Privacy Policy
What we collect, why, who sees it, and how to make it go away.
The short version
We collect what the app needs to put you and a nearby seller in touch: who you are, roughly where you are, and what you ordered. We do not sell your data, we do not run advertising networks over it, and we do not track you across other apps or websites. You can delete your account from inside the app or from this website.
On this page
1. Who we are
Wulo is operated by Wulo Technologies Ltd, a company registered in Nigeria. Where this policy says "we", "us" or "Wulo", it means that company. Where it says "the apps", it means Wulo Buyer and Wulo Seller for Android.
This policy is written to be understood. If any part of it is unclear, that is our failing rather than yours — write to privacy@wulo.app and we will explain it and then fix the wording.
2. What we collect
Everything below is collected because a specific feature needs it. Nothing is collected "just in case".
| What | When | Why it exists |
|---|---|---|
| Name, email address, phone number | When you create an account | To identify your account and let the other side of a transaction reach you |
| Password | When you create an account | Stored as a one-way hash, never as readable text, and never visible to us |
| Your chosen buying or selling address, and its coordinates | When you set your area, and whenever you change it | Every distance on Wulo is measured from this point. Without it there is no feed |
| Delivery radius (sellers) | When you set it | Decides which buyers can see your listings |
| Listings: photos, titles, descriptions, prices, category | When a seller creates them | This is the product itself — it is shown publicly to nearby buyers |
| Orders: items, prices, delivery address, your note, timestamps, status | When you place or receive an order | To carry out the order and to show both sides an accurate history |
| Pings: the messages you send a seller about an item | When you send them | Delivered to that seller so they can answer you |
| Ratings: your thumbs up or down after delivery | When you rate an order | To give other buyers a signal about a seller |
| Device identifier and push notification token | When you sign in | So a notification about your order reaches your phone and not someone else's |
| App version, platform, and crash reports | Automatically | To work out which release broke something and fix it |
Permissions the apps ask for
- Location — to place you on the map so we can show sellers who reach you.
- Camera and photos — so sellers can photograph stock and you can set a profile picture. We only ever receive the images you deliberately choose or capture.
- Notifications — to tell you an order was accepted, is on the way, or has arrived.
- Network access — the app talks to our servers.
You can refuse any of these in Android settings. Refusing location will leave the neighbourhood feed unable to work, because there is no neighbourhood without it. Refusing the others degrades individual features but the app still runs.
What we deliberately do not collect
- Card numbers, bank details or any payment credentials — payment is settled directly between buyer and seller, and Wulo never handles it.
- Your contacts, call logs, SMS, or files on your device.
- Continuous or background location. We use the address point you set, not a trail of where you go.
- Any identifier used to follow you across other companies' apps and websites.
3. Why we collect it
Under Nigerian data protection law we need a lawful reason for each use. Ours are:
- To perform our agreement with you — running your account, showing your feed, delivering pings, processing and tracking orders.
- Our legitimate interests — keeping the marketplace safe, preventing fraud and abuse, fixing crashes, and understanding which features are used so we build the right things.
- Your consent — for device permissions such as location, camera and notifications, which you grant and can withdraw in Android settings.
- Legal obligation — where we are required to retain records or respond to a lawful request.
4. Location, specifically
Location deserves its own section because it is the most sensitive thing we hold and the one people most reasonably worry about.
- We store the address point you choose, not a continuous record of your movements. The apps do not track you in the background.
- That point is used to calculate straight-line distance to sellers, and to decide whether a seller's delivery radius reaches you.
- Buyers are not shown a seller's exact coordinates, and sellers are not shown yours — until you place an order, at which point the seller necessarily receives the delivery address, because somebody has to bring your goods to it.
- Changing your area changes your feed immediately. Nothing about your previous area is retained for targeting.
5. Who else sees it
Other users
- A seller you order from sees your name, your delivery address, your phone number, your order and any note you attached. They need all of it to deliver.
- A seller you ping sees your message and your first name.
- A buyer sees a seller's shop name, listings, general area and distance, and their rating. A seller's home address is never published.
Service providers
We use a small number of external services. They process data on our instructions and may not use it for their own purposes:
| Provider | What for | What they receive |
|---|---|---|
| Google Firebase | Push notifications, crash reporting, basic usage analytics | Device token, device and app version, crash diagnostics |
| Google Maps & Places | Turning a place you search into an address and coordinates | The address text you type when choosing your area |
| Our hosting provider | Running the servers and database | Everything above, stored encrypted at rest in our backups |
Everyone else
We do not sell your personal data, and we do not share it for anyone else's advertising. Sponsored placement on Wulo is sold on location and category only — an advertiser pays to appear to people near them, and never receives a list of who saw it.
We will disclose data if we are legally required to, or where it is genuinely necessary to protect someone's safety or to investigate fraud on the platform.
6. How long we keep it
- Your account details — until you delete your account.
- Listings — until you delete them or delete your account.
- Order records — the transaction itself is retained after account deletion, because the other side of it has a legitimate interest in their own trading history and in resolving disputes. What is retained is the order: its number, the items, the prices, the dates and the status. Your name, email, phone number, photo, delivery address and any note you attached are erased from it at the moment you delete, and the record no longer points to you. The other party sees only "Deleted user".
- Pings — deleted along with your account.
- Crash and diagnostic data — kept for a limited period by Firebase under Google's retention settings, then discarded.
- Backups — encrypted, held off-site, and rotated on a fourteen-day cycle, so deleted data can persist in a backup for up to two weeks before ageing out.
What deletion actually does
Deleting your account erases your profile, your password, your saved addresses, your device registration, your pings, and — for sellers — your listings. It also strips your identity out of every past order: the transaction stays so the shop you dealt with keeps its own records, but your name, contact details, delivery address and note are overwritten and the order stops pointing at you. If you would like anything beyond that removed, email privacy@wulo.app and we will handle it manually and confirm when it is done.
7. Your rights
Under the Nigeria Data Protection Act you may:
- Ask what we hold about you, and get a copy of it.
- Correct anything wrong — most of it you can edit yourself in the app.
- Delete your account, in the app or via this website.
- Object to a particular use, or ask us to restrict it.
- Withdraw consent for any device permission, at any time, in Android settings.
- Complain to the Nigeria Data Protection Commission if you think we have handled your data badly. We would rather you told us first, but it is your right either way.
Write to privacy@wulo.app for any of these. We aim to respond within 30 days and will not charge you for a reasonable request.
8. How we protect it
- All traffic between the apps and our servers runs over HTTPS, with certificates properly validated by the app.
- Passwords are stored as one-way hashes. Nobody at Wulo can read your password.
- Administrative access is restricted, individually credentialed, rate-limited against repeated sign-in attempts, and logged.
- Backups are encrypted before they leave our server and stored off-site.
No system is perfectly secure, and anyone who tells you otherwise is selling something. If we ever suffer a breach affecting your personal data, we will notify you and the regulator as the law requires.
9. Children
Wulo is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has created an account, tell us at privacy@wulo.app and we will remove it.
10. Changes to this policy
When we change something material, we will update the effective date at the top and notify you in the app before it takes effect. We will not quietly broaden what we collect and leave you to notice.
11. Contacting us
Privacy questions, data requests and complaints:
privacy@wulo.app
Everything else: support@wulo.app
Wulo Technologies Ltd · Registered in Nigeria