How VARS handles your data as a vendor

Who we are

VARS is a Lagos home service beauty platform for stylists, barbers, hairstylists, makeup artists, and the customers who book them. We are a CAC-registered entity based in Lagos, Nigeria, and we process your personal data under the Nigeria Data Protection Act 2023 (NDPA).

Data controller: VARS, Lagos, Nigeria. Contact: hello@bookwithvars.com.

VARS has appointed a Data Protection Officer. Data protection queries can be directed to hello@bookwithvars.com.

We do not collect data from anyone under 18.

Information we collect

• Name, email address, and phone number at registration
• A liveness face image captured during identity verification through Youverify, used to confirm your identity. VARS does not store your government-issued ID document; it is referenced by Youverify during the check only. VARS retains just the liveness image and the verification result
• A profile photo, cropped from your liveness image and locked to your account
• Bank account details when you set up payouts, verified via Paystack
• GPS location while you are online, every 5 minutes for zone drift detection, and while en route to a booking for live tracking. Never stored as a historical trail, overwritten on each update
• Service listings, portfolio photos, earnings, and booking history
• Your rolling cancellation record, used for fraud prevention and platform enforcement

How you sign in

VARS supports sign-in via email or phone number, both verified by a one-time code.

Why we collect it

Nigerian data protection law (NDPA 2023) requires a lawful basis for every type of processing. Here is how ours maps:

• Creating and managing your vendor account: contract
• Identity verification (KYC), including biometric liveness data: explicit consent plus legal obligation
• Verifying your bank account for payouts: contract
• Zone-based location monitoring and live tracking while en route to a booking: contract
• Processing bookings and payouts: contract
• Dispute resolution: contract and legitimate interest
• Fraud prevention and platform enforcement: legitimate interest
• Outreach to you before you completed onboarding: consent plus legitimate interest

Where we rely on consent, you can withdraw it at any time (see “Your rights” below).

Portfolio photos

After a completed service, you may upload a photo and request the customer's consent to include it in your VARS portfolio. If the customer declines, the photo is not published and is removed. Approved photos are displayed on your public VARS profile.

Who we share information with

• Supabase: database hosting, authentication, file storage, and edge functions (United States and European Union)
• Paystack: bank verification and payouts (Nigeria)
• Youverify: identity verification, including biometric liveness check (Nigeria)
• Resend: transactional email delivery (United States)
• 360dialog: WhatsApp message delivery (European Union)
• Expo: push notification delivery via Apple APNs and Google FCM (United States)
• Apple: push notification delivery via APNs (United States)
• Vercel: website and admin panel hosting (United States)
• Sentry: crash reporting and error monitoring (United States / EU)
• PostHog: analytics (European Union)

We never sell your data. Each provider processes data under contract and only for the purposes stated.

International transfers

Several of our service providers operate outside Nigeria. When your data is transferred internationally, we protect it through data processing agreements with each provider and safeguards consistent with NDPC guidance.

How long we keep your data

• Vendor account data: your name, contact details, and photo are anonymised immediately when you delete your account. Records we are required by law to keep, such as KYC and payout history below, are retained for their stated periods regardless of deletion
• KYC records (liveness image and verification result): 5 years after the end of the vendor relationship, as required by anti-money laundering law
• Booking records and payout history: 6 years, as required by Nigerian tax law (CITA)
• Dispute records: 6 years
• GPS location: ephemeral, overwritten on each update, never stored as a historical trail

Your rights

Under the NDPA 2023, you have the following rights over your personal data:

• Access: request a copy of the data we hold about you
• Rectification: ask us to correct inaccurate or incomplete data
• Erasure: ask us to delete your data, unless a legal obligation requires retention, for example KYC records for 5 years or financial records for 6 years
• Restriction: ask us to limit processing while a concern is being resolved
• Portability: request your data in a structured, machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: where processing relies on your consent, withdraw it at any time

Use the Privacy and data screen in your account to export your data or delete your account, or email hello@bookwithvars.com. We will respond within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Security

Our security measures include encryption in transit and at rest, row-level security policies so you can only access your own data, hashed passwords, HMAC-authenticated verification webhooks, and access controls limiting each role to the minimum access needed. Your liveness images are stored in a private, access-restricted file store, never a public one.

Analytics and error monitoring

We use PostHog to understand how the app is used and Sentry to capture crash and error reports. Both providers may receive device information, app version, and anonymised usage data. Neither receives payment card details or identity documents. We do not use advertising trackers and we do not sell your data.

Changes to this policy

When we make material changes, we will notify you via the app before the changes take effect. Continued use of VARS after a policy update constitutes acceptance.

Contact

For privacy questions, email hello@bookwithvars.com.