Privacy Policy

This policy explains what personal data ChipChale collects when you use this site, why we collect it, and the choices you have. It applies to visitors, registered customers, and anyone who contacts us.

We collect the following, depending on how you use the site:

• Account details: name, email address, and password (stored as a salted hash — we never store or see your plain-text password).
• Order details: delivery address, phone number, items purchased, and order history.
• Payment confirmation: we receive confirmation of payment success/failure and a transaction reference from Paystack. We do not receive or store your card number, mobile money PIN, or bank login details — those go directly to Paystack.
• Communications: messages you send us or a store, product reviews, and reports you submit.
• Account security data: sign-in history, device/session metadata, and two-factor authentication status, used to detect suspicious activity and secure your account.
• Technical data: IP address and basic request metadata, used for rate-limiting, fraud prevention, and keeping the site secure.

• To create and secure your account, and to process, fulfill, and deliver your orders.
• To send order, payment, and account-security emails (e.g. password reset, new sign-in alerts).
• To detect and prevent fraud and abuse — some orders are automatically risk-scored using order and account signals before being confirmed.
• To respond to support requests, disputes, and reports you submit.
• To meet legal, tax, and accounting record-keeping obligations.

We do not sell your personal data to anyone.

• Paystack — to process payments. Paystack acts as an independent data controller for the payment details you give it directly.
• Our email delivery provider — to send transactional emails (verification, receipts, security alerts) on our behalf.
• Our hosting and database providers — to run the site and store data securely; they do not use your data for their own purposes.
• Law enforcement or regulators, where we are legally required to disclose information.

We keep your account data for as long as your account is active. Order records are retained after an account is deleted, but with personal details removed, since we have a legal and accounting obligation to keep evidence that a transaction occurred. Security logs and session data are kept only as long as needed for the fraud-prevention and security purposes described above, and are periodically purged.

From your Account > Security page, at any time, you can:

• Delete your account — your personal details are erased; order records are kept without your personal details for legal and accounting reasons, as described above. This cannot be undone.

You can also ask us directly at support@chipchale.com to get a copy of the personal data we hold about you, to correct or delete it, or to ask a question about how it’s used. We will send your copy in a machine-readable format.

Passwords are hashed with a modern, salted algorithm — never stored or transmitted in plain text. Our database provider encrypts stored data at rest, and all traffic to and from the site is encrypted in transit (HTTPS). Administrator accounts are protected by two-factor authentication. No method of storage or transmission is 100% secure, but we take reasonable technical and organizational measures to protect your data.

We use a small number of essential cookies required to keep you signed in and to remember your site preferences (such as light/dark theme). We do not use third-party advertising or tracking cookies.

ChipChale is not directed at children under 18, and we do not knowingly collect data from them.

We may update this policy as our practices or applicable law change. The “Last updated” date above reflects the most recent revision.