Privacy Policy

Privacy Policy for Arvices

Last Updated: September 15, 2026

Arvices ("we", "our", "us", or the "Platform") is committed to protecting your privacy and your personal data. This Privacy Policy explains what we collect, why we collect it, who we share it with, how long we keep it and the choices you have, whenever you use the Arvices mobile applications, websites, storefronts, Nexus AI assistant, social media tools and WhatsApp integrations (together, the "Service").

This Policy is written to comply with the Nigeria Data Protection Act 2023 (NDPA), the General Application and Implementation Directive issued under it, and other applicable consumer protection laws. By using the Service you acknowledge that your data will be handled as described here.

If you shop at, book with or message a business that uses Arvices, Section 5 explains how your information is handled there. Our Cookie Policy explains what we store in your browser in more detail.

1. Who We Are and Our Legal Basis

Arvices is the data controller for the personal data described in this Policy, except where Section 5 explains that Arvices acts on behalf of a business that uses it. We process personal data only where we have a lawful basis: your consent, the performance of a contract with you, compliance with a legal obligation, or our legitimate interests in running, securing and improving the Service, where those interests are not overridden by your rights.

2. Information We Collect

The information we collect depends on how you use Arvices: as a customer looking for products and services, as a shopper on a business's store (see Section 5), or as a service provider, vendor or business ("Provider").

2.1 Information You Give Us

Account details: your name, phone number, email address, password (stored only as a secure hash), profile photo, business name and business description.
Verification details (Providers): government issued identification such as your National Identification Number, driver's licence or international passport, used through authorised verification services to confirm identity and prevent fraud.
Listings and content: products, services, prices, photos, videos, portfolio posts, Showcase posts, reviews and ratings you publish.
Conversations with Nexus AI: the text, voice recordings, images and files you send to our AI assistant on the web, in the app or on WhatsApp, and the requests you ask it to carry out.
Payments and wallet: wallet balances, transaction history, payout bank account details and invoices. Card details are entered on our payment partner's pages and are not stored by Arvices.
Support requests: messages you send to our support team and the details you include.

2.2 Information Collected When You Use the Service

Location: approximate or precise location from your device or IP address, used to show nearby providers and to calculate distance and delivery. When a delivery or visit is being tracked live, the live location of the rider or provider is shared with the customer for the duration of that job.
Device and usage information: IP address, device model, operating system, app version, browser type, push notification tokens, pages and features used, and error logs.
Messaging metadata: delivery and read statuses, timestamps and message identifiers from WhatsApp and other messaging channels.
Browser storage: what we keep in your browser to keep you signed in and remember your cart and preferences. Our Cookie Policy explains this in detail.

2.3 Information From Connected Social Media Accounts (Providers)

When a Provider chooses to connect Instagram, Facebook, TikTok, X or a WhatsApp number to Arvices, we receive the information that Provider authorises, which may include:

Account and Page details: account identifiers, username or Page name, profile picture, follower counts and linked Pages or Instagram business accounts.
Access tokens: the credentials the platform issues so we can act on your instructions. Tokens are encrypted before they are stored.
Posts and media: your existing posts, captions and media, so you can bring them into your Arvices Showcase, and the posts Arvices publishes or sends to your drafts at your request.
Performance insights: views, reach, likes, comments, shares and follower changes for posts Arvices published for you, and your best posting times.
Messages and comments: where you turn on the Arvices Inbox, direct messages and comments on your Facebook Page and Instagram account, so you can read and reply to them in Arvices.
Product catalogs: where your account has a shop catalog on Instagram, Facebook or WhatsApp, the product names, descriptions, prices and images in it, so you can add them to your Arvices store.
WhatsApp Business numbers: where you connect your own WhatsApp Business number, the messages your customers send to it and the replies sent from it, including replies our AI assistant writes on your behalf when you switch that on.
Permission to advertise under your name: where you turn it on, the permission your Facebook Page, TikTok account or X account gives Arvices' business accounts to run ads as that Page or account, and the identifiers the networks use for it, so ads Arvices buys for you can appear under your own name.
Shown on your profile: the names of the Instagram, Facebook, TikTok and X accounts you connect appear on your public Arvices profile as links to those accounts, so customers can find you there. A connected WhatsApp number is never shown this way.

