Privacy Policy
Zerrar Technologies Ltd.. Last updated October 21, 2026.
1. Who we are and what this policy covers
Zerrar Technologies Ltd. ("Zerrar", "we", "us") provides business management software at zerrar.com, including websites and stores for merchants, orders, bookings, rentals, point of sale, stock, expenses, profit and loss, balance sheet and tax records, and WhatsApp alerts and an AI business assistant. Our address is Lekki, Lagos, Nigeria.
This policy applies to the Zerrar website, the Zerrar dashboard and apps, the store, booking and rental pages our merchants publish on yourname.zerrar.com addresses, and our WhatsApp services. It explains what personal data we collect, how we use and protect it, who we share it with, how long we keep it, and what rights you have.
We are the data controller for information about our merchants and their staff. For information that merchants collect from their own customers through Zerrar, the merchant is the controller and we act as their processor. See Information about a merchant's customers.
We handle personal data in line with the Nigeria Data Protection Act 2023 and, where it applies to you, other data protection laws.
2. Information we collect
Information you give us
- Account details: first name, last name, email address, phone number and a password. Passwords are stored only as a one-way hash, never in readable form.
- Business details: business name, store link, business type and categories, business phone, branding and the products, services, rentals, prices and photos you add.
- Team details: names, emails and roles of staff you invite.
- Financial records you enter: expenses, budgets, suppliers, debts, discounts and similar bookkeeping data.
- Messages to us: emails, WhatsApp messages and support requests, including what you ask our AI business assistant.
Information we receive when you sign in with Google
If you choose "Sign in with Google" or "Sign up with Google", Google shares your name, email address and basic profile information with us. See Sign in with Google and Google user data for exactly what we request and how we use it.
Information collected automatically
- Device and connection data: IP address, browser and device type, and approximate location derived from the IP address.
- Session and security data: login times, active sessions, failed login attempts and security events, used to protect accounts.
- Usage data: the pages and features you use in the dashboard, so we can fix problems and improve the product.
Payment information
Customer payments on your store go through your own connected payment provider (Paystack, Flutterwave or Monnify). Card numbers and bank login details are handled by those providers and are never stored on Zerrar servers. We receive confirmation of the payment, the amount and a reference. We bill our own subscription fees through the same kind of providers.
Information from other sources
If you connect advertising or sales channels such as Meta, TikTok or Google Merchant Center, we receive account identifiers and campaign or listing status from them so we can show it to you. For TikTok, see Connecting TikTok for Business. If someone refers you using a referral code, we record that code.
3. Sign in with Google and Google user data
Zerrar offers Google sign-in so you can create an account or log in without a separate password. This section describes how we handle information received through Google.
| Question | Answer |
|---|---|
| What we request | Only the scopes openid, email and profile. This gives us your name, email address, a Google account identifier and basic profile information. |
| What we do not request | We do not request or access your Gmail, Google Drive, Google Contacts, Google Calendar or any other Google service data. |
| Why we need it | To create your Zerrar account, verify that your email address is yours, log you in securely, address you by name, and contact you about your account, orders and bookings. |
| Where it is stored | In our database, as part of your Zerrar account, protected as described in How we protect your data. |
| Who we share it with | We do not sell it or share it for advertising. It is shared only with the service providers that help us run Zerrar (for example email delivery and hosting), and only as needed to provide the service, or if the law requires it. |
| How to stop it | You can remove Zerrar's access at any time in your Google Account permissions page. To delete the Zerrar account and the data we hold, see Your rights and deleting your data. |
Limited Use disclosure. Zerrar's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the sign-in and account features described above. We do not use it for advertising, we do not sell it, and we do not allow humans to read it except with your consent, for security purposes, to comply with law, or where it is aggregated and anonymised.
4. Connecting TikTok for Business
Merchants can connect their own TikTok for Business advertiser account to Zerrar to promote their products with TikTok ads. Connecting is optional and starts only when you choose "Connect TikTok" and approve access on TikTok's own authorization page. This section explains how we handle that connection.
| Question | Answer |
|---|---|
| What we access | Only the advertiser accounts you authorize. Through TikTok's Marketing API we use four permission areas: Ad account management, Ads management, Creative management and Reporting. |
| What we receive and store | The advertiser ID, account name, currency, time zone and status, and the access token (and refresh token, if TikTok provides one) that lets us act on your behalf. Tokens are encrypted before they are stored. |
| What we do with it | Show your connected advertiser accounts, create, update and pause ad campaigns, ad groups and ads for your products only when you ask us to, upload the images and videos you choose for those ads, and read campaign performance to show beside your store sales. |
| What we do not access | We do not access TikTok user data: no personal TikTok accounts, followers, videos, messages or viewer information. We do not use Business Center management, billing or payment functions. |
| Who we share it with | We do not sell it or share it for advertising or profiling. We send ad content and settings to TikTok only to run the campaigns you create, and share data with our hosting providers only as needed to run Zerrar. |
| How to stop it | Disconnect TikTok in the Zerrar dashboard at any time. When you disconnect, we revoke our access token with TikTok and delete our stored copy. You can also remove Zerrar's access from your TikTok for Business account settings. |
Limited use. We use data received from TikTok only to provide the advertising features you ask for inside Zerrar. We do not sell it, use it for unrelated advertising, or combine it with other data to profile you or your customers. Your use of TikTok remains subject to TikTok's terms and privacy policy.
