own payment pages - which are governed by their own privacy policies.

3.1 Information you provide directly

• Account details: your email address and/or phone number (at least one is required), and a password. We never store your password itself - only a one-way cryptographic hash (argon2) that cannot be reversed to recover it.
• Shopping activity:items on your shopping list, quantities, and the market you’re shopping in.
• Orders and bids:the items, quantities, and market for any order you submit; if you’re a business or sales agent, the prices and terms of any bid you place.
• Business information: your business name, description, operating hours, contact phone number, categories, and market. Once store setup is complete, this profile is shown publicly to buyers - see Section 14 for what stays private even then.
• Crowdsourcer applications and price submissions: the markets you apply to collect prices in, and the prices you submit.
• “Ask Priceforte” conversations: messages you send our AI shopping assistant, and its replies, stored against your account so your conversation history persists. See Section 12.
• Anything you send us directly, e.g. in a support email.

3.2 Information collected automatically

• Device and session data: IP address, browser/user-agent string, an optional device label, and session timestamps (first seen, last seen) - used to keep you signed in securely and to detect suspicious activity such as a stolen or reused login session.
• Guest identifier: if you build a shopping list before creating an account, we set an httpOnly cookie holding a one-way hashed guest identifier (never your raw device ID) so your list can be found and merged into your account once you sign in.
• Cookies and local storage - see Section 15.

3.3 Information collected through specific features

• Crowdsourcer location data:some price-collection links require you to confirm you were physically at the market when you submitted a price. When a link is marked as requiring location tracking, your browser will explicitly prompt you for permission to share your device’s GPS coordinates, and we record that location alongside the submission. We only ever request this for links that require it, and only at the moment you submit - we do not track your location in the background or at any other time.
• Payment data: purchases of Priceforte credits are processed by Paystack, a licensed third-party payment processor. Priceforte never receives or stores your card number, CVV, or banking credentials - Paystack handles those directly. We store only the transaction reference, amount, currency, and status (pending/completed/failed) needed to credit your wallet and keep financial records.
• AI-assisted features:“Ask Priceforte” and AI-assisted price recommendations send the text you type, and product data returned from our own catalog search, to Google’s Gemini models to generate a response. See Section 12 for how we limit what the AI can act on.

3.4 Information about businesses and agents

If you’re invited to represent a business as a sales agent, we record the invitation, its status (invited/active/revoked), and, once accepted, your link to that business. If you apply naming a business you claim to represent, our team reviews that claim before linking your account to it.

We use personal data to:

• Create and secure your account, and authenticate you - including detecting and shutting down stolen or reused login sessions;
• Operate the marketplace: build and price your shopping list, create and track orders, run the bidding process, and let sellers manage inventory and pricing;
• Operate the crowdsourced price-collection program, including scoring submissions for accuracy against other submissions in the same market and time window;
• Process credit purchases and maintain an accurate, auditable ledger of your credit balance;
• Send transactional communications: verification codes/links, order and bid updates, wallet notifications, and responses to support requests;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Maintain internal audit logs of privileged actions taken on your data by our own staff, so every access is accountable;
• Produce aggregated, internal business analytics (e.g. order volume, bidding activity, crowdsourcing coverage per market) for our own operations - not sold or shared externally;
• Comply with legal, tax, and regulatory obligations.

We do not use your personal data to serve third-party advertising, and we do not sell your personal data. If you accept analytics cookies (Section 15), we use Google Analytics to understand how the Service is used in aggregate - which pages are visited, how people found us, and which locale or market they’re browsing in - never to build an advertising profile of you individually.

Where the GDPR or a similar law applies to you, we rely on:

• Contract- to create your account and provide the Service you’ve asked for (lists, orders, bids, inventory tools);
• Consent - for optional features such as sharing your device location for a crowdsourcer submission, for analytics cookies (Section 15), and for any marketing communications you opt into;
• Legitimate interests - for fraud prevention, service security, and internal analytics - balanced against your rights, and never for a purpose incompatible with why the data was collected;
• Legal obligation - for financial record-keeping, responding to lawful requests, and regulatory compliance.

Under the NDPA, we process personal data on the equivalent bases of consent, contractual necessity, legal obligation, and legitimate interest.

We share personal data only with:

• Paystack, to process credit purchases (Section 3.3);
• Google (Gemini API), to power AI-assisted features (Section 3.3, Section 12);
• Google (Analytics), to measure aggregate site usage - only if you’ve accepted analytics cookies (Section 15);
• Infrastructure providers who host our application, database, and email delivery on our behalf, strictly as data processors acting on our instructions;
• Nigerian regulators, courts, or law enforcement, where we are legally required to disclose information;
• A successor entity, if Priceforte or Silverlight Technologies Limited is ever involved in a merger, acquisition, or sale of assets - subject to that entity assuming the commitments in this Policy.

