Privacy policy

KERUX8 AGENCY LIMITED (CAC registration number RC 9701590) is the data controller for Plug. You can reach us at hello@kerux8.com or at 156 Ijegun Ikotun Road, Lagos, Nigeria.

If you are a shopper, we collect:

• Your WhatsApp phone number. We receive it automatically when you message us. It is how we identify you across requests — you never create an account.
• The text of what you ask for, including anything else you type into the chat.
• The city or area you give us, so we can match you to nearby vendors. We do not collect GPS or device location.
• Request and quote records: the item or service, quoted price, vendor, your choice and any outcome you report. Plug does not currently process escrow orders.

If you are a vendor, we also collect:

• Your business name and trading address.
• Your email address. We use it for vendor onboarding and account communications, including as a fallback when WhatsApp is unavailable.
• Identity verification. Vendors must pass a NIN and live-selfie review. The application stores the results of checks and the verification reference, not raw NIN or BVN values. Do not send identity documents or bank details in shopper chat.
• Your CAC registration number, if you have one. It is optional and it is not required to be listed.
• Your Instagram handle and a description of how you currently sell, if you give them.
• Your response times, quote history and dispute record, which we use to decide who receives requests.

Plug does not collect shopper purchase payments or card details. Payment is arranged directly with the vendor. Do not include payment credentials in your request.

Web chat uses a session cookie to recognise your browser and retrieve your messages. You do not need to supply a phone number to start a web request. We store web messages, a session identifier and expiry, browser user-agent information, and a hash of the connection address received by the backend. Session expiry does not itself delete message records.

If you use Telegram, Telegram also processes the messages delivered through its service. We store the channel identifier and any profile or contact details you choose to share.

• To match you with a vendor — necessary to perform the service you asked us for (NDPA s.25(1)(b)).
• To review reports about vendors and keep a record of requests and reported outcomes.
• To verify vendors and remove bad actors — our legitimate interest in running a service that buyers can trust.
• To measure how the service is used in aggregate — our legitimate interest in improving it. We count page views on our own server; we do not use third-party advertising or tracking cookies.

We do not sell your data, and we do not use your request text to advertise to you or to anyone else.

• The vendors we match you with. A vendor receiving your request sees what you asked for and your area. Once you choose to contact a vendor, they see your WhatsApp number, because you are messaging them directly.
• Meta Platforms, Inc. When you use WhatsApp, Meta processes messages as part of delivering them through the WhatsApp Business Platform. Their handling is governed by Meta’s own privacy terms.
• Request interpretation providers. When configured, Anthropic processes request text and collected request details that our local parser cannot understand, to identify the item or service, area and budget.
• Our hosting and infrastructure providers, who store the data on our behalf and may not use it for anything else.
• Law enforcement or regulators, where we are legally required to disclose.

Some of these providers operate servers outside Nigeria. Where data is transferred abroad we rely on the transfer conditions in Part IX of the NDPA.

• Request text and matching records: 12 months from the date of the request, then deleted.
• Order and escrow records: 6 years from completion. We are required to keep transaction records, and they are the evidence used to settle any dispute.
• Dispute records: 6 years from resolution, for the same reason.
• Vendor verification results: the outcome of each check and the provider reference, for as long as the vendor is on the platform and 12 months after removal. The NIN and BVN themselves are never stored, so there is nothing to delete.
• Handover codes: never stored in readable form at all. We store only a cryptographic hash, and we never send your code to a vendor.

Under the NDPA you can ask us to:

• Tell you what personal data we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete your data. We will do this except where we are required to keep order or dispute records.
• Stop using your data for a particular purpose, or object to our use of it.
• Withdraw your consent, where we relied on consent.

To make any of these requests, email hello@kerux8.com from a message that lets us match you, or message us on WhatsApp from the number you used. We will respond within 30 days. We may ask you to confirm your identity first, so that someone else cannot request your data.

To ask us to stop messaging you, contact the team using the email address above.

If you think we have handled your data wrongly, tell us first at hello@kerux8.com. You also have the right to complain to the Nigeria Data Protection Commission.

Plug is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has used the service, contact us and we will delete their data.

If we change this policy we will update the date at the top of the page. If the change is significant, we will tell you on WhatsApp before it takes effect.