Privacy Policy

01

Introduction

GREYSIG. (“we”, “our”, or “us”) is a fashion brand based in Lagos, Nigeria. We sell clothing and accessories through our online store at greysig.com. This Privacy Policy explains what personal information we collect when you use our website, why we collect it, how we use and protect it, and what rights you have over your data.

By using our website or placing an order, you agree to the practices described in this policy. If you do not agree, please do not use our services.

02

Information We Collect

We collect information you provide directly to us and information generated automatically when you use our site.

Information you provide

• —Full name, email address, and password when you create an account.
• —Shipping address, phone number, and postal code when you place an order.
• —Payment details — processed securely through Flutterwave. We never store your card number or bank credentials.
• —Profile information you optionally save (dial code, default address) for faster checkout.
• —Any messages you send us directly via email.

Information collected automatically

• —Browser type, device type, and operating system.
• —Pages visited, time spent on pages, and referring URLs.
• —IP address and general geographic location (country/city level).
• —Session and authentication tokens stored in your browser's local storage.

Information from third parties

• —If you sign in with Google, we receive your name, email address, and profile picture from Google OAuth.
• —Payment confirmation data (transaction ID, reference, amount) from Flutterwave after a successful payment.

03

How We Use Your Information

We use your information strictly to operate and improve our service:

• —Process and fulfil your orders, including sending order confirmation, shipping, and delivery notifications.
• —Create and manage your account so you can track orders and save shipping details.
• —Send transactional emails — order confirmations, shipping updates, password resets, and email verification links. We use Amazon Web Services Simple Email Service (SES) to send these.
• —Verify your identity and keep your account secure using JSON Web Tokens (JWT).
• —Communicate with you when you contact us with a question or issue.
• —Detect and prevent fraudulent transactions or abuse of our services.
• —Improve our website and product catalogue based on how people use the site.

We do not use your data for advertising profiling or sell it to marketing firms.

04

How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only with the service providers we need to operate:

• —Flutterwave — to process card and bank transfer payments. Flutterwave is PCI-DSS compliant.
• —Amazon Web Services (SES) — to deliver transactional emails.
• —Google — if you choose to sign in with Google, subject to Google's own Privacy Policy.
• —Our hosting and infrastructure providers — servers that run the website and database.

We may also disclose your information if required to do so by Nigerian law or a valid legal process, or to protect the rights, property, or safety of GREYSIG., our customers, or others.

05

Data Storage & Security

Your data is stored on servers within secure cloud infrastructure. We use the following measures to protect it:

• —Passwords are hashed using Django's default PBKDF2-SHA256 algorithm — we never store your plain-text password.
• —Authentication sessions use short-lived JWT access tokens (rotated automatically) and longer-lived refresh tokens.
• —All communication between your browser and our servers is encrypted over HTTPS/TLS.
• —Payment details are handled entirely by Flutterwave — we only receive a transaction reference and confirmation status.
• —Password reset and email verification tokens are single-use, time-limited (1 hour and 7 days respectively), and invalidated after use.

We retain your order records for as long as required to fulfil legal and accounting obligations. Account data is retained while your account is active. If you request deletion, we will remove your personal data within 30 days, except where retention is legally required.

06

Cookies & Local Storage

We do not use third-party advertising or analytics cookies. We use a small number of functional browser storage mechanisms strictly necessary to run the site:

• —Local storage — to keep you signed in between sessions. Your access token and basic profile info are stored locally so you don't have to log in on every visit.
• —Session storage — a short-lived flag used to prevent unnecessary re-authentication within a single browsing session.
• —NextAuth session cookie — used to manage your authentication session if you sign in with Google.

You can clear this data at any time through your browser's developer tools or by signing out. Clearing it will log you out of your account.

07

Your Rights

You have the following rights regarding your personal data:

• —Access — you can view the personal information associated with your account at any time from your account page.
• —Correction — you can update your name, email, phone, and saved address from your account settings.
• —Deletion — you can request that we delete your account and personal data by emailing us.
• —Password changes — you can change your password at any time from account settings, or use the forgot password flow.
• —Opt-out of emails — transactional emails (order confirmations, shipping updates) are necessary for the service and cannot be turned off, but we do not send marketing emails.

To exercise any of these rights, email us at support@greysig.com. We will respond within 3 business days.

08

Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

09

Third-Party Links

Our website may contain links to third-party sites such as our social media pages (Instagram, TikTok, X). We are not responsible for the privacy practices of those sites. We encourage you to read their privacy policies before providing them with any personal information.

10

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If the changes are significant, we will notify you by email. Continued use of the site after changes are posted constitutes your acceptance of the updated policy.

11

Contact Us

If you have any questions about this Privacy Policy or how we handle your data, you can reach us at: