Privacy Policy

1. Overview

NYUZI Crafts Studio ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our marketplace platform at https://nyuzicrafts.com(the "Platform").

2. Information We Collect

Personal Information

• Account Data: Name, email, phone number, password (hashed), role (customer/artisan/admin).
• Profile Data: Avatar, bio, location (city/region), artisan shop details, portfolio images.
• Communication: Messages between customers and artisans via in-platform chat.
• Order Data: Order details, specifications, pricing, status history, ratings, and reviews.

Automatic Collection

• Usage Data: Pages visited, time spent, clicks, referral source.
• Device Data: IP address, browser type, operating system, device identifiers.
• Cookies: Essential, analytics, and preference cookies (see Cookie Policy below).

3. How We Use Your Information

• Provide and maintain the Platform, including authentication and authorization.
• Match customers with artisans and facilitate order management.
• Send transactional emails (order confirmations, status updates, messages).
• Enable in-platform chat between customers and artisans.
• Display artisan profiles and portfolios publicly (with consent).
• Improve the Platform through analytics and user feedback.
• Comply with legal obligations, resolve disputes, and enforce our Terms.
• Send marketing communications (only with your opt-in consent).

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we rely on:

• Contract: To fulfill our Terms of Use (account, orders, chat).
• Legitimate Interest: Platform security, analytics, fraud prevention.
• Consent: Marketing emails, optional profile fields, cookies.
• Legal Obligation: Tax, accounting, law enforcement requests.

5. Information Sharing

We do not sell your personal data. We share data only:

• With Artisans/Customers: Order details, contact info, and messages necessary to fulfill orders.
• Service Providers: Supabase (database/auth), Vercel (hosting), email providers — under data processing agreements.
• Legal Requirements: When required by law, court order, or to protect rights/safety.
• Business Transfers: In a merger/acquisition, with notice and equivalent protections.

6. Data Retention

• Account data: Retained while account is active + 2 years after closure.
• Order & transaction data: 7 years (tax/accounting requirements).
• Chat messages: Retained while order is active + 1 year.
• Analytics/usage data: Aggregated/anonymized after 26 months.
• You may request deletion earlier (see Your Rights below).

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a structured format).
• Withdraw consent (for consent-based processing).
• Lodge a complaint with a supervisory authority.

To exercise these rights, email privacy@nyuzicrafts.com

8. Security

• All data transmitted via HTTPS/TLS. Passwords hashed with bcrypt (via Supabase Auth).
• Row Level Security (RLS) policies in Supabase ensure users only access their authorized data.
• Regular security reviews, dependency scanning, and access controls.
• No system is 100% secure; we will notify you of any breach as required by law.

9. Cookies & Tracking

We use cookies for:

• Essential: Session management, authentication, CSRF protection.
• Analytics: Anonymous usage statistics (Vercel Analytics).
• Preferences: Theme, language, dismissed banners.

You can manage cookies via your browser settings. Disabling essential cookies may break Platform functionality.

10. Third-Party Links

The Platform may contain links to external sites (e.g., artisan social media, payment providers). We are not responsible for their privacy practices. Review their policies before providing information.

11. Children's Privacy

The Platform is not directed to children under 18. We do not knowingly collect data from children. If you believe we have, contact us immediately for deletion.

12. International Transfers

Our servers are hosted in the EU (Vercel) and US (Supabase). By using the Platform, you consent to transfer of your data to these jurisdictions, which may have different data protection laws. We implement appropriate safeguards (SCCs) for such transfers.

13. Changes to This Policy

We may update this Policy. Material changes will be posted on this page with an updated "Last updated" date and notified via email or Platform banner 30 days prior.

14. Contact

Data Protection Officer: privacy@nyuzicrafts.com
Postal: NYUZI Crafts Studio, Dodoma, Tanzania