Privacy policy

O'Pearlz Cakes 'N' More (“O'Pearlz”, “we”, “us”) bakes and delivers cakes, small chops and snacks from 39 Awonusi Str., Ikotun, Ijegun, Lagos. This policy explains what personal information this website collects, why we collect it, who we pass it to and what you can ask us to do with it.

It covers everyone who uses the shop — whether you browse without signing in, check out as a guest, keep an account, leave a review or open a support ticket. We are the data controller for that information under the Nigeria Data Protection Act 2023 (NDPA), which means we decide what is collected and we are the ones answerable for it.

We collect what an order or an account genuinely needs, and no more. Where a field is optional we say so — leaving it blank never breaks anything.

• Account details — Your name, email address and a password. Passwords are hashed before they are stored and are left out of every API response, so nobody at O'Pearlz can read yours.
• Optional profile details — Phone number, date of birth, gender and a profile photo. All four are optional.
• Delivery addresses — Recipient name, phone number, street, city, state, country and postal code for each address you save. The address used on an order is copied onto that order, so an old receipt stays accurate even after you edit or delete the saved address.
• Order history — The items, quantities, unit prices, delivery fee, total, currency, payment status and delivery status of everything you buy.
• Payment records — The amount, currency, outcome, our own payment reference and the reference our payment provider hands back. We never receive your card number — see section 5.
• Support tickets — The name, email address, phone number, subject and message you send us, plus the order it relates to if you attach one. You can raise a ticket without an account.
• Reviews — Your rating, your comment and the display name shown beside it. A guest reviewer may leave an email address so we can follow up; guest email addresses are never shown publicly.
• Security and activity records — For security and troubleshooting we log significant actions — sign-ups, logins, payments, admin changes — with your IP address, your browser's user-agent string and a timestamp.
• WhatsApp messages — If you reach us on the WhatsApp numbers we publish, we see your WhatsApp display name, your number and whatever you write. That conversation lives in WhatsApp rather than in our database — we only copy something out of it into a support ticket when we need it to sort out your order.
• Newsletter status — Whether you are opted in to promotional email, so a broadcast only reaches people who want it.
• Google sign-in details — Only if you choose “Continue with Google”: Google sends us the name, email address and profile picture on your Google account, and nothing else. Your Google password never reaches us.

Guest checkout.If you order without signing up, we create an account from the email and delivery details you enter so you can track the order, and we email you a password you can change whenever you like. If you'd rather not keep it, ask us and we'll remove it.

Under the NDPA every use of your information needs a lawful basis. Here are ours, and what each one covers.

• To perform our contract with you — Taking payment, baking and delivering your order, sending confirmations, delivery updates and payment reminders, and handling refunds, replacements and complaints.
• Because you consented — Promotional email about new products, offers and seasonal menus. You can withdraw that consent at any time — it changes nothing about an order you have already placed.
• For our legitimate interests — Keeping the shop secure and free from fraud, holding stock so the same tray isn't sold twice while a payment is in flight, seeing which products sell, and fixing what's broken. We use the least information that does the job.
• To meet a legal obligation — Keeping tax, accounting and transaction records for as long as Nigerian law requires.

We do not profile you for advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

We use very few, and none of them are for advertising. There are no third-party analytics scripts, no advertising pixels and no cross-site trackers on this site.

• jwt (cookie, strictly necessary) — Set when you log in; it is how the next page knows it's still you. It is an httpOnly cookie, so no JavaScript running in the page — ours or anyone else's — can read it. Logging out clears it.
• theme (browser local storage) — Remembers whether you chose the light or dark look.
• Your cart (browser local storage) — Keeps the basket intact if you close the tab before checking out. It stays in your browser until you order or empty it.

Local storage entries live in your browser and are not sent to us. Clearing your browsing data removes them — including an unfinished cart. Blocking the jwtcookie still lets you browse and fill a basket, but you won't be able to stay signed in. Stripe sets its own cookies on its payment page; those are covered by Stripe's policy, not this one.

Card payments are taken by Stripe on Stripe's own hosted checkout page. Your card number, expiry date and security code are typed into Stripe's page and go straight to Stripe. They never pass through our servers and are never stored by us.

We send Stripe your email address and the items being paid for, so it can show you the right basket and email you a receipt. What comes back to us is the amount, the currency, the outcome and Stripe's reference, which we keep against your order for accounting and refunds. Stripe handles what it collects as an independent controller under its own privacy policy.

We do not sell your personal information, and we never rent or trade our customer list. We share it only with the providers that make the shop work, each acting on our instructions and only for the purpose listed.

• Stripe

  Card payments

  Your email address and the items/amount being paid. Card details go straight to Stripe and never reach us.

  Processed in: United States / European Union

• Brevo

  Order emails, verification links and the newsletter

  Your name, email address and the contents of the message we send you.

  Processed in: European Union

• Cloudinary

  Image hosting

  Profile photos you upload, and our own product photography.

  Processed in: United States / European Union

• MongoDB Atlas

  Database hosting

  Everything listed under “What we collect” — this is where the shop's records live.

