Privacy Policy

Owambe Tribe ("we", "us", "our") is a vendor review platform for the Nigerian wedding and events industry. We are the data controller for personal data collected through this website.

• Account data: name, email address, phone number, profile photo, and role (bride, reviewer, or vendor).
• Review content: ratings, written reviews, photos you upload, and the price you paid.
• Planning data: wedding budget, checklist, timeline, guest list, and inspiration board entries (bride accounts only).
• Usage data: pages visited, search queries, vendor views, and actions taken — collected to improve recommendations.
• Consent records: terms-acceptance timestamp, version, and IP address — retained to evidence lawful processing.
• Payment metadata: payment reference and amount (we do not store card numbers; payments are processed by Paystack).
• Communications: messages sent between brides and vendors through the platform.

• To create and manage your account and provide platform features.
• To display reviews, ratings, and vendor profiles to other users.
• To send transactional emails (email verification, password reset, review status, payment receipts).
• To match brides with suitable vendors based on category, location, budget, and style.
• To detect and prevent fraud, spam, and policy violations.
• To comply with legal obligations and respond to regulatory requests.

We process your data on the following legal bases: contract (to deliver the service you signed up for), legitimate interests (platform safety, fraud prevention, analytics), and consent (marketing emails — you may withdraw at any time).

We do not sell your personal data. We may share data with:

• Paystack — payment processing.
• SMTP providers — transactional email delivery.
• Law enforcement — when required by Nigerian law or court order.

Reviews you submit are publicly visible and associated with your display name.

We retain account data for as long as your account is active. If you delete your account, we remove your personal profile within 30 days. Reviews may be retained in anonymised form to preserve the integrity of vendor ratings. Audit logs are retained for 2 years for compliance purposes.

• Access & portability: Download all your data from Account → Export My Data.
• Correction: Update your profile information at any time.
• Deletion: Request account deletion from Account Settings.
• Withdraw consent: Unsubscribe from marketing emails via notification preferences.
• Lodge a complaint: Contact NITDA (Nigeria's data protection authority) if you believe we have mishandled your data.

Passwords are hashed with PBKDF2-SHA256 (120,000 iterations). Tokens are cryptographically random. We apply rate limiting, input sanitisation, and content security headers. File uploads are validated against MIME type and magic bytes.

We use two session cookies: vr-token (authentication) and vr-role (role-based routing). We do not use advertising or tracking cookies.