Last updated: June 2026 · Aligned with the Nigeria Data Protection Act (NDPA) 2023 (which superseded the earlier NDPR framework) and applicable Nigerian privacy law.
This Privacy Statement explains how MagnusOP ("we", "us") collects, uses, stores, shares, and protects personal data when you use MagnusOP.com and related services (the "Platform"). It is written in plain language as required by the NDPA. Use of the Platform is also governed by our Terms of Service.
Data controller & contact
Data controller: MagnusOP (operator of the Platform).
Privacy accountability: MagnusOP Operations Team (privacy lead for NDPA compliance).
Privacy contact: support@magnusop.com
Response time for data subject requests: within 30 days of a verified request, unless law requires a different period or we notify you of an extension.
Who this applies to
- Traders — merchants with a MagnusOP account (inventory, sales, CRM, online stores).
- Store shoppers — people who browse or buy from a trader's public store, including optional shopper accounts on premium stores.
- Visitors — anyone viewing a public storefront or landing page.
The NDPA applies to processing of personal data of natural persons in Nigeria and Nigerian citizens abroad. Business-only data about companies (not individuals) is outside personal-data scope.
Traders and their customers: When you add customer names and phone numbers to MagnusOP, you are typically an independent data controller for that CRM data. MagnusOP acts as a data processor providing the tool. You must treat customer data lawfully (see Traders: customer phone numbers).
What constitutes your consent
We rely on consent where you make a clear choice, including:
- Creating a trader account and actively agreeing to this Privacy Statement and Terms of Service at registration (unchecked consent checkbox).
- Optionally creating a store shopper account (email, password, or Google sign-in where enabled).
- Submitting checkout details on an online store (necessary to fulfill your order).
You may withdraw consent at any time where processing is consent-based — e.g. delete your shopper account, unpublish your store, or request account deletion. Withdrawal does not affect processing that was lawful before withdrawal. Service features that require certain data may no longer work after withdrawal.
Personal data we collect
Trader accounts
- Identity & contact: name, email, password (hashed), optional profile image
- Business: business name, type, slug, tagline, bio, WhatsApp number, store settings
- CRM: customer names, phone numbers, optional emails and notes you enter
- Transactions: sales, inventory events, store orders, payment references
- Configuration: Paystack API keys you provide for your storefront
- AI usage: conversation history tied to your trader account
Store shoppers
- Name, email, authentication method (email/password or Google)
- Wishlist items per store
- Checkout: name, email, phone on orders
Technical data
- IP address, browser/device type, session identifiers
- Security and application logs
Purposes & legal basis (NDPA)
| Purpose | Typical legal basis |
|---|---|
| Provide the Platform (inventory, sales, reports, stores) | Contract / legitimate interest |
| Authenticate users and prevent fraud | Legitimate interest / legal obligation |
| Process store payments via Paystack | Contract |
| Service emails (e.g. password reset) | Contract / consent |
| Reorder reminders you enable for your customers | Your consent / customer relationship (trader as controller) |
| Comply with law and respond to regulators | Legal obligation |
We do not sell personal data. We do not use trader or shopper data for unrelated third-party marketing.
Cookies, sessions & storage
We use technical methods to operate the Platform, including:
- Session cookies — trader login (Better Auth) keeps you signed in securely.
- Separate shopper cookies — premium store customer accounts use a different cookie prefix so shopper sessions do not mix with trader sessions.
- Server-side storage — account, business, and order data in encrypted PostgreSQL databases.
- Theme preference — local display settings where applicable.
We do not use third-party advertising cookies on the Platform. You can clear cookies in your browser; you will need to sign in again.
Third-party access
- Paystack — payment initialization and verification for store checkout and platform fees.
- Google — optional shopper sign-in only, if enabled by the platform operator.
- Hosting & database providers — e.g. cloud infrastructure to run the app, under data-processing terms.
- Email delivery — transactional messages (password reset, notifications).
- Legal & safety — when required by law, court order, or to protect users from fraud or harm.
Traders who export customer numbers to WhatsApp or other apps are responsible for those apps' privacy practices.
NDPA data protection principles
We process personal data in line with NDPA principles, including:
- Lawfulness, fairness, transparency — this statement and in-product notices
- Purpose limitation — data used for stated purposes only
- Data minimisation — collect what is needed to run the service
- Accuracy — you can update profile and business data in Settings
- Storage limitation — retention policy below
- Integrity & confidentiality — security measures below
- Accountability — documented processes and contact for requests
Your rights under the NDPA
Subject to the NDPA, you have the right to:
- Access — know what personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion in certain circumstances
- Restrict processing — in limited cases
- Data portability — receive your data in a usable format where applicable
- Object — to processing based on legitimate interest, including direct marketing
- Withdraw consent — where processing is consent-based
- Lodge a complaint — with us or with the regulator
To exercise rights, email support@magnusop.com with enough detail to verify your identity. See Data deletion process for step-by-step instructions.
How long we keep data
- Active trader accounts — while you use the Platform and as needed afterward for backup, disputes, or legal duties.
- Store orders — for fulfillment, trader records, and legal requirements; traders may need order history for tax and customer support.
- Shopper accounts — until you delete them or they are inactive and removed per our deletion process.
- Payment references — retained as required for financial and audit purposes.
- Security logs — typically up to 12 months for fraud investigation, then deleted or anonymised where feasible.
- Deleted trader accounts — removed within 90 days of a verified deletion request, except records we must keep by law.
Security measures
- HTTPS encryption in transit
- Password hashing; optional two-factor authentication for traders
- Multi-tenant isolation — each trader only accesses their own data
- Rate limiting on authentication endpoints
- Access controls for admin and support functions
No online system is 100% secure. Use a strong unique password and enable 2FA in Settings.
Cross-border transfers
Our infrastructure providers may process data outside Nigeria (for example in the EU or US). Where this occurs, we rely on contractual safeguards and provider security standards consistent with NDPA requirements for lawful transfer.
Personal data breaches
If we become aware of a breach likely to affect your rights, we will investigate promptly, take steps to contain harm, notify affected users where required, and report to the Nigeria Data Protection Commission (NDPC) and other authorities as required by law.