Any processor we share personal data with is contractually and technically restricted to using it only for the purpose we specify, and is not permitted to sell it or use it for their own purposes.

Sellers never receive your identity as a buyer through the bidding process - see Section 14.

Some of our processors - including Google (Gemini, Analytics) and Paystack - may process data outside Nigeria. Where we transfer personal data internationally, we take reasonable steps to ensure it continues to receive an appropriate level of protection, consistent with the NDPA’s cross-border transfer requirements and, where applicable, GDPR Chapter V.

We keep personal data only as long as necessary for the purposes described in this Policy:

• Account data is retained while your account is active. You may request deletion at any time (Section 10).
• Session and refresh-token records secure your account and are invalidated immediately on logout, password reset, or detected token reuse.
• Records used to safely retry a payment or write action are automatically purged after roughly 48 hours.
• A crowdsourcer’s permission to submit prices in an approved market expires automatically after 365 days unless renewed.
• Financial and order records are retained as long as required for accounting, tax, and dispute-resolution purposes.
• Audit logs of privileged administrative actions are retained to preserve accountability and are not deleted on request, since they document actions taken by our staff, not by you.

Where we no longer need personal data for these purposes, we delete or anonymize it.

We apply the following safeguards as standard practice:

• Passwords are hashed with argon2 and never stored or logged in plain text.
• Session refresh tokens and verification codes are stored only as one-way hashes, never in raw form; a stolen or reused refresh token triggers automatic revocation of the entire session family.
• All traffic to Priceforte is encrypted in transit (HTTPS/TLS).
• Access to personal data by our own staff is governed by role-based permissions, and privileged actions are recorded to an audit log with before/after detail and a stated justification.
• Payment webhook messages from Paystack are cryptographically verified against the raw request before we trust them.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify the appropriate regulator and affected users without undue delay, consistent with our obligations under the NDPA.

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Request deletion of your data (“right to be forgotten”), subject to our legal retention obligations (Section 8);
• Object to, or request restriction of, certain processing;
• Request a portable copy of the data you provided us, in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent (this won’t affect processing already carried out before you withdrew it);
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC), or, where GDPR applies to you, your local supervisory authority.

To exercise any of these rights, contact us using the details in Section 17. We aim to respond within 30 days, and may need to verify your identity before acting on a request.

Priceforte’s AI features (the “Ask Priceforte” assistant and AI-assisted price recommendations) are advisory only. They never place an order, submit a bid, or make any decision with a legal or similarly significant effect on you without your own action - you always choose whether to add a suggested item to your list, and a human buyer or seller always makes the final call on any order or bid.

We do not intentionally collect “special category” data such as health, religious, political, or biometric information. Our “Ask Priceforte” chat is free text, so please avoid volunteering sensitive personal details there or in any other free-text field - anything you type is stored against your account and sent to our AI provider (Google Gemini) to generate a response. The assistant is restricted to recommending products it has actually found in our own catalog search - it cannot invent a product, price, or store, and any suggestion that fails that check is discarded before it ever reaches you.

Priceforte is not directed at children. You must be at least 18 years old, or the age of majority where you live, to create an account, place an order, or operate a business/agent account. We do not knowingly collect personal data from children.

By design, a business bidding on your order never sees who you are - the bidding queue and bid composer show only what a seller needs to decide whether to bid (items, quantities, market), never your identity. Your contact details are visible only to Priceforte staff acting under a permissioned, audited administrative role, for support, moderation, or dispute-resolution purposes.

15.1 Necessary cookies (always on)

Functionally required to operate the Service:

• An authentication/session cookie (httpOnly, Secure, restricted to same-site requests);
• A hashed guest-list identifier cookie, set only once you add your first item as a guest;
• Your language and market-selection preferences;
• A record of your cookie-banner choice, stored on your device.

15.2 Analytics cookies (only if you accept)

We use Google Analytics to understand aggregate site usage - which pages are visited, how visitors found us, and general location and device information. Google Analytics only loads, and only sets its own cookies, after you choose “Accept all” in the cookie banner; choosing “Necessary only” means it never loads at all. We have not enabled Google’s advertising features (such as remarketing or ads personalization) on this property, and we do not use Google Analytics to show you ads. Google’s own handling of this data is governed by Google’s Privacy Policy.

To change your choice later, contact us (Section 17) and we’ll reset it for you. We do not use any third-party advertising cookies.

We may update this Policy from time to time. We’ll revise the “Last updated” date above, and where a change is material, we’ll take reasonable steps to notify you - e.g. on the platform or by email - before it takes effect.

Questions, requests, or complaints about this Policy or your personal data can be sent to nnoromifeanyi@gmail.com. This inbox is our privacy contact until a dedicated address is published here.