5. How we use your information
| What we do | Why we are allowed to |
|---|---|
| Create and run your account, website, orders, bookings, rentals and books | To perform our contract with you |
| Send order, booking and rental alerts, one-time codes, receipts, invoices and account notices by email and WhatsApp | To perform our contract with you |
| Answer questions you ask our AI business assistant, such as today's sales or pending bookings | To perform our contract with you |
| Process subscription payments and keep financial records | Contract and legal obligation |
| Protect accounts, detect fraud and abuse, and keep records of security events | Our legitimate interest in keeping the service safe |
| Fix bugs, measure performance and improve features | Our legitimate interest in improving the product |
| Provide support | Contract and legitimate interest |
| Send product news and offers | Your consent, which you can withdraw at any time |
| Meet tax, accounting and other legal duties | Legal obligation |
We do not make decisions about you that have legal effect using only automated processing.
6. Who we share information with
We do not sell personal data. We share it only with the following kinds of recipients, and only as needed.
| Recipient | Why |
|---|---|
| Payment providers (Paystack, Flutterwave, Monnify) | To collect customer payments for merchants and our subscription fees |
| Delivery and logistics partners | To book and track deliveries, using the customer name, phone number and address the merchant provides |
| Email and messaging providers, including WhatsApp | To send one-time codes, alerts, receipts and notices |
| AI service provider | To generate answers to messages sent to our AI business assistant |
| Hosting, storage, security and bot-protection providers | To run Zerrar securely and keep it available |
| Advertising and sales channels you connect (Meta, TikTok, Google Merchant Center) | To publish your products or run the campaigns you create, and to show results to you, only when you connect them |
| Professional advisers, regulators, courts or law enforcement | Where the law requires or to protect rights, safety and property |
| A buyer or successor of our business | If Zerrar is merged, acquired or sold, with the same protections for your data |
Our service providers may only use personal data to provide services to us and must protect it.
7. Information about a merchant's customers
When someone buys from, books or rents from a merchant on Zerrar, the merchant receives the customer's name, phone number, email, delivery address and order or booking details. The merchant decides why and how that information is used and is responsible for it. We process it on the merchant's behalf, only to provide the Zerrar service, and we do not use it for our own marketing.
If you are a customer of a Zerrar merchant and want to see, correct or delete your information, please contact that merchant first. You can also email us at [email protected] and we will help route your request.
Zerrar is not a marketplace. Customers reach a merchant's page because the merchant shared the link.
8. Cookies and similar technologies
We use a small number of cookies and similar storage:
- Essential cookies: a secure, HTTP-only login cookie that keeps you signed in, and a security token that protects forms against cross-site request forgery. Without these the dashboard cannot work.
- Preferences: for example your light or dark theme.
- Bot protection: Cloudflare Turnstile is used on sign-up forms to block automated abuse.
- Merchant storefront tools: if a merchant turns on advertising tools such as a Meta or TikTok pixel on their store, those providers may set their own cookies on that store.
You can block or delete cookies in your browser settings, but the dashboard may not work without the essential ones. For more detail, see our Cookie Policy.
9. How we protect your data
- All traffic between your browser and Zerrar is encrypted with HTTPS.
- Passwords are hashed, and login cookies are HTTP-only and secure.
- Access to production systems and data is limited to staff who need it, and merchants control which of their own staff can see what through roles and permissions.
- We keep activity and security logs, rate-limit login and one-time-code attempts, and lock accounts after repeated failed logins.
- Sessions can be ended from your account, and expire automatically.
No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.
10. How long we keep information
| Information | How long we keep it |
|---|---|
| Account, business profile and Google sign-in details | While your account is active. After you ask us to delete your account, we delete or anonymise it within 30 days, except as listed below. |
| Orders, bookings, invoices and financial records | While your account is active, and for up to 6 years where Nigerian tax and accounting law requires us to keep records. |
| Login sessions | Up to 90 days, or until you log out or revoke the session. |
| Security and activity logs | Up to 12 months. |
| Server and application logs | Up to 30 days. |
| Support and email correspondence | Up to 24 months after the matter is closed. |
| TikTok connection details (advertiser details and encrypted access token) | Until you disconnect the advertiser or delete your account. On disconnect we revoke the token with TikTok and delete our copy. |
When we no longer need information, we delete it or irreversibly anonymise it. Backups are overwritten on a regular cycle.
11. Your rights and deleting your data
You have the right to:
- ask what personal data we hold about you and get a copy;
- correct information that is wrong or incomplete;
- ask us to delete your personal data;
- object to or ask us to limit certain processing;
- withdraw consent you gave us, such as for marketing messages;
- receive your data in a common, portable format; and
- complain to the Nigeria Data Protection Commission if you think we have handled your data unlawfully.
How to delete your account and data
Email [email protected] from the address on your account with the subject "Delete my account". We will confirm your identity and delete or anonymise your data within 30 days, apart from records we must keep by law, as listed in How long we keep information. If you signed in with Google, you can also remove Zerrar's access in your Google Account permissions. If you connected TikTok, you can also disconnect it from the dashboard, or remove Zerrar's access from your TikTok for Business account settings.
We will respond to other requests within 30 days. We do not charge a fee unless a request is clearly unfounded or excessive.
12. Where your data is processed
Zerrar is based in Nigeria, but some of our service providers (for example cloud hosting, email, messaging and AI providers) may process data in other countries. When your data is transferred abroad, we take steps so that it stays protected, such as using providers with appropriate security commitments and contract terms.
13. Children
Zerrar is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email [email protected] and we will delete it.
14. Changes to this policy
We may update this policy as our product or the law changes. We will change the "Last updated" date at the top and, for significant changes, tell you by email or in the dashboard before they take effect. Using Zerrar after a change means you accept the updated policy. Please also read our Terms of Service.
15. Contact us
Questions about this policy or your data? Contact us:
- Company: Zerrar Technologies Ltd.
- Email: [email protected]
- Phone: +234 816 480 0698 (Monday to Friday, 8am to 6pm)
- Address: Lekki, Lagos, Nigeria