Last updated: 18 September 2026 · Effective: 18 September 2026
StoreLink ("StoreLink", "we", "us", "our") operates storel.ink — a platform that lets sellers ("merchants") create their own online store, and lets shoppers ("customers") buy from an individual merchant's store or browse across every store on the StoreLink Marketplace. This policy applies to the StoreLink website, the StoreLink Marketplace, every individual merchant storefront hosted on storel.ink, and the merchant dashboard.
Legal entity: StoreLink is operated by [LEGAL ENTITY NAME], registered in [COUNTRY, REGISTRATION NUMBER]. (This bracketed line is the one part of this policy we can't fill in for you — we don't have your registered entity details. Everything else on this page reflects how the product actually works today.)
Because StoreLink is a platform other businesses build their own stores on, we sit in two different legal positions depending on what data we're talking about, and it's worth being upfront about the difference:
If you create a store (merchant): your name, email, phone number, business/store name, store bio and branding, the products you list (including photos and descriptions), and your bank account or wallet details for payouts.
If you verify your identity for payouts (KYC): your full legal name, a government-issued ID type and number, a photo/scan of that ID document, proof of address where requested, and your business name if applicable. This is among the most sensitive data we hold, and we treat it accordingly — see Section 7.
If you buy something on a merchant's store: your name, phone number, email (optional, depending on the merchant's checkout), and delivery address — passed to that merchant, per Section 2 above.
If you create a StoreLink Marketplace account: your email (verified by one-time passcode), name, phone, and any saved delivery addresses, so you can check out faster and track orders across different stores.
Payment data: when you pay by card, bank transfer, or USSD, your card and bank details are captured directly by our payment partner, MyroPay, not by StoreLink. We receive confirmation that a payment succeeded and a reference for it, not your full card number.
Location data: if a merchant sets up in-person pickup, they provide their own pickup address (optionally located via Google Maps). We also make a best-effort guess at your country from your IP address, to suggest the right currency and determine whether to show you a cookie notice — we don't store precise device location unless you explicitly share it.
Usage & device data: pages visited, browser and device type, and general analytics needed to keep the platform working and to help merchants understand their own store's traffic.
Cookies and local storage: see our Cookie Policy for the specifics — in short, we use them to keep you signed in, remember your cart, and remember your preferences.
Under the Nigeria Data Protection Act 2023 (NDPA), and equivalent frameworks elsewhere, we rely on: performance of a contract (running your account or fulfilling an order you placed), your consent (marketing communications, non-essential cookies), our legitimate interests (fraud prevention, service improvement), and compliance with a legal obligation (KYC/AML checks, tax recordkeeping). If you're located somewhere with its own data protection framework — the EU/UK GDPR, for instance — the same categories of legal basis apply; let us know if you need this mapped to your specific regulation.
We do not sell personal data to third parties, and we don't share it with anyone for their own independent marketing purposes.
Government ID documents and proof-of-address files you submit for payout verification are stored for as long as your account remains active and verified, plus a retention period afterward to meet anti-money-laundering recordkeeping obligations. Access to this data is restricted to the specific staff roles that review verifications; it is never used for marketing and is never shared with other merchants or customers.
StoreLink primarily serves Nigeria and other African markets. Our infrastructure and some of our service providers (including payment and communications partners) may process data outside the country you're in. Where that happens, we rely on those providers' own security and compliance standards (including, where applicable, standard contractual safeguards) to protect your data in transit and at rest.
We keep account, order, and transaction data for as long as your account is active, and afterward for as long as needed to meet our tax, accounting, and financial recordkeeping obligations — these typically run for several years after an account closes, in line with applicable Nigerian recordkeeping requirements. KYC documents are retained as described in Section 7. If you'd like your account or data deleted sooner, see Section 10 — we review every request individually against these legal retention obligations.
Depending on where you're located, you may have the right to access the personal data we hold about you, correct it if it's inaccurate, ask us to delete it, restrict or object to certain processing, receive a copy in a portable format, and withdraw consent at any time where we rely on consent. To exercise any of these, email hello@storel.ink — we currently handle these requests manually (we don't yet have a self-service "delete my account" button in the product) and will confirm your identity before acting on the request. We aim to respond within 30 days. Some rights are limited where we have an overriding legal obligation to keep certain data, such as financial transaction records.
If you're in Nigeria and unsatisfied with how we've handled a request, you can lodge a complaint with the Nigeria Data Protection Commission (NDPC). If you're in the EU/UK, you have the right to complain to your local supervisory authority.
We only send marketing emails or push notifications to merchants and marketplace customers who've opted in (or, for merchants, where permitted as part of operating your account). Every marketing email and push notification includes a way to unsubscribe, and doing so takes effect immediately — it won't affect transactional messages like order confirmations, which we need to send you to operate the service.
StoreLink is not directed at, and is not intended for use by, anyone under 18. We don't knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we'll remove it.
We use industry-standard measures to protect your data, including encrypted connections (HTTPS/TLS) across the platform, hashed passwords, and role-based access controls that limit which staff can see sensitive data like KYC documents or payout details. Card and bank details are handled by our PCI-DSS-compliant payment partners, not stored on our own servers. No system is perfectly secure, and we can't guarantee absolute security, but we take it seriously and will notify affected users and applicable regulators as required by law if a breach puts your data at risk.
We'll update the "Last updated" date above whenever we make changes, and for material changes — a new category of data, a new purpose, a new type of third party we share with — we'll make a reasonable effort to notify active merchants and customers directly, not just quietly update this page.
Questions, requests, or complaints about this policy: hello@storel.ink.