Privacy policy

KERUX8 AGENCY LIMITED (CAC registration number RC 9701590) is the data controller for Plug. You can reach us at hello@kerux8.com or at 156 Ijegun Ikotun Road, Lagos, Nigeria.

If you are a shopper, we collect:

• Your WhatsApp phone number. We receive it automatically when you message us. It is how we identify you across requests — you never create an account.
• The text of what you ask for, including anything else you type into the chat.
• The area of Lagos you give us, so we can match you to nearby vendors. We do not collect GPS or device location.
• Records of orders placed through escrow: the amount, the item, the vendor, and the status of the order.

If you are a vendor, we also collect:

• Your business name and trading address.
• Identity verification. To be listed you give us your National Identification Number (NIN) and take a short selfie. For vendors handling orders from ₦50,000 we also verify a BVN and check that your payout account name matches your verified identity. We pass these to a NIMC-licensed verification provider and we do not store your NIN or BVN. We keep only the result of each check and the provider’s reference number — enough to prove the check happened, and nothing an attacker could use.
• Your CAC registration number, if you have one. It is optional and it is not required to be listed.
• Your Instagram handle and a description of how you currently sell, if you give them.
• Your response times, quote history and dispute record, which we use to decide who receives requests.

We do not collect your bank details or card details. Payment information is handled entirely by our payment and escrow providers and never reaches our systems.

• To match you with a vendor — necessary to perform the service you asked us for (NDPA s.25(1)(b)).
• To run escrow orders and resolve disputes — necessary to perform the contract, and to establish or defend a legal claim.
• To verify vendors and remove bad actors — our legitimate interest in running a service that buyers can trust.
• To measure how the service is used in aggregate — our legitimate interest in improving it. We count page views on our own server; we do not use third-party advertising or tracking cookies.

We do not sell your data, and we do not use your request text to advertise to you or to anyone else.

• The vendors we match you with. A vendor receiving your request sees what you asked for and your area. Once you choose to contact a vendor, they see your WhatsApp number, because you are messaging them directly.
• Meta Platforms, Inc. All messaging happens over the WhatsApp Business Platform, so Meta processes your messages as part of delivering them. Their handling is governed by Meta’s own privacy terms.
• Our escrow provider, a licensed third party, for orders where funds are held. They receive the order amount and the phone numbers of the buyer and vendor so they can hold and release funds.
• Our identity verification provider, a NIMC-licensed aggregator, for vendors only. They receive the NIN, selfie and (where applicable) BVN you submit in order to run the check, and return the result to us.
• Our payment processor, for vendor subscription billing only.
• Our hosting and infrastructure providers, who store the data on our behalf and may not use it for anything else.
• Law enforcement or regulators, where we are legally required to disclose.

Some of these providers operate servers outside Nigeria. Where data is transferred abroad we rely on the transfer conditions in Part IX of the NDPA.

• Request text and matching records: 12 months from the date of the request, then deleted.
• Order and escrow records: 6 years from completion. We are required to keep transaction records, and they are the evidence used to settle any dispute.
• Dispute records: 6 years from resolution, for the same reason.
• Vendor verification results: the outcome of each check and the provider reference, for as long as the vendor is on the platform and 12 months after removal. The NIN and BVN themselves are never stored, so there is nothing to delete.
• Handover codes: never stored in readable form at all. We store only a cryptographic hash, and we never send your code to a vendor.

Under the NDPA you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data. We will do this except where we are required to keep order or dispute records.
• Stop using your data for a particular purpose, or object to our use of it.
• Withdraw your consent, where we relied on consent.

To make any of these requests, email hello@kerux8.com from a message that lets us match you, or message us on WhatsApp from the number you used. We will respond within 30 days. We may ask you to confirm your identity first, so that someone else cannot request your data.

To stop receiving messages entirely, reply STOP to any of our WhatsApp messages.

If you think we have handled your data wrongly, tell us first at hello@kerux8.com. You also have the right to complain to the Nigeria Data Protection Commission.

Plug is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete their data.

If we change this policy we will update the date at the top of the page. If the change is significant, we will tell you on WhatsApp before it takes effect.