  Processed in: Managed cloud region

• Redis (managed cache & job queue)

  Speeding up the catalogue and running background jobs

  Short-lived copies of pages you request and of queued email jobs.

  Processed in: Managed cloud region

• WhatsApp (Meta)

  Chatting with us on the numbers we publish

  Only if you message us: your WhatsApp display name, your number and whatever you write. The conversation stays in WhatsApp — it is not copied into our database.

  Processed in: Operated by Meta, outside Nigeria

• Google

  “Continue with Google” sign-in

  Only if you choose it: Google gives us the name, email address and picture on your Google account. Your Google password never reaches us.

  Processed in: United States

• Dispatch riders and couriers

  Getting your order to the door

  The recipient's name, phone number and delivery address for that order.

  Processed in: Nigeria

We will also disclose information where the law requires it — a court order, a tax audit, or a demand from the Nigeria Data Protection Commission or another regulator entitled to ask. If the business is ever sold or merged, customer records may transfer with it; we would tell account holders before that happened.

Our database, file storage and email sending run on managed cloud services that may be hosted outside Nigeria, including in the European Union and the United States. Whenever personal information leaves Nigeria we rely on the cross-border transfer conditions in the NDPA — either a destination the Commission recognises as offering adequate protection, or contract terms binding the provider to protect it to the same standard.

You can ask us which region your information currently sits in and we'll tell you.

We keep each kind of record only as long as it is useful or legally required, then delete it.

• Account and profile — Until you ask us to delete it.
• Orders, invoices and payment records — For the period Nigerian tax and company law requires — currently six years — even if you close your account in the meantime. We cannot delete these on request; they are a legal obligation.
• Support tickets — Two years after the ticket is closed.
• Reviews — Until you or we remove them. If you'd rather keep the review but drop your name from it, ask.
• Security and activity logs — Twelve months, then deleted.
• Verification and password-reset links — Stored only as a one-way hash, never as the link itself. A verification link expires after 24 hours and a reset link after one hour, and both are cleared the moment they are used.
• Newsletter opt-out — Kept indefinitely — it is the record that stops us emailing you again.

No system is perfectly safe, so here is specifically what we do rather than a promise we can't keep.

• Traffic between your browser, this site and our API is encrypted with HTTPS.
• Passwords are stored as bcrypt hashes, never as readable text, and are excluded from API responses by default.
• Verification and password-reset links are stored only as SHA-256 hashes and expire, so a stolen database row cannot be turned back into a working link.
• Your session lives in an httpOnly, secure cookie rather than in JavaScript, which closes off the most common way sessions get stolen.
• Login, signup, password-reset and checkout requests are rate-limited to slow down guessing attacks.
• Only staff accounts holding the admin role can reach customer records, and admin actions are written to the activity log.
• Card data is out of scope entirely — it never reaches our systems (section 5).

If a breach ever puts your rights at risk, we will report it to the Nigeria Data Protection Commission and tell you, as the NDPA requires.

Under the NDPA you can ask us to:

• Give you a copy of the personal information we hold about you.
• Correct anything wrong or out of date.
• Delete your information where we no longer need it — bearing in mind the order and tax records we are required to keep (section 8).
• Restrict or object to a particular use, including anything we base on legitimate interests.
• Hand over the information you gave us in a portable, machine-readable format.
• Withdraw a consent you gave us — for marketing, for example — at any time.

Most of it is self-service: your profile edits your details, addresses, photo and password, and its Notifications tab controls what we send. For anything else, open a support ticket or call us. We answer within 30 days and never charge for a first request.

If you aren't satisfied with how we handle it, you can complain to the Nigeria Data Protection Commission (NDPC), Nigeria's data protection regulator. If you are in the EU or UK and data protection law there applies to you, you have the equivalent rights and may complain to your local supervisory authority.

We send three kinds of message, and you control each of them from your profile.

• Order updates — Confirmations and delivery progress. On by default, because they are part of the order.
• Payment reminders — A nudge when an order is still waiting to be paid. On by default.
• Promotions — New products, offers and seasonal menus. On by default when you create an account; switch it off and you will not receive another.

You can also turn off a whole channel — all email, or the in-app notifications in the bell menu — in the same place. Turning off email does not stop us contacting you about a specific order when we have to, such as a delivery problem or a refund.

The shop is meant for adults. We do not knowingly collect information from anyone under 18, and you should be 18 or over to create an account or pay for an order. Date of birth is an optional profile field — leaving it blank changes nothing about your account.

If you believe a child has given us their details, tell us and we will delete them.

We update this page whenever what we do with your information changes. The date at the top always says when it last changed.

If a change materially affects you — a new purpose, or a new kind of recipient — we will email account holders or show a notice on the site before it takes effect.

For anything about this policy or your information, reach the O'Pearlz team at:

• 39 Awonusi Str., Ikotun, Ijegun, Lagos
• 0907 854 3761·WhatsApp
• 0813 838 4616·WhatsApp
• Open a support ticket