We use this information only to provide the features you turned on. We do not use data received from these platforms to build advertising profiles of you or your followers, and we do not sell it.

2.4 Information About Businesses Not Yet on Arvices

To invite businesses to join Arvices and to help customers find services, we collect publicly available business information such as business names, public phone numbers, public listings and public social media profiles. A business can ask us at any time to stop contacting it and to remove its information.

3. How We Use Your Information

To provide the Service: creating and managing accounts, matching customers with providers, processing orders, bookings and payments, arranging delivery and sending updates.
To run Nexus AI: understanding your requests, finding providers and products, preparing offers and bookings, and creating documents, images, audio and designs you ask for.
To publish and promote for Providers: preparing posts and captions, publishing or scheduling them to the accounts you connect, posting to your Arvices Showcase, and running paid promotions you approve.
To measure results: counting how many clicks, chats, orders and payments came from each post or ad, using trackable Arvices links, so Providers can see what works.
To keep the Platform safe: verifying providers, preventing fraud and payment abuse, moderating content, detecting attempts to move transactions off the Platform, and securing our systems.
To meet legal duties: keeping financial records, producing invoices, and complying with tax, anti money laundering and other laws.
To communicate with you: service messages, security alerts, and, where you have agreed, news and offers you can switch off at any time.
To improve Arvices: understanding how features are used so we can fix problems and build better ones.

4. Advertising and Measurement

4.1 Paid Promotions Run by Arvices

When a Provider pays for an ad through Arvices, the ad is placed on Meta (Facebook and Instagram), TikTok or X from Arvices' own advertising accounts. Where the Provider has allowed it, the ad appears under the Provider's own Facebook Page, Instagram account, TikTok account or X account. Otherwise it appears under the Arvices name, and a member of the Arvices team reviews it before it runs. We share the ad's content, its destination link, the targeting settings and, where it applies, which of the Provider's accounts it runs as with those networks. We receive back performance figures such as spend, impressions, clicks and whether the ad was approved.

4.2 Telling Advertising Networks What Happened After an Ad

To help ads reach people who are likely to become real customers, and to report honest results to the Providers who pay for them, we may send the following events to TikTok through its Events API when your visit started from a TikTok ad or a TikTok link run by Arvices:

viewing a product, service, store or provider profile;
starting a WhatsApp chat with a business;
placing an order or making a booking;
completing a payment, with the amount.

With these events we may send TikTok's own click identifier from the ad you tapped, your IP address, your browser or device type, and your email address and phone number in hashed form. Hashing turns them into a fixed code using the SHA 256 method before they leave our systems, so the raw email address or phone number is never sent. TikTok uses these codes only to match the event to its own users and must not use them for any other purpose under its business terms.

In the browser, we only keep and send TikTok's click identifier if you accept measurement in our cookie banner. If you reject it, the identifier is not used.

4.3 Custom Audiences

Where this feature is switched on, we may create advertising audiences from Arvices customers, for example people who have paid for an order or booking in the past year, so that ads can be shown to similar people. Only hashed email addresses and phone numbers are uploaded, and the networks use them solely to match and build the audience. Audiences are not used to target the Provider's own competitors, and no individual's order history is shared.

4.4 Your Choices About Advertising

You can ask us at any time to stop using your information for advertising measurement and audiences by writing to [email protected]. We will exclude your account from future events and audience uploads. You can also manage ad preferences directly with Meta, TikTok and X in their own settings.

