What we do with your data

01Who we are

Nayeli Hair & Co. sells braiding hair and arranges installation in Lagos and Abuja. We are the data controller for everything described on this page — meaning we decide what is collected and why, and we are the ones you hold responsible for it.

Both the email address and the WhatsApp line reach us. Use the email address if you want a written trail — for a data request, that is the better one.

Our Data Protection Officer

We have not appointed one yet. The Nigeria Data Protection Act 2023 requires a Data Protection Officer once a business handles personal data at a certain scale, and we are working through whether we have crossed that line and who the right person would be. Until that is settled, privacy requests go to info@nayelihairandco.com and the owner handles them herself. When a DPO is appointed, their name and contact details will be printed in this section.

Our NDPC registration

We do not have a registration number to show you yet. When the Nigeria Data Protection Commission issues one, it will appear here. We would rather leave this blank than put a number on the page that does not exist.

02What we collect, and why

We do not collect anything for the sake of having it. Each item below exists because something you asked us to do cannot happen without it.

• Name, email address, phone number So we can confirm your order, send your receipt, and reach you if something about your delivery changes. Lawful basis: performing the contract you entered when you placed the order.
• Delivery address and landmark So the hair, or the stylist, arrives at the right gate. Lawful basis: performing the contract.
• Your order and booking history So we can answer “what did I buy last time”, honour a replacement, and keep our books straight. Lawful basis: performing the contract, and our legal duty to keep accounting records.
• Payment references The reference number our payment processor hands back after a payment — enough to prove a payment happened, and to trace it if it did not. We never see, receive or store your card number, expiry date or security code. Those go straight to the payment processor and never touch anything we run.
• Messages you send us WhatsApp and chat conversations about an order, kept so that what was agreed is not lost between us. Lawful basis: performing the contract, and our legitimate interest in being able to settle a disagreement about what was said.
• Basic visit statistics Which pages were opened, a random identifier for the browsing session, and a rough device category such as “phone” or “desktop”. No name, no email address, no precise location. Lawful basis: our legitimate interest in knowing whether the site works on the phones our customers actually use.
• A photograph of your face Only if you choose to use the try-on. Nothing else on this site asks for your face, and you can buy hair from us without ever giving us one. Lawful basis: your explicit consent, given at the moment you upload, and withdrawable at any time.

03The try-on, the AI behind it, and your photograph

If you use the try-on, here is the whole of it, with nothing left out.

The photo you choose is sent to an artificial-intelligence image service run by OpenAI, in the United States. It is sent for one reason: so that a preview of your chosen shade on your own face can be generated. It is not used to train anyone's model, it is not sold, it is not published, and it is not shared with anyone beyond that one service.

The preview that comes back is generated by that AI, not photographed. It is a picture a computer has made of what the hair could look like on you. It is an approximation — the colour, the length and the way it falls are matched as closely as we can manage, and they will still not be exact. It is not a photograph of you. If you are unsure about a shade, message us and we will tell you what that shade really does, rather than leaving you to decide from a preview.

The photo you uploaded is deleted once the preview has been generated. We keep the generated preview, not your original photograph.

The generated preview is kept for 28 days, then deleted. That is 28 days for the copy on your phone and 28 days for the copy on your Nayeli profile — the same number on both sides. You can delete it yourself sooner, at any time, and you can ask us to delete it sooner by writing to info@nayelihairandco.com.

Our own photographs

The model and product photographs that belong to Nayeli — including the internal image files the try-on uses behind the scenes to do its work — are never sent to OpenAI or to any other outside company. They stay on our own systems. That is not a preference we could change our minds about quietly: it is a rule written into how the system is built, and every release is checked against it.

If you would rather not

Declining the try-on costs you nothing. No photo is uploaded, no preview is generated, nothing about your face is stored, and every shade, length and price on this site is still yours to browse. The try-on is a convenience, not a gate.

04Sending your data outside Nigeria

Some of what we hold leaves Nigeria. We would rather say so plainly than bury it.

The United States, where the image-generation service and some of our other suppliers operate, has not been recognised by the Nigeria Data Protection Commission as offering an adequate level of protection. That means we cannot rely on adequacy to send your photograph there.

So we rely on your explicit consent, under section 43(2) of the Nigeria Data Protection Act 2023. You give it at the moment you upload, for that upload. We record the exact wording you agreed to — the words themselves, not a pointer to a file we could quietly edit later — together with the date, so that the question “what did she actually agree to, and when” always has an answer.

