Privacy Policy

1. Who is responsible for your data

Demmy Plug ("we", "us") operates the digital store available at demmyplug.store. We are the data controller for the personal information described in this policy.

Privacy questions and requests: ceodemmy001@gmail.com. We answer within 30 days.

2. Information we collect

• Account data: full name, email address, password hash (never the password itself), role and account status.
• Wallet and order data: deposits, purchases, refunds, order status, delivery content you receive and the reference of each movement.
• Payment references: the transaction hash or bank reference you submit when declaring a deposit. We do not store full card numbers or banking passwords.
• Identity verification for virtual accounts: when Monnify is enabled, a BVN or NIN may be sent directly to Monnify to open your deposit account. Demmy Plug does not store the BVN or NIN.
• Telegram data: your Telegram chat ID and username if you choose to link your account, plus your notification preference.
• Technical data: IP address, browser type and security logs used to prevent abuse, fraud and unauthorised access.

3. Why we use your data

• Create and secure your account, sign you in and keep your session safe.
• Credit deposits, charge purchases, deliver orders and process refunds to your wallet.
• Send transactional notifications by Telegram when you enable them.
• Prevent fraud, chargebacks, multi-account abuse and attacks on the service.
• Answer support requests and comply with applicable Nigerian law.

4. Legal bases

We rely on the performance of our contract with you (account, wallet and orders), our legitimate interest in keeping the service secure and reliable, your consent where consent is required (for example Telegram notifications or sending BVN/NIN to Monnify), and legal obligations where they apply.

5. How long we keep data

Account and wallet records are kept while your account is active and for the period required to resolve disputes and meet accounting or legal obligations. Security logs are kept for a limited period. Telegram link tokens are single-use and expire quickly. When data is no longer needed, it is deleted or anonymised.

6. Who can access your data

• Authorised administrators of Demmy Plug, only for the task they need to perform (for example validating a deposit or delivering an order).
• Service providers that host the site and database (Vercel and Supabase), process payments (Monnify when enabled) and deliver Telegram messages.
• Authorities or courts when we are legally required to disclose information.

7. International transfers

Some providers process data outside Nigeria. Where that happens, we use providers with appropriate contractual and technical safeguards and we only transfer what is necessary to provide the service.

8. Cookies and local storage

We use essential cookies and local storage to keep you signed in, remember your theme (light or dark) and your language (English or French). We do not use advertising cookies or sell your data.

9. Security

Passwords are hashed. Access to the database is protected by row-level security and controlled functions. Sensitive operations require an authenticated session, rate limits and server-side checks. No system is perfectly secure, but we work to detect and limit incidents quickly.

10. Your rights

To exercise a right, email ceodemmy001@gmail.com from the address linked to your account. We may ask for proof of identity to protect your data.

• Access a copy of the personal data we hold about you.
• Correct information that is inaccurate or incomplete.
• Request deletion of your account and data, subject to legal retention duties.
• Object to processing or withdraw consent where consent is the legal basis.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

11. Children

The store is intended for people aged 18 or over. We do not knowingly collect data from children. If you believe a minor created an account, contact us so we can close it.

12. Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows the latest version. Significant changes will be announced on the site or by email.