Privacy Policy

1. Who we are

Jara is run by KLOSE HUB (BN 9673698), a business name registered with the Corporate Affairs Commission of Nigeria ("we", "us"). We are the data controller for the personal data described in this policy: we decide why and how it is used.

Questions about your data, or requests to use your rights, go to our data protection contact at support@jaracircle.com. For anything else, contact support@jaracircle.com.

This policy is part of our Terms of Use. Please read it together with the Refund and Cancellation Policy.

2. The personal data we collect

Data you give us:

• Phone number: to create your account and sign you in with a one-time SMS code.
• Your name: the name you choose. Other members of your circles see it.
• Email address: asked at checkout so our payment partner can send your receipt. Other users never see it.
• Delivery address: when you choose seller delivery. Only the seller of that order sees it.
• Circles: the circles you create or join, their name and area, and your role (member or admin).
• Deals, orders and messages: deals you post (title, description, photos, prices, delivery options), orders you place, questions you ask and notes sellers pin on a deal.
• Bank account (sellers, and buyers who need a refund paid to a bank account): we keep only the bank name, the last 4 digits and the account name your bank confirms. The full account number goes straight to our payment partners (Paystack, and Bachs for payouts through Bachs) and is not stored by us.
• Alert choices: which alerts you want and how (push notification or SMS).
• Messages to us: what you send when you contact support.

Data collected automatically:

• Staying signed in: cookies that keep you signed in.
• Saved on your phone: drafts of a deal or checkout you haven't finished, and copies of pages you opened so they work offline (removed when you sign out). See our Cookie Policy.
• Alerts: if you turn on alerts, your phone or browser gives us a way to send them to you.
• Basic device information: such as the type of browser and when you used the app, kept briefly for security and to fix problems.

Data we receive from others:

• Our payment partners, Paystack and Bachs: whether a payment, refund or payout succeeded, the amounts, their fee, and the account name your bank confirms. They handle your card and bank details; we never see or store full card numbers.
• Twilio: whether an SMS was delivered.

We do not use advertising trackers or analytics cookies, and we do not build profiles of you for advertising. Everything we store on your device is listed in our Cookie Policy.

3. Why we use your data, and our lawful basis

Under section 25 of the NDPA we may only process your data when we have a lawful basis. Ours are:

• To perform our contract with you: creating your account, signing you in, running circles and deals, working out prices, taking payments, sending refunds and payouts, delivering orders, and sending the alerts you asked for.
• To meet legal obligations: keeping financial and tax records, responding to lawful requests from regulators, courts or the police, and preventing financial crime.
• Our legitimate interests: keeping the service secure, stopping fraud and abuse, enforcing our Terms, and improving the service using overall figures (not to target you). We weigh these interests against your rights and do not rely on them where your rights come first.
• Your consent: optional alerts by push notification or SMS. You can turn them off at any time in Alerts → Settings; this does not affect anything done before.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. The rules that decide prices and refunds are the deal rules you and the seller agreed to, shown before you pay.

4. Who can see your data

• Members of your circles see your name, the deals posted in the circle, and questions asked on them.
• Sellers see the name, quantity and delivery choice of each buyer of their deal, and the delivery address when the buyer chose seller delivery.
• Buyers see the seller's name and how many deals the seller has completed.
• Circle admins see who has asked to join their circle.
• The public: while a deal is open, anyone with its link, and search engines such as Google, can see the deal's title, photos, description, price, how many people have joined, its closing time, and the seller's name and completed deals. Buyers' names, circle names and the pickup place are never public. Deal photos are stored at web addresses that anyone with the address can open.

5. Service providers we share data with

We use trusted service providers (data processors) who handle data only on our instructions and under contracts that require them to protect it:

• Paystack: payments, refunds and payouts to bank accounts.
• Bachs: card payments, refunds and payouts to sellers' bank accounts, for deals that use Bachs. To pay a seller, Bachs keeps the seller's name and bank account.
• Supabase: stores the app's information and photos, and handles sign-in.
• Twilio: sends sign-in codes and SMS alerts.
• Google, Apple, Mozilla and Microsoft: deliver alerts to your phone or browser.
• Vercel: runs our website.

We may also share data with professional advisers (such as lawyers and auditors) under a duty of confidence, with a buyer of our business if it is sold (who must keep this policy's promises), and with authorities where the law requires it.

We never sell your personal data.

6. Data sent outside Nigeria

Some of our service providers store or process data outside Nigeria. Under Part VIII of the NDPA we only transfer data where the receiving country or provider gives an adequate level of protection, where appropriate safeguards are in place (such as the provider's data processing terms with standard contractual protections), or where the transfer is needed to perform our contract with you (for example, to process your payment). You can ask us for details of these safeguards.

7. How long we keep your data

• Account and circle data: while your account is open, and up to 12 months after you close it so we can deal with disputes and complaints, unless the law requires longer.
• Payment, order, refund and payout records: 6 years, because tax and accounting law requires it.
• Alerts list: 180 days.
• Alert settings for your phone: until you turn alerts off, or they stop working on that phone.
• Security records: a short period, normally no more than 90 days.

After that we delete the data or make it anonymous so it can no longer identify you.

8. Your rights

Under the NDPA you have the right to:

• be told how your data is used (this policy);
• get a copy of the personal data we hold about you;
• have wrong or incomplete data corrected;
• have your data deleted, where we no longer need it or have no lawful basis to keep it;
• restrict or object to some uses of your data;
• receive your data in a common machine-readable format, or have it sent to another provider;
• withdraw your consent at any time (for example, to SMS or push alerts);
• not be subject to decisions based solely on automated processing that significantly affect you;
• complain to the Nigeria Data Protection Commission (NDPC).

To use a right, email support@jaracircle.com from, or quoting, the phone number on your account. We may ask you to confirm your identity before acting. We reply within 30 days, and tell you if we need more time or cannot do what you ask (for example, because the law requires us to keep payment records).

Deleting your account does not delete records we must keep by law, and does not cancel open orders or payouts that are still being processed.

9. How we protect your data

• Information sent between your phone and us is encrypted.
• Only the people who need it can see your data, and the app stops users from seeing other people's private details.
• We do not store full card numbers or full bank account numbers.
• Our payment keys are never kept in the app on your phone.

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will report it to the NDPC within 72 hours of becoming aware of it where the law requires, and tell affected users without undue delay, with what we are doing about it.

Please keep your phone and sign-in codes safe. Never share an SMS code with anyone, including someone claiming to be from us.

10. Children

Jara is not for anyone under 18. We do not knowingly collect data from children. If we learn that a child has an account, we will close it and delete their data, except records we must keep by law. If you think a child is using Jara, contact support@jaracircle.com.

11. Changes to this policy

We may update this policy. The version date at the top shows when it last changed. If a change materially affects how we use your data, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

12. Contact and complaints

Data protection contact: support@jaracircle.com.

If you are not happy with how we handled your data, please tell us first so we can put it right. You can also complain to the Nigeria Data Protection Commission (NDPC).