5. Shopping With a Business That Uses Arvices

Many businesses use Arvices to run their online store, take orders and bookings, and chat with customers, including on their own website address and their own WhatsApp number. This section explains how your information is handled when you visit, shop at, book with or message one of those businesses (the "Business"). The rest of this Policy applies to you as well.

5.1 Who Is Responsible

The Business decides how it uses your order, booking and contact details to serve you, and is responsible for that use.
Arvices provides the storefront, checkout, payments, delivery updates, store assistant and messaging tools the Business uses, and is responsible for operating and securing them. When Arvices processes your information only to provide these tools to the Business, it acts on the Business's behalf.

The Business may also publish its own privacy terms on its store. Where they differ from this Policy, the Business's terms apply to how the Business itself uses your information.

5.2 Information Collected on a Store

Visit information: the pages you view, your approximate location from your IP address, your device and browser type, and the link or ad that brought you to the store.
A visitor identifier: a random code kept in your browser so your cart and guest orders can be found again without an account. It stays until you clear your browser storage.
Order and booking details: the items or services you choose, your name, phone number, email address, delivery or service address, notes you add, and payment status.
Payment details: payments are made on the pages of our payment partner, Paystack. Arvices and the Business receive confirmation of payment, not your full card details.
Messages: what you write to the store assistant on the storefront, and messages you send to the Business on WhatsApp, including through chat links on the store or in its posts.
Reviews: ratings and comments you choose to leave.

5.3 How It Is Used

To show you the store, keep your cart, and process your order or booking.
To take payment, arrange delivery or the service visit, and send you updates about your order by email, SMS or WhatsApp.
To answer your questions. The store assistant and, where the Business has switched it on, the WhatsApp assistant are powered by artificial intelligence and reply on the Business's behalf. A person at the Business can take over the conversation at any time, and you can ask for a person.
To show the Business which of its posts and ads bring customers, using trackable Arvices links.
To prevent fraud, resolve disputes and meet legal record keeping duties.

5.4 Who It Is Shared With

The Business, which receives your order, booking, contact and delivery details and your messages to it.
Delivery riders handling your order, who receive your name, phone number and delivery address, and whose live location you may see while they deliver.
Hosting and infrastructure providers that run the store, including when the store uses the Business's own website address.
TikTok, only if your visit started from a TikTok ad run through Arvices and you accepted measurement in the cookie banner, as described in Section 4.2.
Paystack, our artificial intelligence providers, Meta (which carries WhatsApp messages) and authorities, as described in Section 6.

Your information is never sold.

5.5 Your Rights as a Shopper

You can use any of the rights in Section 11 by contacting the Business directly, or by writing to Arvices at [email protected]. We will help, including passing your request to the Business where it concerns the Business's own use of your information. The Business's contact details are shown on its store.

6. Who We Share Information With

We do not sell, rent or trade your personal data. We share it only as needed to provide the Service, with these categories of recipients:

Other users of the transaction: a provider or vendor receives your name, contact number, address and order or booking details once you place an order or confirm a booking. Customers see a provider's public profile and, during a tracked job, the live location of the rider or provider.
Payment partners: Paystack processes card and bank payments and payouts. We share the transaction details needed to complete each payment.
Artificial intelligence providers: OpenAI, Google and ElevenLabs process the text, images and audio needed to answer your requests, generate content and produce or understand speech, under agreements that do not allow them to use your data to train their public models.
Social media and messaging platforms: Meta (Facebook, Instagram and WhatsApp), TikTok and X receive the content you ask us to publish or send, messages sent through connected accounts, and the advertising information described in Section 4.
Shopping and advertising catalogs (Providers): Google, Meta, X and TikTok receive the products and services a Provider publishes on Arvices, with their titles, descriptions, photos, prices, the business name shown on them and links to their Arvices pages, so they can appear in shopping listings and ads. This is the same information already shown publicly on those pages; no contact details are included.
Infrastructure providers: cloud hosting and storage providers such as Amazon Web Services, email delivery services, and mapping services such as Mapbox, which may receive anonymous usage information when a map is shown.
Domain registrars: when a Provider buys or connects a domain name for their store, the registrar and the domain registry receive the registrant contact details they require by law.
Verification services: providers that confirm identity documents for Provider onboarding.
Authorities: regulators, courts, law enforcement or tax authorities, where the law requires it or where it is necessary to protect the rights, property or safety of users, the public or Arvices.
A buyer of our business: if Arvices is involved in a merger, acquisition or sale of assets, subject to this Policy continuing to protect your data.

