Privacy Policy
How Webift handles personal data on its website and for merchant accounts, and your rights under Nigerian data protection law.
1. Who we are
Brain and Cash Tech Limited ("Webift", "we", "us") operates webift.com. Registered address: No 03, Peace Avenue.
Privacy contact: info@webift.com.
2. What this policy covers
The personal data we handle when you visit webift.com and when you open a Webift merchant account. It also explains our role when you buy from a store on Webift. For cookies in detail, see our Cookie Policy.
When you buy from a Webift store. Each store belongs to a merchant. The merchant decides what customer data it collects and why (for example to take and deliver your order and to contact you), and is responsible for how it uses that data and for its own privacy notice and store cookies. Webift provides the platform and handles customer, order and payment details on the merchant's behalf in order to run the store: storing orders, passing payments to the payment provider offered at checkout and sending order emails. Webift also keeps limited records for its own purposes, such as security, preventing fraud and abuse, billing the merchant, resolving disputes and meeting legal obligations. To see, correct or delete data from a purchase, contact the merchant first; you can also email us and we will pass your request on or help as the law requires.
3. Information about your visit (only if you accept)
You choose in the cookie banner. If you accept, we and our providers collect:
- A random visitor ID in the
wb_vidcookie. It is not derived from your name, email or IP address. - How you arrived: the referring website's name (host only), campaign tags (utm_source, utm_medium, utm_campaign, utm_content), the blog article if any, and the first page you landed on (
wb_attr). - Page views and clicks on "create a store" buttons: page type, page path (without the query string), blog article, channel (for example Google search, a social site or direct), referring site name, campaign tags and time, stored under your visitor ID.
- Through Google Analytics 4: page views (page address, title, blog article), "create a store" clicks, and Google's standard measurements (scrolls, outbound link clicks, site search, form interactions, video views and file downloads), plus Google's identifiers (the
_gacookies). As with any web request, your browser gives Google your device and browser type, language and approximate location derived from your IP address; Google states that it does not log or store IP addresses. - Through Meta's measurement pixel, which runs only on our home page and sign-up page: your page view, a "registration completed" event from your browser when you create an account, and Meta's own identifiers (
_fbp, and_fbcif you arrive from a Facebook or Instagram ad), so Meta can measure how our marketing performs. We do not add your name, email address, phone number or store details to these events. - When you register, if you had accepted analytics, we link your new account to your visitor ID, how you arrived, and your Google Analytics client and session IDs, in our own database, so we can learn which pages bring merchants. This link is not sent to Google or Meta.
Browser events and server events. The Google and Meta events described above are sent by your browser, and only after you accept. At present we do not send any events from our own servers to Google or Meta. If we start to, we will say so here first, send them only for visitors who accepted, and cancel any that are still waiting if you withdraw.
If you reject when the banner first appears, nothing optional is ever loaded, so we collect none of the above. If you registered without accepting, we record only that you registered without consent: no visitor ID or source is stored and nothing is sent to Google or Meta.
Whatever you choose we keep a simple total of how many times each blog article was read. To avoid counting a reload twice, our server remembers for 30 minutes a scrambled (hashed) fingerprint made from your IP address and browser type; it is not stored in our database. We never store your IP address or browser details in our analytics tables. Our hosting provider's server logs, which are separate, record IP addresses and browser types for security and operations.
Loading our pages also makes your browser fetch fonts and rendering files from Google, and blog images from our Cloudflare storage; those providers receive your IP address and browser details as part of that request, whatever you choose in the banner.
4. Information for merchant accounts
When you register or use Webift we process the details you give us (such as your name, email address, phone number and business name), your store's content, products and orders, subscription and billing records, and payments handled through the payment providers you or we enable (currently Paystack and Flutterwave). We send account and transactional emails through our email provider (Brevo) and keep uploaded files with our storage provider (Cloudflare). We keep this information to provide the service, for support, for billing, and as the law requires.
5. Why we use it
| Purpose | Basis |
|---|---|
| Understand which content and channels bring visitors and merchants; measure our marketing | Your consent, which you can withdraw at any time |
| Remember your cookie choice; keep our website secure | Necessary to provide the website; our legitimate interest in security |
| Provide and support your merchant account, billing and payments | Performance of our contract with you |
| Meet legal, tax and accounting obligations; prevent fraud | Legal obligation; our legitimate interests |
6. How long we keep it
| Data | Retention |
|---|---|
wb_consent / wb_vid / wb_attr cookies | 180 / 395 / 90 days |
| First-party analytics events | 395 days, then deleted automatically |
| Attribution record linked to a merchant account | The visitor ID, landing page, referrer and campaign details are removed after 395 days; the channel and dates remain for as long as the merchant record exists |
| Hashed blog-view fingerprint | 30 minutes |
| Google Analytics event data | 14 months (user-level data is not extended when you return) |
| Google Search Console data (aggregate search queries and clicks, no personal data) | Up to 16 months |
| Merchant account, billing and order records | While your account is active and as needed afterwards for legal, tax and accounting purposes |
7. Who receives it
- Google LLC: Google Analytics 4 (we keep Google signals and ad personalisation off, and the optional data-sharing settings off) and Google Search Console (aggregate search performance, no visitor-level data); Google Fonts and Google-hosted rendering files.
- Meta Platforms: the measurement pixel in your browser, as described above, only if you accepted.
- Our service providers for payments, email, file storage and hosting, as described in section 4.
- We do not sell personal data.
8. Transfers outside Nigeria
Google, Meta and some of our other providers may process data in other countries, including the United States.
9. Your rights
Under the Nigeria Data Protection Act 2023 you may, subject to the law: be informed about how we use your data; access it; correct it; ask us to delete it; object to or restrict its processing; withdraw consent at any time; receive your data in a portable form; and not be subject to decisions made solely by automated means that have legal effect (we make none).
Rejecting at the start and withdrawing later are different. If you reject when the banner first appears, Google's and Meta's scripts are never loaded and nothing is collected or sent. If you accept and later withdraw, those scripts have already run and some of what they collected has already reached Google or Meta.
To withdraw analytics and marketing consent, use Cookie settings in the footer and choose Reject. This deletes the analytics events linked to your visitor ID, removes the link between your account and your visitor and Google IDs, deletes your analytics and Meta cookies from your browser, and switches off Google's and Meta's scripts in the page you are viewing, which are not loaded again on later pages. We cannot recall events your browser already sent to Google or Meta while you had accepted: they stay with Google or Meta under their own retention settings, and you can email us if you want us to ask them to delete them. If you have already cleared your cookies, email us and we will help.
To exercise your rights, email info@webift.com. You may also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
10. Security
Our analytics cookies are first-party, Secure and SameSite=Lax; analytics credentials are encrypted at rest; and access to analytics reports is limited to Webift Super Admins.
11. Children
Webift is not intended for people under 18 and we do not knowingly collect their data.
12. Changes
We will post updates here, and ask for your consent again where a change affects processing that relies on your consent.