Data Promise

We can only sell what we have. Most of what people fear we have, we don't. This page lists every field — and every commitment about how it's used.

1. Hard commitments

These are not aspirations. If we violate any of them, you have grounds for a public complaint and a regulatory one.

2. What we collect from buyers

Buyers are people using the SnapAct mobile app to scan products, discover shops, and place orders.

3. What we collect from partners

Partners are shops, sellers, and businesses who list on SnapAct. We collect enough to verify the business is real and registered in Nigeria, and to route payments. We hard-reject applications where the documents are fake or unverifiable. Rejected applicants may reapply by email to [email protected].

4. What we collect from riders

Riders deliver high-value goods on behalf of partners and earn through SnapAct. Because goods worth money pass through their hands, our KYC is intentionally thorough — but never gratuitous.

5. What our public APIs return

The fields above are what flow into SnapAct. What flows out to API customers is much smaller — derived signals, never PII.

Trust API (/v1/partner/{id}, /v1/lookup?phone=…)

Marketplaces, banks, and platforms use this to verify a SnapAct partner or rider. The response shape is:

{
  "kyc_tier": "verified",
  "trust_score": 87,
  "completion_rate": 0.94,
  "dispute_count": 2,
  "tenure_days": 213,
  "bond_posted": true
}

No name. No phone. No address. No NIN. No BVN. The phone-lookup variant takes a phone in and returns the same signal shape — no PII echo.

Verified Delivery Proof API (/v1/delivery-proof/{escrowId})

Insurers and lenders use this to confirm a delivery happened. Response includes: GPS pickup/dropoff coordinates, timestamps, handoff phrase confirmation, rider KYC tier (verified/unverified — not name or NIN), and a cryptographic signature. No buyer identity. No rider identity. No goods description.

Verified Inventory API (/v1/inventory)

Brands and platforms use this to check shop-level product availability. Response includes: SKU, partner ID, last-shelf-snap timestamp, GPS coordinates. No partner owner name, no contact phone — the shop's public name and address only.

6. How it's protected

• Encryption at rest: NIN and bank account numbers are encrypted with a server-managed key. System operators see only ciphertext, not the numbers.
• Encryption in transit: HTTPS everywhere, HSTS preload, TLS 1.2+ required.
• Server-mediated only: the frontend never reads the data store directly. Every read and write goes through SnapAct's authenticated API layer. Admin access requires email + password + TOTP-based multi-factor authentication.
• Audit logging: Every sensitive admin action (rider KYC approval, partner profile change, payout configuration) writes to an append-only audit log. We can show you who accessed what, when, and from where.
• Rate limiting: Every authentication and apply endpoint is rate-limited to defeat enumeration and credential stuffing.
• Recurring security audits: systematic reviews conducted May 1, May 12, and May 15, 2026 — findings remediated and verified.

7. Your rights

Regardless of jurisdiction, SnapAct will honor the following requests when emailed from a verified address to [email protected]:

• Export: get a copy of every field SnapAct holds about you, in machine-readable JSON.
• Correction: fix typos or stale info in your profile.
• Deletion: remove your account and associated personal data, subject to legal retention requirements (tax records, dispute history, anti-fraud signals). We will tell you what's retained and why.
• Access log: see the audit trail of who at SnapAct has read your record. Always available on request.

We aim to respond within 14 days. Identity verification may be required before processing.

8. Contact

Privacy questions or data-rights requests: [email protected].
Security concerns (potential leak, vulnerability, suspicious activity): [email protected].
Read alongside our Privacy Policy for the legal framing of the same commitments.