Overcast privacy notice
How Overcast uses personal data
This notice explains the information Overcast collects, the purposes for using it, the people and services it may be shared with, how it is protected, and the choices available to you.
1. Who is responsible for your data
Overcast is the operator of the marketplace and is responsible for the personal data described in this notice. For privacy questions, access requests, correction requests, deletion requests, or security concerns, contact Overcastsupport@getovercast.app.
Some services that help us provide the marketplace may process data under their own privacy terms or as service providers acting on our behalf. We select and configure those services according to the feature they support and the safeguards required for the data involved.
2. Information we collect
We collect only the information needed for the features you use. It may include:
- Account details: legal name, email address, phone number, role, shop name, authentication events, recovery events, and account status.
- Vendor details: bank name, account details used for bank-account verification, resolved account name, delivery settings, shop information, and vendor earnings records. The current signup flow does not require a NIN or BVN.
- Marketplace content: product descriptions, prices, stock, images, ratings, reports, promotion records, and moderation decisions.
- Order and payment data: order IDs, product and delivery details, payment references, provider status, charges, refunds, disputes, release states, and reconciliation records. We do not store card PINs or payment-provider secret keys.
- Location and delivery data: addresses, map coordinates, delivery areas, and location information you choose to provide or allow the device to share.
- Communications: messages, support correspondence, evidence submitted for an order, and notifications.
- Security data: IP address, approximate network location, browser and device characteristics, session identifiers, request metadata, authentication events, and risk signals used to protect accounts and investigate abuse.
3. Why we use personal data
We use personal data to:
- create and secure accounts, authenticate users, recover access, and enforce account restrictions;
- publish listings, show shops, process searches, manage stock, and provide the marketplace;
- verify vendor bank details and associate eligible earnings with the correct vendor;
- create order-specific payment requests, verify provider events, coordinate delivery, and record release decisions;
- process cancellations, refunds, disputes, complaints, and support requests;
- prevent fraud, abuse, duplicate recovery, account takeover, payment misuse, and security attacks;
- maintain accounting, reconciliation, audit, tax, legal, and regulatory records; and
- measure reliability, diagnose failures, and improve performance and safety.
4. Lawful grounds and your choices
Depending on the purpose, processing is based on taking steps to provide a service you request, performing a contract, complying with a legal obligation, protecting the security and integrity of the service, pursuing a legitimate business purpose that does not override your rights, or your consent where consent is required. We do not treat a request for optional marketing or personalisation as necessary to place an order.
Where processing relies on consent, you may withdraw that consent. Withdrawal does not invalidate processing that happened before withdrawal and may mean that a related optional feature is no longer available. We may still retain information where law, payment reconciliation, fraud prevention, security, a dispute, or another lawful exception requires it.
5. Payments, refunds, and earnings records
Overcast does not offer buyer wallets or accept general buyer deposits. A payment is connected to a particular order and payment reference; a cart is only a convenience list for starting separate item payments. Approved refunds are submitted to the original payment method where supported. The normal refund process does not ask a buyer to enter a bank account. If the payment service reports an exception that cannot be resolved through the original method, support may request limited information through a verified channel.
Vendor earnings are recorded against completed marketplace orders. Bank-account information is used for verification and eligible settlement processes and is not a public profile field. Transaction records may be retained for payment reconciliation, refunds, disputes, chargebacks, accounting, security, and legal obligations.
6. Identity documents and sensitive information
Bank-account details used for vendor settlement are restricted to authorised systems and are not public marketplace fields. They are not written to browser-visible profile data, analytics events, browser logs, or ordinary support email. Unless the application clearly introduces a separate, lawful notice and consent flow, Overcast does not request or retain NIN, BVN, or identity-document uploads for ordinary signup or settlement.
Do not send identity documents, passwords, transaction PINs, or payment secrets to support unless support provides a verified secure collection method and explains why it is required.
7. Sharing and international transfers
We may share the minimum information needed with infrastructure, authentication, database, hosting, image-delivery, bank-verification, payment, map, geocoding, email, fraud-prevention, and professional-support providers. We may also disclose information to banks, payment providers, regulators, courts, law-enforcement agencies, advisers, or a successor to the business when a lawful basis exists or it is necessary to protect users, the service, or legal rights.
Some providers may process information outside Nigeria. Where a transfer is required, Overcast applies the safeguards and transfer conditions required by applicable Nigerian data-protection law, the provider arrangement, and the nature of the data.
8. Public, private, and administrator access
Public marketplace pages are designed to show safe listing, shop, availability, and rating-summary information. Bank details, payment records, transaction-PIN hashes, identity numbers, identity documents, private delivery addresses, private messages, moderation evidence, and refund details are restricted by server authorisation and database access policies.
Administrators receive access only where their role requires it. Security and administrator activity may be recorded in an append-only audit log, including the account used, time, IP address, coarse network location, device or browser information, and the action or event. This supports fraud investigation, incident response, accountability, and legal compliance.
9. Retention and deletion
We keep each category only for as long as its purpose, a payment or provider process, a dispute, security need, legal obligation, or legitimate claim requires:
| Category | Retention approach |
|---|---|
| Account and vendor records | While the account is active and for a reasonable period needed for security, support, disputes, and legal obligations. |
| Orders, payments, refunds, earnings, and reconciliation | For the period needed for provider reconciliation, chargebacks, accounting, tax, complaints, disputes, and applicable law. |
| Messages and routine operational data | Until the service purpose ends, a dispute is resolved, or a scheduled deletion process removes or anonymises it. |
| Security and administrator audit records | For as long as needed to investigate abuse, protect the service, demonstrate accountability, and satisfy legal or provider requirements. |
| Identity evidence, where collected | Restricted to the documented verification purpose and retained only for the approved period required by that purpose, law, dispute, or security need. |
When the retention period ends, information is securely deleted or anonymised unless another lawful reason requires continued retention. Deleting an account does not automatically erase records that must be preserved for payment, fraud, security, tax, complaints, or legal claims.
10. Security and incident response
Controls include least-privilege access, database row-level policies, server-side provider calls, HTTPS, secret management, rate controls, restricted administrator functions, append-only security records, data minimisation, and monitoring. No internet service can guarantee that an attack will never occur.
If you suspect account takeover, payment misuse, a data exposure, or a leaked secret, contact Overcastsupport@getovercast.app as soon as possible and share only the minimum necessary detail. We assess and handle suspected breaches according to applicable law and notify affected people or authorities where required.
11. Your privacy rights
Subject to the Nigeria Data Protection Act and applicable exceptions, you may request access to personal data, correction of inaccurate data, deletion, restriction of processing, objection to certain processing, portability where applicable, information about automated decision-making, and withdrawal of consent where consent is the basis.
To make a request, contact Overcastsupport@getovercast.app with the account email and a clear description of the request. We may verify your identity, protect another person's data, refuse or limit a request where a lawful exception applies, and retain information needed for payment, security, fraud prevention, tax, disputes, or legal claims. You may complain to the Nigeria Data Protection Commission if you believe your rights have not been respected.
12. Cookies, local storage, and service changes
Authentication cookies and local browser storage may support login, preferences, the cart, ranking signals, and notifications. The cart is a convenience cache and is rechecked at checkout. Clearing browser storage does not delete server records.
We may update this notice when the service, provider arrangements, data practices, security controls, or applicable law changes. The version and effective date will be updated, and renewed consent or acceptance will be requested where required.
13. Contact and official references
Privacy, data-access, deletion, and security contact: Overcastsupport@getovercast.app.