Privacy

What we collect, why we collect it, and who else sees it.

KIVU Leaf Limited (RC 9572141) is the data controller for information collected through this site. This notice describes what we actually do, not what a template says we might.

What we collect

• When you create an account: your email address (proven by a code), your name, phone number and country, the moment you accepted the terms, and whether you said yes to marketing.
• When you order: your delivery address, what you bought, what you paid, and the payment reference Paystack gives us. As a guest, the name, phone number and email you type at checkout.
• When you ask for or vote on a product: the request, and a random visitor id in a cookie if you are not signed in.
• When you scout: the listings you post — photographs, specifications, colours, sizes — and the handle you chose, which is shown publicly.
• When you review: the review, its rating and any photographs, shown publicly under your first name or handle together with the fact that stands behind it (a delivered order, an earning, membership).
• When you refer: the referral code on your account, which link visitors arrived through, and which orders were placed through it.
• When you turn on alerts: a push subscription issued by your browser. It identifies your browser, not you, and it is linked to your account so alerts about your own orders reach the right device.
• Automatically: your IP address and basic request information in ordinary server logs.

We do not collect or store card details. Payment happens on Paystack's systems and card data never reaches ours.

Why we use it

• To take, fulfil and deliver your order, and to refund you when a price drops.
• To let you look up your own order with a reference and phone number.
• To tell you about your own orders, wallet and Drops through your Inbox, by email and — if you allowed them — by push alert. These are part of the service and are sent whether or not you opted into marketing.
• To tell you about new Drops, price falls and offers, only if you ticked the marketing box, and only until you untick it in your account.
• To work out which products people actually want, so we source those. This uses counts across everyone, not your individual history.
• To operate the referral and scout schemes, where you use them, and to show reviews and listings you chose to publish.

We do not sell your data. We do not send your details to anyone who is not doing one of the jobs listed below.

Who else sees it

• Paystack — to take payment and to issue refunds.
• Resend — the service that delivers our emails (sign-in codes, receipts, Drop notices) to your address.
• Your browser's push service (Google, Apple or Mozilla, depending on the device) — which carries a push alert from us to your device. It sees that a message was sent, not what your account holds.
• Delivery partners — your name, address and phone number, so they can hand you your order.
• Our sourcing and inspection partners — the order quantities and specifications. They do not receive customer names, addresses or phone numbers.
• Our hosting and database providers — who store the data on our behalf and do not use it for anything else.

Cookies

• A signed sign-in cookie, so you stay signed in on this device. Signing out, or deleting your account, ends it everywhere.
• A random visitor id, so that a vote or request from somebody who is not signed in counts once rather than once per tap.
• A referral cookie for 30 days when you arrive through somebody's link, so that a purchase you make is credited to them.
• A cookie holding the phone number you last used, so you do not retype it to back a suggestion. It lasts six months.
• An administrator sign-in cookie, which only exists on staff devices.

We do not use analytics cookies to profile individual visitors.

How long we keep it

Order records are kept for as long as we need them for tax, accounting and dispute purposes. Suggestions and interest data are kept while they are still useful for sourcing. Push subscriptions are deleted automatically as soon as a browser reports that it has discarded one.

Your rights

Under the Nigeria Data Protection Act you can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Your name, country and marketing choice can be changed in your account settings. To delete your account, use "Delete my account" in your settings: it removes your name, contact details, address, alert devices and preferences, signs out every device, and keeps only the amounts of past orders and wallet entries, with no person attached — those are accounting records other buyers' prices were worked out from. Reviews and listings you published stay under "a former member".

Deletion waits for anything still owed to you: a wallet balance must be cashed out first and an order still on its way must arrive. For anything else — a copy of your data, a correction we cannot offer on the screen — write to hello@8pmdrop.com from the address on your account, or include your order reference and phone number so we can identify you without asking for more than we already have.

Marketing consent is asked for separately when you create an account and can be withdrawn at any time from your settings. Withdrawing it stops announcements and offers; messages about your own orders and wallet continue, because they are part of the service.

Security

Traffic to this site is encrypted. Order lookup requires both a reference and the matching phone number. Administrative access is restricted to staff. No system is perfect, and we will tell you promptly if something happens that affects your data.

Contact

Questions, corrections or complaints: hello@8pmdrop.com. If you are not satisfied with our response you can complain to the Nigeria Data Protection Commission.

Last updated 13 September 2026.