7. International Transfers

Some of the providers listed above store or process data outside Nigeria. Where that happens we rely on the transfer mechanisms permitted by the NDPA, such as adequate protection in the receiving country, contractual safeguards, or your consent, and we choose providers with recognised security standards.

8. Security

All traffic between your device and Arvices, and between Arvices and its partners, is encrypted in transit using TLS.
Access tokens for connected social media accounts and other sensitive secrets are encrypted at rest with AES 256 encryption.
Access to personal data inside Arvices is limited to staff who need it for their work.
No system is completely secure. Please protect your password, your device and your WhatsApp verification codes, and tell us straight away if you suspect misuse of your account.

9. How Long We Keep Information

Account information is kept while your account is open.
Transaction, invoice and payment records, including orders and bookings placed on a Business's store, are kept for up to seven (7) years after the transaction, as required by Nigerian tax, accounting and anti money laundering laws.
Messages to a Business through its store assistant or WhatsApp are kept while the Business uses Arvices, or until you or the Business ask for them to be deleted.
Connected social media data is kept while the connection is active. When you disconnect an account, its access token is deleted and imported content that you did not add to your store is removed within thirty (30) days.
Advertising measurement records are kept for up to twenty four (24) months, then deleted or anonymised.
Support and safety records are kept for as long as needed to resolve the matter and protect the Platform.

10. Disconnecting Accounts and Deleting Your Data

Disconnecting a social media account: go to Social, then Connected accounts, and choose Disconnect. You can also remove Arvices from the connected apps list in your Facebook, Instagram, TikTok or X settings. To stop ads running under your own name, choose Stop using my name under Ads under your name; to remove Arvices completely, also remove it from your Page partners in Meta Business Suite, from your TikTok account's Business Center permissions, or from your X account access settings.
Deleting your Arvices account: use Delete account in your settings or visit the account deletion page on arvices.com. We delete or anonymise your personal data, except records we must keep by law as described in Section 9.
Deleting data received from Facebook, Instagram, TikTok or X without closing your account: email [email protected] with the subject "Social data deletion" and we will confirm when it is done, normally within thirty (30) days.

11. Your Rights

Under the NDPA you have the right to:

Access the personal data we hold about you and receive a copy in a commonly used format;
Correct data that is inaccurate or incomplete;
Delete data where there is no legal reason for us to keep it;
Restrict or object to processing, including processing for advertising measurement and direct marketing;
Withdraw consent at any time, without affecting processing that took place before;
Not be subject to decisions based only on automated processing that have legal or similarly significant effects on you, and to ask for a human review of automated matching or safety decisions;
Complain to the Nigeria Data Protection Commission if you believe your rights have been infringed.

To exercise any right, email [email protected]. We may need to confirm your identity first.

12. Children

Arvices, including stores run on Arvices, is not intended for anyone under eighteen (18) years of age. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Links to Other Services

Arvices may link to or display content from other websites, maps, social media platforms and business storefronts. Those services have their own privacy practices, which we do not control.

14. Changes to This Policy

We may update this Policy as the Service changes. When we make significant changes we will update the date at the top and notify you in the app, by email or on WhatsApp. Please review this Policy from time to time.

15. Contact Us

For questions, requests or complaints about your personal data:

Email: [email protected]
Response time: we respond to data protection requests within forty eight (48) business hours and complete them within the time the law allows.