Privacy Policy
Pouch Villa sells phone pouches, cases and device accessories. This notice explains what personal information we collect when you use our website, why we hold it, who else can see it, and what you can ask us to do about it.
It is written to meet the Nigeria Data Protection Act 2023. Pouch Villa is the data controller for the information described here.
What we collect
When you place an order we collect your name, email address, phone number and, for delivery orders, your address, nearest landmark and local government area. We record what you ordered, what you paid, and any note you leave us.
When you upload a transfer receipt we store the file you send. These are financial documents and are treated as the most sensitive information we hold — see Payment receipts below.
If you create an account we store your email address, name, phone number and a cryptographic hash of your password. We never store the password itself. If you sign in with Google we store the identifier Google gives us, not your Google password.
When you leave a review or send us a message we collect the name you give, your rating and comments or enquiry, and any email address or phone number you provide so we can reply.
Automatically, we record the IP address of requests that create something — an order, a review, an enquiry, a sign-in attempt — and keep it briefly to stop abuse and spam. We also keep an internal record of actions our own staff take on your order, so we can answer questions about who changed what.
We do not collect card details. We are not a payment processor and no card number ever reaches this website.
Why we hold it, and on what basis
- To fulfil your order — this is necessary to perform our contract with you. Without your phone number and address we cannot deliver. - To confirm your payment — we compare the receipt you upload against our bank records. - To keep your account, where you asked for one. At checkout, the "Create my Pouch Villa account" box is ticked by default and you can untick it; we record the moment you consented so the choice is auditable. - To answer your enquiries and publish reviews you submit. - To protect the shop — rate limiting, fraud prevention and our audit trail rest on our legitimate interest in running the business safely.
Payment receipts
Transfer receipts usually show bank account details, so they are handled differently from everything else on the site:
- They are stored in a private location that is not reachable from the public internet. - Staff can only view one through a short-lived link that expires within minutes. - Every single time a staff member opens a receipt, that access is recorded against their name.
They are never published, never attached to a product page, and never included in any email.
Cookies
We use five cookies. None of them are for advertising, and we do not use third-party analytics or tracking pixels.
| Cookie | Purpose |
|---|---|
pv_customer_session | Keeps you signed in |
pv_cart | Remembers your basket before you sign in |
pv_order_grant | Lets you see the order you have just placed, for one hour |
pv_theme | Remembers whether you chose light or dark appearance |
pv_staff_session | Signs in Pouch Villa staff only |
Who else can see your information
We use a small number of service providers, and they may only process your information on our instructions:
- CockroachDB — hosts our database.
- Cloudflare R2 — stores product images and payment receipts.
- Resend — sends order confirmations and password reset emails.
- Google — only if you choose to sign in with Google.
- Vercel — hosts the website itself.
We do not sell your personal information, and we do not share it for advertising.
Where your information is held
Our database is hosted in Germany. If you are in Nigeria, your information is therefore transferred outside Nigeria to be stored and processed. We rely on our providers' contractual data-protection commitments for that transfer. You can ask us for more detail about those safeguards via our Contact page.
How long we keep it
Orders, receipts and account records are kept while your account is active and afterwards for as long as we need them for tax, accounting and dispute purposes.
You should know two specific things about how our system works:
- When something is deleted here it is marked as deleted and hidden, rather than immediately erased, so that order history and financial records stay consistent. - Our record of staff actions is append-only and is not edited or removed.
If you ask us to erase your information we will do so wherever we are not required to keep it, and we will tell you plainly what we must retain and why.
Your rights
Under the NDPA you may ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete information we no longer have a reason to keep;
- restrict or object to how we use it; or
- provide it in a portable form.
You can also withdraw consent where we relied on it. To exercise any of these, contact us using the details on our Contact page. We will respond within the period the NDPA requires.
If you are unhappy with our response you may complain to the Nigeria Data Protection Commission.
Keeping information safe
Passwords are hashed with Argon2id and checked against public breach lists when you set them, so a password known to have leaked elsewhere is refused. Traffic to this site is encrypted. Staff accounts are separate from customer accounts, sign-ins are rate limited, and staff sessions can be revoked immediately.
No system is perfectly secure, but if a breach affects your rights we will notify you and the Commission as the NDPA requires.
Children
This website is not intended for children, and we do not knowingly collect information from anyone under 15.
Changes
We may update this notice. The version on this page is always the current one.