Legal
Privacy Policy
Last updated: July 2025. This policy explains what personal data CAFLES Limited collects, why we collect it, how we use it, and your rights in relation to it.
1. Who Controls Your Data
CAFLES Limited, operating from Irrua, Edo State, Nigeria, is the data controller for all personal information collected through cafles.com and its associated services. We are responsible for how your data is collected, stored, used, and protected.
If you have any questions or concerns about how we handle your personal data, contact us directly at support@cafles.com. We take privacy seriously and will respond to all legitimate enquiries promptly.
2. What Data We Collect
We collect the following categories of personal data:
Account Information
Full name, phone number, and email address (for users who sign in with Google). Phone number is used as the primary identifier for accounts created via OTP login.
Order Information
Your delivery address, contact number provided at checkout, the items ordered, order total, payment method used, order status history, and timestamps for each order placed.
Location Data
When you use location-based features on our platform, we may collect your approximate or precise device location to assist with delivery address selection or to confirm you are within our delivery area. Location access is requested explicitly and you may decline it without affecting your ability to order.
Financial Activity
Your CAFLES Pay wallet balance, top-up history, transaction history, points balance, cumulative spend, and loyalty tier. We do not store card numbers, CVV codes, or any raw card data. All card payments are processed by Paystack and we only receive a payment reference and confirmation of success or failure.
Device and Usage Data
Your device type, browser type, IP address, pages visited on our platform, and general interaction patterns. This data is collected automatically when you use the platform and is used for security, performance monitoring, and improving the service.
Communications
If you contact us at support@cafles.com, we retain the content of that communication and your contact details for the purpose of responding to your enquiry and maintaining a record of our interactions.
3. Why We Collect Your Data
We collect and process your personal data only for specific, legitimate purposes:
To process your orders
Your name, contact number, and delivery address are necessary to fulfil your order and ensure it reaches you.
To manage your account
Your account information allows you to log in, view order history, manage your wallet, and earn and redeem loyalty points.
To process payments
Your payment details are passed securely to Paystack. We retain only the confirmation and reference number.
To send order notifications
We use Termii to send SMS updates about your order status to the phone number on your account or provided at checkout.
To send email notifications
For users with an email address on their account, we send order confirmations and updates via Resend.
To operate CAFLES Advantage
Your order history and spend are used to calculate your points balance and loyalty tier.
To improve our service
Aggregated and anonymised usage data helps us understand how the platform is used and where we can improve.
To protect against fraud
We monitor for unusual account activity, suspicious payment patterns, and abuse of our dispute or refund process.
To comply with legal obligations
We may retain certain data as required by Nigerian law, including financial records for tax and regulatory purposes.
4. Who We Share Your Data With
We do not sell, rent, or trade your personal data to any third party for marketing or commercial purposes. We share data only where strictly necessary to provide our services:
Paystack
Payment processing. Your card details are submitted directly to Paystack and are never seen or stored by CAFLES Limited. Paystack operates under CBN licensing and PCI DSS compliance.
Termii
SMS delivery. Your phone number is passed to Termii solely to send order status notifications. Termii does not retain your data beyond what is required for message delivery.
Resend
Email delivery. Your email address is used solely to send transactional emails such as order confirmations. No marketing emails are sent without your consent.
Supabase
Database and authentication. Your account and order data is stored on Supabase infrastructure hosted in the EU (Frankfurt). Supabase is GDPR-compliant and operates under strict data processing agreements.
Vercel
Platform hosting. Our website runs on Vercel infrastructure. Vercel may process request data including IP addresses as part of standard hosting operations.
Delivery staff
Your name, contact number, and delivery address are shared with our delivery riders for the sole purpose of completing your order.
We may also disclose your personal data if required to do so by law, court order, or regulatory authority in Nigeria, or where we believe in good faith that such disclosure is necessary to protect the rights, safety, or property of CAFLES Limited, our customers, or the public.
5. How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:
Account data
Retained for as long as your account is active. If you request account deletion, we will delete or anonymise your personal data within 30 days, except where retention is required by law.
Order history
Retained for a minimum of 7 years as required for financial and tax record-keeping purposes under Nigerian law.
Payment records
Transaction references and confirmation records are retained for 7 years. Raw card data is never stored.
Location data
Not retained beyond the active session in which it is used. We do not build location history profiles.
Communications
Support emails and dispute records are retained for 2 years from the date of last communication.
Device and usage data
Anonymised aggregated data may be retained indefinitely for analytics. Identifiable device data is retained for no more than 12 months.
6. How We Protect Your Data
We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure:
All data transmission between your device and our platform uses HTTPS encryption.
Our database is hosted on Supabase with row-level security policies that ensure each user can only access their own data.
Admin access to the platform is protected by multi-factor authentication using a time-based one-time password (TOTP).
Payment data never passes through our servers — it goes directly from your browser to Paystack.
Staff accounts have role-based access controls limiting what each staff member can view or modify.
We conduct regular reviews of our security practices and access controls.
No system is completely immune to security risks. In the event of a data breach that affects your personal data, we will notify you as soon as reasonably practicable and take immediate steps to contain and investigate the breach.
7. Cookies and Tracking
Our platform uses essential session cookies to maintain your login state and shopping cart. These cookies are strictly necessary for the platform to function and do not require your consent.
We do not use third-party advertising cookies, tracking pixels, or behavioural profiling tools. We do not sell your browsing behaviour or purchase history to advertisers or data brokers. CAFLES products are ad-free and your data is not used to serve you advertising.
We may use anonymised analytics to understand how our platform is used in aggregate — for example, which pages are most visited or where users encounter errors. This data cannot be used to identify you individually.
8. Your Rights
As a user of our platform, you have the following rights in relation to your personal data:
Right to access
You may request a copy of the personal data we hold about you at any time. We will provide this within 30 days of your request.
Right to correction
If any of your personal data is inaccurate or incomplete, you may request that we correct it. You can update most information directly through your account settings.
Right to deletion
You may request that we delete your personal data. We will comply where we are not legally required to retain it. Note that deleting your account does not entitle you to a refund of your wallet balance.
Right to restrict processing
You may request that we limit how we use your data while a dispute or concern is being investigated.
Right to data portability
You may request a copy of your data in a structured, machine-readable format.
Right to object
You may object to any processing of your data that is not strictly necessary for us to provide our service to you.
To exercise any of these rights, contact us at support@cafles.com with the subject line "Data Rights Request" and clearly describe your request. We will verify your identity before processing any request that involves accessing or modifying your data.
9. Children's Privacy
Our platform does not knowingly target or collect data from children under the age of 13. If you are a parent or guardian and believe your child has provided us with personal data without your consent, please contact us at support@cafles.com and we will take steps to delete that information promptly.
10. Third-Party Links
Our platform may contain links to third-party websites or services. This Privacy Policy applies solely to cafles.com. We are not responsible for the privacy practices of any third-party site and encourage you to review the privacy policy of any site you visit through a link on our platform.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The updated policy will be posted at cafles.com/privacy with a revised effective date.
Where changes are material — for example, if we begin collecting a new category of data or sharing data with a new category of third party — we will notify active users via the platform or by the contact method on their account before the changes take effect. Continued use of the platform after changes are posted constitutes acceptance of the revised policy.
12. Governing Law
This Privacy Policy is governed by the laws of the Federal Republic of Nigeria. Any disputes arising in connection with this policy shall be subject to the jurisdiction of the courts of Edo State, Nigeria. Where applicable, we also recognise the principles of the Nigeria Data Protection Regulation (NDPR) issued by the National Information Technology Development Agency (NITDA).
13. Contact
For any privacy-related questions, data rights requests, or concerns about how we handle your personal data, contact us at:
© 2025 CAFLES Limited. All rights reserved.
Terms & Conditions →