Privacy Policy

01

Introduction

GREYSIG. (“we”, “our”, or “us”) is a fashion brand based in Lagos, Nigeria. We sell clothing and accessories through our online store at greysig.com. This Privacy Policy explains what personal information we collect when you use our website, why we collect it, how we use and protect it, and what rights you have over your data.

We handle personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and the regulations made under it by the Nigeria Data Protection Commission.

By using our website or placing an order, you agree to the practices described in this policy. If you do not agree, please do not use our services.

02

Information We Collect

We collect information you provide directly to us and information generated automatically when you use our site.

Information you provide

• —Full name, email address, and password when you create an account.
• —Shipping address, phone number, and postal code when you place an order.
• —Payment details — processed securely by Flutterwave (card) or ProvidusBank (bank transfer). We never store your card number, CVV, PIN or bank credentials.
• —Profile information you optionally save (dial code, default address) for faster checkout.
• —Any messages you send us directly via email.

Information collected automatically

• —Browser type, device type, and operating system.
• —Pages visited, time spent on pages, and referring URLs.
• —IP address and general geographic location (country/city level).
• —Session and authentication tokens stored in your browser's local storage.

Information from third parties

• —If you sign in with Google, we receive your name, email address, and profile picture from Google OAuth.
• —Payment confirmation data (transaction reference, settlement details, amount) from Flutterwave for card payments, or from ProvidusBank for bank transfers.

03

How We Use Your Information

We use your information strictly to operate and improve our service:

• —Process and fulfil your orders, including sending order confirmation, shipping, and delivery notifications.
• —Create and manage your account so you can track orders and save shipping details.
• —Send transactional emails — order confirmations, shipping updates, password resets, and email verification links. We use ZeptoMail, a service of Zoho Corporation, to send these. We do not send marketing email through it.
• —Verify your identity and keep your account secure using JSON Web Tokens (JWT).
• —Communicate with you when you contact us with a question or issue.
• —Detect and prevent fraudulent transactions or abuse of our services.
• —Improve our website and product catalogue based on how people use the site.

We do not use your data for advertising profiling or sell it to marketing firms.

04

How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only with the service providers we need to operate:

• —Flutterwave — to process card payments. Flutterwave is PCI-DSS compliant. Card details are entered on Flutterwave's own secure form and are never seen by or stored on our systems.
• —ProvidusBank — to process bank transfers. When you choose to pay by transfer we ask Providus to generate a virtual account number for your order, and they notify us when your payment arrives. We share your name and order reference with them for this purpose.
• —ZeptoMail (Zoho Corporation) — to deliver transactional emails such as order confirmations, shipping updates, password resets and email verification. We do not use it for marketing.
• —Cloudinary — to host and deliver product images and media on our site.
• —Google and Apple — only if you choose to sign in using their services, and subject to their own privacy policies.
• —Amazon Web Services and Vercel — hosting for our website, application servers and database.

We may also disclose your information if required to do so by Nigerian law or a valid legal process, or to protect the rights, property, or safety of GREYSIG., our customers, or others.

05

Data Storage & Security

Your data is stored on servers within secure cloud infrastructure. We use the following measures to protect it:

• —Passwords are hashed using Django's default PBKDF2-SHA256 algorithm — we never store your plain-text password.
• —Authentication sessions use short-lived JWT access tokens (rotated automatically) and longer-lived refresh tokens.
• —All communication between your browser and our servers is encrypted over HTTPS/TLS.
• —Payment details are handled entirely by our payment providers. For card payments we receive only a transaction reference and confirmation status from Flutterwave — never your card number, CVV or PIN. For bank transfers we receive only the settlement details Providus sends us, and we verify every one directly with the bank before treating an order as paid.
• —Password reset and email verification tokens are single-use, time-limited (1 hour and 7 days respectively), and invalidated after use.

Our servers are located in Paris, France. Because we operate from Nigeria, this means your personal data is transferred outside Nigeria for storage and processing. We rely on our hosting provider’s contractual data protection commitments to safeguard it, as permitted under the Nigeria Data Protection Act 2023.

We retain your order records for as long as required to fulfil legal and accounting obligations. Account data is retained while your account is active. If you request deletion, we will remove your personal data within 30 days, except where retention is legally required.

06

Cookies & Local Storage

We do not use third-party advertising or analytics cookies. We use a small number of functional browser storage mechanisms strictly necessary to run the site:

• —Local storage — to keep you signed in between sessions. Your access token and basic profile info are stored locally so you don't have to log in on every visit.
• —Session storage — a short-lived flag used to prevent unnecessary re-authentication within a single browsing session.
• —NextAuth session cookie — used to manage your authentication session if you sign in with Google.

You can clear this data at any time through your browser's developer tools or by signing out. Clearing it will log you out of your account.

07

Your Rights

You have the following rights regarding your personal data:

• —Access — you can view the personal information associated with your account at any time from your account page.
• —Correction — you can update your name, email, phone, and saved address from your account settings.
• —Deletion — you can request that we delete your account and personal data by emailing us.
• —Password changes — you can change your password at any time from account settings, or use the forgot password flow.
• —Opt-out of emails — transactional emails (order confirmations, shipping updates) are necessary for the service and cannot be turned off, but we do not send marketing emails.

To exercise any of these rights, email us at support@greysig.com. We will respond within 3 business days.

08

Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

09

Third-Party Links

Our website may contain links to third-party sites such as our social media pages (Instagram, TikTok, X). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing them with any personal information.

10

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If the changes are significant, we will notify you by email. Continued use of the site after changes are posted constitutes your acceptance of the updated policy.

11

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, you can reach us at: