MemoBox Privacy Policy

Last updated: 12 November 2026

This policy explains what personal data the MemoBox app and website collect, why we collect it, who we share it with and the choices you have. It covers the MemoBox mobile app (iOS and Android), the gift page at gift.memobox.com.ng and the MemoBox service behind them.

Who we are

MemoBox is operated by DataLenz Technologies ("MemoBox", "we", "us"), Nigeria.

For anything about this policy or your data, email support@memobox.com.ng.

What we collect

When you create an account

• Your first and last name, email address and password. We store passwords only in hashed form.
• Your phone number, if you add one.
• If you sign in with Google or Apple: the name and email address the provider shares with us, and a sign-in token that we check once to confirm who you are. If you choose Apple's "Hide My Email", we receive the relay address only.

When you send a gift

• Your recipient's name and phone number and/or email address.
• The message you write for them.
• The delivery date or details you choose, and the delivery address your recipient confirms for gift boxes.
• The gift, the order total and the order status.

When you pay

• Payments are handled on the secure hosted checkout of our payment processor (Bachs). You enter your card or bank details on their page, not in MemoBox. We receive only the payment reference, amount, method and whether it succeeded. We never see or store your full card number.

If you register a business (providers)

• Business name, contact name, email, phone number and address.
• Verification documents you upload (such as a CAC certificate or a government ID).
• Photos and descriptions of the experiences you list, your availability and your bookings.
• Bank account details for payouts (bank name, account name and account number).

While you use the app

• Gifts and experiences you save as favourites.
• The city you choose (Lagos or Abuja), so we show what is available there.
• Support requests you send us and our replies.
• A push notification token for your device, if you allow notifications, so we can send order and booking updates.
• Basic technical logs from our servers (such as IP address, time of request and errors), kept for security and troubleshooting.

What we do not collect

• We do not use advertising or analytics SDKs, and we do not track you across other apps or websites.
• We do not collect your precise location.
• We access your photo library only when you choose a picture to upload (for example a business document or experience photo), and only the picture you pick.

How we use your data

• To create and secure your account and let you sign in.
• To process your order, take payment and deliver gift boxes or let recipients book experiences.
• To contact your recipient about the gift you sent them, and only about that gift.
• To send you order, delivery and booking updates by email, push notification or SMS.
• To verify businesses and pay providers for completed bookings.
• To answer support requests, prevent fraud and keep MemoBox safe.
• To meet our legal, tax and accounting obligations.

Our legal bases under the Nigeria Data Protection Act 2023 (NDPA) are: performing our contract with you, your consent (for example push notifications, which you can switch off any time), our legitimate interest in running and securing the service, and complying with the law.

Who we share it with

We share only what is needed to fulfil a gift:

• Experience providers (for example a spa or restaurant) receive the recipient's name, contact details and booking time.
• Delivery partners receive the recipient's name, phone number and delivery address for gift boxes.
• Our payment processor (Bachs) processes your payment.
• Service providers that host our servers, send our emails, SMS and push notifications, and store files, acting on our instructions.
• Authorities, when the law requires it, or to protect the rights and safety of our users or MemoBox.

We do not sell your personal data, and we do not share it for advertising.

Some of our service providers may process data outside Nigeria. When that happens we rely on the safeguards the NDPA allows, such as contractual protections.

How long we keep it

• Account data: for as long as your account is open.
• Orders and payment records: for as long as Nigerian tax and accounting law requires (usually six years), even after you delete your account.
• Support requests: up to two years after they are closed.
• Server logs: up to 90 days.

Deleting your account

You can delete your account yourself at any time:

• In the app: Profile → Delete account. You confirm with your password or by signing in with Google or Apple again. Your profile and personal data are deleted; records we must keep by law are kept, separated from your profile, until the retention period ends.
• Businesses: Profile → Delete business account sends us a deletion request. We complete it after any open bookings and payouts are settled.
• Without the app: follow the steps at https://api.memobox.com.ng/account/delete, or email support@memobox.com.ng from the address on your account.

Your rights

Under the NDPA you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it to another service, and you can withdraw consent at any time. Email support@memobox.com.ng and we will reply within 30 days. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Security

Data is encrypted in transit (HTTPS). Sign-in tokens on your device are kept in the system's secure storage. Access to personal data is limited to staff and partners who need it.

Children

MemoBox is for people aged 18 and over. We do not knowingly collect data from children. If you think a child has given us data, contact us and we will delete it.

Changes

If we change this policy we will update the date above, and tell you in the app or by email if the change is significant.

Contact

DataLenz Technologies (MemoBox) — support@memobox.com.ng