You can withdraw that consent at any time. Withdrawing it does not undo a preview that has already been generated, but it stops any further upload, and if you ask us to, we delete what we still hold.

05Who else touches your data

We use other companies to do things we cannot do ourselves — take a card payment, send a text message, deliver a parcel. Each of them receives only the specific pieces it needs to do its part, and none of them is allowed to use your data for its own purposes.

• OpenAI United States Generates the try-on preview with AI. Receives the photograph you upload, and nothing else — no name, no phone number, no order.
• Paystack Nigeria Takes card and bank payments. Receives your name, email address, the amount, and a payment reference. Your card details go to Paystack directly and never reach us.
• ShipBubble Nigeria Checks delivery addresses and quotes delivery rates. Receives your name, phone number and delivery address.
• Our SMS provider Not chosen yet Will send sign-in codes and order updates by text message, and will receive your phone number and the message sent to it. We have not picked the company yet. Its name and the country it operates from will be printed here before the first message is sent.
• Our email provider Not chosen yet Will send sign-in codes and receipts, and will receive your email address and the contents of the message we send you. We have not picked the company yet. Its name and the country it operates from will be printed here before the first email is sent.
• Meta Platforms United States / Ireland · WhatsApp Carries the WhatsApp conversation about your order. Receives your phone number and whatever is said in that conversation — the same as any WhatsApp chat.

We do not sell your data. We do not rent it, trade it, or hand it to advertisers. There is no list of Nayeli customers for sale anywhere, and there will not be one.

06How long we keep things

• Your try-on photo Deleted as soon as the preview has been generated.
• The generated preview 28 days on your phone, 28 days on your Nayeli profile, then gone from both. Sooner, if you delete it.
• Your name, email, phone and address For as long as you have an account with us. Removed when you ask us to erase you.
• Order and payment records Six years, even after an erasure request. The next section explains that one properly — it has a catch, and we are not going to hide it.
• Visit statistics Kept in aggregate. They are not attached to your name and cannot be traced back to you.

07Your rights, and how to use them

Under the Nigeria Data Protection Act 2023 you have the rights below, and you do not need to give a reason for using any of them.

• Access — ask what we hold about you. We send you a copy of all of it.
• Correction — tell us something is wrong and we fix it. A misspelt name or a changed phone number is a message, not a form.
• Erasure — ask us to delete you. We do, apart from the accounting records explained in the next section.
• Objection — tell us to stop using your data for something we are doing on the basis of our own legitimate interest.
• Withdrawal of consent — take back a consent you gave, including the consent to send your photograph abroad, at any time and without explaining yourself.

If we get it wrong

Tell us first — we would much rather fix it than be reported for it. But you are entitled to go straight to the regulator, and you can complain to the Nigeria Data Protection Commission about how we have handled your data, whether or not you have raised it with us.

08What erasure deletes, and what it cannot

If you ask us to erase you, most of it goes completely and one part does not. Here is the honest split.

Deleted outright

• Every photograph and every generated preview we hold of you. This is the most sensitive thing we have and there is no reason to keep it.
• Your saved delivery addresses.
• Your sign-in records, your active sessions, and any unused one-time codes.

Stripped of your identity

• Your name, email address and phone number are replaced with placeholders, so the account can no longer identify you.
• What you wrote in chat messages is replaced with “[erased]”. That a conversation happened remains on record; what was said in it does not.

Kept, for six years

We keep the record of what you bought and what you paid, without your name attached to it, for six years, because the law requires us to. Nigerian tax and accounting rules oblige us to be able to show what money came in and what it was for. What survives is an order, an amount and a date attached to an anonymous account number — not a person we can identify.

The same is true of our internal audit trail and of the record of the consents you gave. Those exist precisely so that our account of events can be checked, which only works if they cannot be quietly rewritten afterwards. They are kept unchanged, and once you have been erased they no longer carry your name.

09Changes to this page

When what we do changes, this page changes first, or at the same time — never afterwards. The date at the top tells you when it was last revised.

If a change affects something you have already consented to, we do not quietly reinterpret the old agreement. We ask you again, and we keep the record of what you agreed to the first time.

Questions about any of it: info@nayelihairandco.com or +234 906 628 2094.