This is a good-faith working draft written from the PagePax product and architecture spec. It has not been reviewed by a lawyer. Before launch it must be reviewed by counsel qualified in Nigerian data-protection law (NDPA 2023), including its cross-border-transfer rules. Items marked [CONFIRM] are open questions only the client can answer.
Privacy Policy
Last updated 16 August 2026 · Operated by PagePax Limited Partnership (“PagePax”, “we”, “us”)
On this page
1. Who we are
PagePax is operated by PagePax Limited Partnership, a company registered in Nigeria. PagePax lets people in Nigeria register a subdomain (for example yourname.mystore.ng), publish a page, and — if they choose — sell and collect payments.
[CONFIRM] Registered address of PagePax Limited Partnership.
Contact for privacy matters: [CONFIRM — dedicated address, e.g. privacy@pagepax.com]
Data Protection Officer: [CONFIRM — the NDPA requires a DPO for controllers of major importance; assess whether PagePax qualifies]
2. Who this policy covers
PagePax has more than one kind of user, and we handle each one’s data differently. This policy covers all of them:
| You are | What that means here |
|---|---|
| A page owner / merchant | You signed up, claimed a subdomain, and published a page. Most of this policy is about you. |
| A buyer / customer | You bought something from, or contacted, someone whose page is on PagePax. We handle a limited amount of your data on that merchant’s behalf. |
| A visitor | You browsed pagepax.com or someone’s page without signing up or buying. |
3. What we collect
3.1 From page owners
| Data | Why we need it | Legal basis |
|---|---|---|
| Phone number | Account identity; OTP verification; fraud prevention | Contract |
| Email address | Account recovery, receipts, service notices | Contract |
| Name / business name | Displayed on your page; account records | Contract |
| Page content you create — bio, descriptions, photos, links, product listings, prices | To build and host your page | Contract |
| Persona choice (seller / service provider / individual) | Sets your default page blocks | Contract |
| Subdomain and root domain chosen | To provision and route your page | Contract |
| Subscription and billing status | To operate the trial, Pro plan, and demotion | Contract |
| Device, browser, IP address, approximate location | Security, fraud prevention, and performance | Legitimate interest |
3.2 From page owners who switch on payments
| Data | Why we need it | Legal basis |
|---|---|---|
| Bank Verification Number (BVN) | Regulatory identity verification before you can collect money | Legal obligation / Contract |
| Bank account number and bank name | To create your payment subaccount so money settles to your account | Contract |
| Verification result and reference from our KYC provider | To record that you passed, and to support the Verified badge | Legal obligation |
Your BVN is passed to a licensed KYC verification provider for checking. We do not store your BVN. What we keep is the outcome of the check (passed / failed / needs review), the date, and the provider’s reference. We never see or store your full card details either — those go straight to Paystack.
[CONFIRM] The exact KYC provider (Dojah / Youverify / Smile ID) must be named here once selected, along with a Data Processing Agreement.
3.3 From buyers and customers
When you buy from or contact a page on PagePax, we may handle: your name, phone number, email address, delivery address if given, what you ordered, and the payment reference. We handle this on behalf of the merchant you bought from — they are the primary controller of their customer relationship. Your card details go directly to Paystack and never reach us.
3.4 From visitors
Basic analytics — pages viewed, approximate location, device and browser type, referring site — collected via Google Analytics. See §8 on cookies.
4. What we do with it
- Create and run your account, and publish your page at your subdomain.
- Verify that you are a real person (phone OTP; BVN where payments are involved).
- Enable payments to settle to your own bank account.
- Generate page content with AI (see §5).
- Send you service messages — order alerts, receipts, trial and billing notices — including over WhatsApp and SMS.
- Keep the platform safe: scan new and edited pages for prohibited content, handle abuse reports, suspend bad actors.
- Understand how the product is used, in aggregate, so we can improve it.
We do not sell your personal data. We do not sell or rent your customer list. We do not use your data to advertise other people’s products to you.
5. AI processing — please read this
PagePax uses Anthropic’s Claude to help build your page. When you go through onboarding, the answers you give, the photos you upload, and any text you provide are sent to Anthropic so that a draft bio, headline, or product description can be generated and returned to you.
- You review and can edit everything the AI drafts before it is published. Nothing is published without you seeing it.
