Privacy policy

1. Visiting the site without an account

You can browse products, compare and contact a seller without an account. To show sellers how many people see their products and to improve the site, we count in our own database the pages viewed, the clicks on “Contact on WhatsApp” and “Call”, and the shares.

To avoid counting the same person twice, each visit gets a code computed from your IP address and your browser with a secret key that changes every day. Neither the address nor the browser is stored, and yesterday’s code cannot be linked to today’s: nobody can follow you from one day to the next. These raw counts are deleted after 90 days; only daily totals (with no personal data) are kept.

The words you search for are recorded with the number of results, without any link to you (no account, address or visit code), to improve the search, and deleted after 180 days.

Like any web server, ours receives your IP address and technical information about your browser. They appear in our technical logs, used for security and troubleshooting, and kept for at most 30 days.

2. Your account

When you create an account, we record:

• your name, your email address and your password, in an irreversible hashed form (we cannot read it);
• if you sign in with Google: your name, your email address and your Google account identifier, which Google sends us; we receive nothing else from your Google account;
• your preferred language (French or English), when the account was created and when you last signed in;
• what you do with your account: saved products, followed shops, reports sent, notifications received.

3. Emails we send

We only send emails about your account or your shop: address confirmation, password reset, decisions about your shop, a listing removed or about to expire, the answer to a proposal. No advertising emails. Emails are written in your preferred language.

4. Sellers: your shop and your number

Your shop’s name, city, description, logo, banner and WhatsApp or phone number are public: this is how buyers find and contact you. The number is stored in international format (for example +237…). It appears in the contact buttons of your product pages and in search engines.

To verify this number, you send us, from your WhatsApp, a message containing the code shown in your seller area, to Nopalaba’s number. We then receive your number and that message, as with any WhatsApp message; WhatsApp (Meta) processes it under its own policy.

Verification ends with a short WhatsApp video call. The call is neither recorded nor captured in images. We keep only the verification level (number verified, call done), its date, the team member who did it and a short note.

We never ask for or keep identity documents. If an extra check is needed for a doubtful case (for example a photo of your stock with the code written on paper, or a link to your Facebook page), the photo is deleted after the decision.

5. Photos and published content

Product photos, logos and banners are stored on a file storage service at our hosting provider, in a public space: anyone with a photo’s link can see it, as with any image on a website. Do not put personal information on your photos. Photos are resized and compressed; the technical data embedded by your device (location, date) is removed.

6. Cookies and storage in your browser

Nopalaba only uses what the site needs to work, nothing for advertising or tracking:

• a sign-in cookie, unreadable by scripts, while you are signed in, and a small “signed in” cookie that tells the site to load your account area;
• a security cookie (anti-forgery token) that protects forms against requests sent without your knowledge by another site;
• a cookie that remembers your country and language for one year, for your next visits;
• the list of products you are comparing, kept in your browser’s local storage and never sent to our servers.

On the sign-in page, the “Continue with Google” button loads a script from Google; Google may then receive technical information under its own policy. No other third-party script is loaded on the site.

7. Why we use this data

We use this data to:

• provide the service: accounts, shops, listings, putting you in touch with sellers, notifications (performance of our terms of use);
• verify shops, handle reports and fight fraud and forbidden listings (our legitimate interest and the buyers’);
• keep the site and your account secure;
• produce statistics without personal data;
• meet our legal obligations, for example keeping the record of a moderation decision.

Where processing relies on your consent (for example the country and language cookie, or an extra check during verification), you can withdraw it at any time.

8. Who can access your data

Our team, as far as their work requires (shop verification, report handling, support), and our technical providers, who act only on our instructions:

• hosting of the site, the database, the backups and the photos: Hetzner Online GmbH, in its data centres in Germany;
• email delivery: an email sending service, which receives the address and content of each email;
• technical monitoring (logs and operating metrics): Grafana Labs.

Buyers see the public information of shops (name, city, contact number, badges) and nothing from your account. We pass your data to no advertiser. We may hand it over to an authority that lawfully requests it.

Because our servers are in Germany, your data leaves Cameroon. Germany applies data protection equivalent to or stronger than Cameroon’s; we carry out the steps Cameroonian law provides for this transfer.

9. How long we keep your data

• account data: as long as the account exists;
• shop and listings: as long as the shop is open; expired listings stay in your area until you delete them;
• reports and moderation decisions: kept with the shop concerned, to keep the history;
• visit counts: 90 days; searches: 180 days; technical logs: at most 30 days; sent emails: 30 days;
• backup copies: overwritten by our backup cycle, within a few weeks.

10. Deleting your account

You can delete your account from your account area, with one confirmation. What happens then:

• your name, email address, password, number and language are erased; your account becomes anonymous and all your sessions are closed;
• your saved products, followed shops, notifications, sessions and the link with your Google account are deleted;
• the shop you own is closed immediately and is no longer visible; its listings, photos and moderation history are kept, without any of your personal data, to handle possible reports;
• your reports are kept without your identity;
• your email address can be used to create a new account, which starts from nothing.

A closed shop cannot be reopened: you would need to create a new one and go through verification again.

11. Your rights

You can ask to access your data, correct it, erase it or restrict its processing, object to processing based on our legitimate interest, and receive a copy of the data you gave us. Write to [RESPONSABLE DES DONNÉES], [EMAIL DE CONTACT], from your account’s email address; we answer within 30 days. Your name and language can be changed directly in your account area.

If you believe your rights are not respected, you can lodge a complaint with Cameroon’s Personal Data Protection Authority, created by law no. 2024/017 of 23 December 2024, or with the competent authority of your country.

12. Security

The site is served over HTTPS, passwords are stored in an irreversible form, access to data is limited to the team members who need it, and the database is backed up daily. Should a breach of your data occur, we would inform the authority and, if the risk to you justifies it, you, within the deadlines the law sets.

13. Minors

The site is meant for people aged 18 or over. We do not knowingly create accounts for minors; if you think a minor has opened an account, write to us and we will delete it.

14. Changes

We will publish any change to this policy here, with its date. For an important change, people with an account will be informed in their area or by email.