Privacy Policy

1. Who We Are

PawaBoost is a social media marketing platform operated by PAWABOOST LABS, a business entity based in Nigeria. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the PawaBoost platform at pawaboost.com (the “Platform”).

For privacy inquiries, contact us at: support@pawaboost.com

2. Information We Collect

We collect the following categories of personal data:

• Account Information — name, email address, and hashed password when you register. If you sign in with Google, we receive your name and email address from Google OAuth.
• Payment and Transaction Data — wallet deposit amounts, transaction references, and payment method type (card/bank or crypto). We do not store your full card number, CVV, or bank account details — these are handled directly by our payment processors (Kora and NowPayments).
• Order Data — services purchased, target URLs or usernames submitted with orders, quantities, order status, and delivery records.
• Referral Data — your referral code, which accounts you referred, and commission amounts earned.
• Usage Data — pages visited, actions taken within the Platform, and session metadata (IP address, browser type, timestamps) collected for security and fraud prevention.

3. How We Use Your Information

We use your personal data to:

• Create and manage your account and wallet.
• Process orders and communicate order status updates.
• Process wallet deposits and credits via our payment providers.
• Send transactional emails (password resets, order confirmations, notification alerts) via Resend.
• Detect and prevent fraud, chargebacks, and abuse of the Platform.
• Calculate and credit referral commissions.
• Comply with applicable Nigerian laws and regulations, including NDPR.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

4. Third-Party Service Providers

We share limited data with the following service providers, solely for the purpose of operating the Platform:

• Kora — payment processing for card and bank transfer deposits. Kora receives transaction amounts and payment method details.
• NowPayments — cryptocurrency deposit processing. NowPayments receives transaction hashes and wallet addresses for on-chain verification.
• Resend — transactional email delivery. Resend receives your email address and the content of emails sent on your behalf.
• Google — OAuth authentication (if you choose “Sign in with Google”). Google provides your name and email; we do not receive your Google password.
• Supabase — database infrastructure. Your account, order, and transaction data is stored in Supabase's PostgreSQL database, hosted in secure EU-based data centers.
• SMM Providers — when you place an order, the target URL and quantity are submitted to our upstream SMM providers to fulfil the order. No personal account data beyond the order link is shared.

Each provider operates under their own privacy policy and data processing agreements. Data may be processed outside Nigeria (including the EU and United States) by these providers. We ensure that any such transfers are subject to appropriate safeguards.

5. Cookies and Session Data

We use a single secure, HTTP-only session cookie to maintain your login state. This cookie is strictly necessary for the Platform to function and does not track you across other websites. We do not use advertising cookies, analytics tracking pixels, or any third-party tracking cookies.

6. Data Storage and Security

Your data is stored in a PostgreSQL database managed by Supabase with encryption at rest and in transit (TLS). Passwords are hashed using bcrypt and never stored in plain text. Access to production data is restricted to authorised personnel only.

While we implement industry-standard security measures, no system is completely immune to breaches. In the event of a data breach affecting your personal data, we will notify you within 72 hours as required by applicable law.

7. Data Retention

We retain your personal data for as long as your account is active. Financial transaction records (wallet deposits, order history, commission payments) are retained for a minimum of 7 years for regulatory and financial record-keeping purposes, regardless of account status.

If you request account deletion, your personal identifiers (name, email) are anonymised within 30 days. Transaction and order records may be retained in anonymised form for the financial retention period above.

8. Your Rights Under the NDPR

As a data subject under the Nigeria Data Protection Regulation (NDPR), you have the following rights with respect to your personal data:

• Right of Access — to request a copy of the personal data we hold about you.
• Right of Rectification — to request correction of inaccurate or incomplete data.
• Right of Erasure — to request deletion of your personal data, subject to our legal retention obligations.
• Right to Data Portability — to receive your personal data in a structured, commonly used format.
• Right to Object — to object to processing of your data where we rely on legitimate interests.

To exercise any of these rights, email us at support@pawaboost.com. We will respond within 30 days. We may ask you to verify your identity before processing your request.

9. Children's Privacy

PawaBoost is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected data from a minor, we will delete it promptly. If you believe a minor has registered, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-platform notice. Continued use of the Platform after the updated policy is posted constitutes your acceptance of the changes.

11. Contact

For privacy inquiries or to exercise your NDPR rights, contact PAWABOOST LABS at: support@pawaboost.com