- [CONFIRM] Anthropic’s commercial terms and data-retention position must be recorded here, along with a signed DPA, before this goes live.
If you would rather not have AI involved, you can skip the AI interview and write your page yourself. [CONFIRM — product must actually provide this opt-out path.]
6. Who we share it with
We share data only with the services needed to run PagePax:
| Who | What they get | What for |
|---|---|---|
| Paystack | Transaction and subaccount details; buyer payment data | Processing payments and settling money to merchants |
| KYC provider [CONFIRM] | BVN, name, bank account details | Identity verification |
| Termii | Phone number | Sending SMS one-time passwords |
| Meta (WhatsApp Cloud API) | Phone number, message content | Order alerts and notifications |
| Cloudinary | Images you upload | Hosting and optimising your images |
| Anthropic | Onboarding answers, page content | AI content generation (see §5) |
| Cloudflare | Traffic and DNS data | Routing, SSL, security |
| Google Analytics | Usage data | Basic visitor analytics |
| Hosting provider [CONFIRM] | All stored application data | Running the servers and database |
We may also disclose data where we are legally required to — a valid court order, a regulator, or a law-enforcement request — and where necessary to investigate fraud or abuse.
7. Where your data goes (cross-border transfer)
PagePax is operated by a Nigerian company, and several of the services above (Anthropic, Cloudflare, Google, Cloudinary) process data outside Nigeria.
Under the NDPA 2023, transferring the personal data of people in Nigeria out of the country requires an adequate legal basis — an adequacy determination, appropriate contractual safeguards, or your explicit informed consent.
[CONFIRM — this is a genuine open compliance item.] Counsel must confirm the lawful transfer mechanism, and this section must then state it plainly. Do not publish this policy with this section unresolved.
8. Cookies
We use cookies and similar technologies to keep you signed in, remember your preferences, and measure usage. You can control cookies in your browser settings; blocking some will break sign-in.
[CONFIRM] Whether a cookie consent banner is required for the Nigerian audience, and what the default state should be.
9. How long we keep it
- While your account is open, we keep your account and page data so your page stays live.
- If you don’t upgrade after your trial, your account is demoted, not deleted. Your page stays live in a reduced form, and your data is retained, not erased — so that everything is intact if you subscribe later. Your page keeps working; commerce features are switched off.
- Order and payment records are kept for as long as tax and financial-record rules require. [CONFIRM retention period with counsel.]
- KYC verification results are kept for the period required by anti-money-laundering rules. [CONFIRM period.]
- If you ask us to delete your account, we delete or anonymise your personal data except where we are legally required to keep it (see above), and your subdomain is released.
10. Your rights
Under the NDPA 2023 you have the right to:
- Know what personal data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data, where we are not legally required to keep it.
- Object to certain processing, and to withdraw consent where consent is the basis.
- Portability — receive your data in a usable format.
- Complain to the Nigeria Data Protection Commission (NDPC) if you think we have handled your data wrongly.
To exercise any of these, contact us at [CONFIRM address]. We will respond within 30 days.
If you are a buyer and want data held about you by a merchant on PagePax, contact that merchant first — it is their customer record. We will help if they don’t respond.
11. Security
- We never hold your money. Payments are processed by Paystack, a licensed processor, and settle directly to your own bank account.
- We do not store your BVN or your full card details.
- Access to production data is restricted to staff who need it.
- Pages and dashboards are served over HTTPS with SSL across every subdomain.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the NDPC as the law requires.
12. Children
PagePax is for people 18 and over. We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will remove the account.
13. Changes
We may update this policy. If a change materially affects you, we will tell you — by email, in the dashboard, or on this page — before it takes effect. The “last updated” date at the top always reflects the current version.
14. Contact
[CONFIRM — full contact block: registered name and address of PagePax Limited Partnership, privacy email, DPO details.]
Open items before publication
- Registered address of PagePax Limited Partnership.
- Named KYC provider + signed DPA.
- Anthropic commercial terms + DPA; confirm the AI opt-out path exists in the product.
- Lawful cross-border transfer mechanism under NDPA 2023 (§7).
- Retention periods for order, payment, and KYC records.
- DPO appointment and whether PagePax is a “controller of major importance.”
- Cookie consent requirement.
- Full review by Nigerian-qualified counsel.