Privacy Policy
Shop Book by · Effective 22 September 2026
The short version
- We keep your shop records so you never lose them. That is the only reason we hold them.
- Only your shop can see your shop's records. Our staff look at them only when you ask for help, or when the law requires it.
- We never sell your data, never show you adverts, and never use your records to compete with you.
- You can ask for a copy of your data, ask us to correct it, or ask us to delete it, at any time.
- Questions? See Contact us at the bottom.
1. Who we are
Shop Book is provided by , ("we", "us").
This policy explains what information Shop Book collects, why, where it is kept, and your rights under the Nigeria Data Protection Act 2023.
Our two roles
- For your account (your name, phone number and subscription), we decide how the information is used. We are the data controller.
- For your shop records (sales, stock, spending, and your customers' and suppliers' names), you decide what goes in. We only store it for you, following your instructions. You are the data controller and we are your data processor.
2. What information we collect
About you and your staff
- Shop name, owner's name and phone number. The phone number is your login.
- Staff names and phone numbers, if you ask us to create staff logins.
- Your PIN. It is stored scrambled (hashed), so nobody, including us, can read it. The phone also keeps a scrambled copy so the app lock works without network.
- Subscription details: dates paid for, amounts paid, and notes we keep about your shop, such as your market or shop number.
Your shop records
- Items, quantities, cost prices and selling prices.
- Sales, purchases, stock counts, damaged or missing goods, spending and regular costs.
- How each sale was paid (cash, transfer or POS). We do not collect bank account or card numbers.
- Which login made each record and when, so you can see which staff member recorded a sale.
About your customers and suppliers
- Names and, if you choose to type them, phone numbers of customers who buy on credit, and names of suppliers you owe.
- These are only stored when you type them in. They are used only to show you who owes what.
Technical information
- A short random code for each phone or laptop, so we know which device sent a record.
- Our hosting providers automatically record basic connection details, such as IP address and time, to keep the service secure. They keep these for a short time.
What we do NOT collect
We do not collect your location, contacts, photos or messages. We do not use advertising or tracking cookies.
3. Why we use it, and our legal reasons
| What we do | Legal reason |
|---|---|
| Create your login, store your records and copy them between your devices | To provide the service you signed up for (contract) |
| Manage your subscription, send renewal reminders, and pause saving online when it ends | Contract |
| Help you when you call us, for example reset a PIN or recover records | Contract, and your request |
| Keep backups, block misuse, and investigate problems | Legitimate interest in keeping the service safe and working |
| Keep payment records and respond to lawful requests | Legal obligation |
We will ask for your permission first before we use your information for anything else.
The app does not make automatic decisions about you that have legal or similarly serious effects. Advice such as "prices need to go up" is only a calculation to help you.
When we may share information
- With the authorities, only when Nigerian law requires it, such as a valid court order. Where we are allowed to, we will tell you first.
- If Blestonex is sold or merged, your information would pass to the new owner under this same policy, and we would tell you.
4. What we never do
- We never sell or rent your information.
- We never show adverts, or give your data to advertisers.
- We never contact your customers or suppliers.
- We never share one shop's records with another shop.
- We never use your sales figures for our own trading.
5. Where your information is kept, and who helps us
- On your phone or laptop: a copy of your records, so the app works without network.
- Supabase: our online database and login service, where your records are saved. Their servers are in the region.
- Cloudflare: delivers the app to your browser. It does not store your shop records.
- GitHub: keeps our weekly backup copy. The backup is encrypted before it is stored there, so GitHub cannot read it.
- Google Fonts: supplies the lettering the app uses. Google sees that a device loaded the lettering, but none of your records.
- WhatsApp: only used when you tap to send a receipt, reminder or report. That message is then handled by WhatsApp under its own privacy policy.
Storage outside Nigeria
Some of these services keep data on servers outside Nigeria. We only use providers that protect data with strong security, including encryption while data travels and while it is stored. They are bound by their own contracts to protect it. We rely on these safeguards as the Nigeria Data Protection Act 2023 allows.
6. How long we keep it
- While your subscription is active or paused: we keep all your records, so nothing is lost if you renew late.
- After you close your account: we keep your records for 12 months in case you return or need a copy, then we delete them. You can ask us to delete them sooner.
- Payment records for your subscription are kept as long as Nigerian tax and accounting laws require.
- Backups: old copies are replaced automatically within 90 days.
- Removed records: when you tap "Remove" on a record, it stops counting everywhere but is kept, marked as removed. This lets all your devices agree, and stops sales from quietly disappearing. If you want a record erased completely, ask us.
7. How we protect it
- Every connection to our servers is encrypted.
- Security rules inside the database make sure a login can only reach its own shop. This cannot be switched off from the app.
- PINs are stored scrambled. Staff logins cannot see profit, change prices or remove records.
- Only named Blestonex staff can open the admin tools, and only with their own passwords.
- Weekly encrypted backups are kept separately from the main database.
- You can turn on "Ask for my PIN when the app opens" to protect a shared phone.
Please keep your PIN secret, and do not sign in on a phone you do not trust. If you think someone knows your PIN, call us and we will change it.
8. Your rights
Under the Nigeria Data Protection Act 2023 you can:
- Get a copy of your information. You can download all your records yourself: go to More → Download all records.
- Correct anything that is wrong.
- Delete your information, or ask us to erase particular records completely.
- Take your data elsewhere in a common format. The download is a spreadsheet file.
- Object to, or ask us to limit, how we use your information.
- Withdraw permission you have given us, at any time.
- Complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you are not happy with how we handle your data.
To use any of these rights, contact us (details below). We will reply within 30 days, and usually much sooner. We may ask you to confirm you are the account holder before we act.
9. If you are a shop owner: your customers' information
When you type a customer's name or phone number into Shop Book, you are responsible for that information. Please:
- Only record what you need, such as a name and phone number for credit.
- Tell customers you keep a record of what they owe. For example, you can say or display: "We record credit sales, with your name and phone number, in our shop book, only to keep track of what is owed."
- Use their phone number only to remind them about their own balance.
- Tell us if a customer asks for their details to be removed, and we will help you erase them.
If you are a customer or supplier and a shop has written your name or phone number in Shop Book, please ask that shop first, because the shop controls its records. If you cannot reach the shop, contact us and we will help.
10. If something goes wrong
If there is ever a security problem that puts your information at risk, we will:
- act quickly to stop it
- tell the Nigeria Data Protection Commission within the time the law requires (72 hours where it applies)
- tell affected shops without delay, including what happened and what to do
11. Children
Shop Book is for businesses and their adult staff. It is not meant for anyone under 18, and we do not knowingly collect children's information.
12. Changes to this policy
If we change this policy, we will update the date at the top. For important changes, we will also tell shops in the app or by phone before the change takes effect.
13. Contact us
©