Privacy

What we collect

To take and deliver an order: your name, email address, phone number, delivery address and what you bought.
If you create an account: your email address and a password. The password is stored only as a salted scrypt hash — we cannot read it, and neither can anyone who obtains the database.
Payment: card payments are handled entirely by Paystack. We receive a payment reference, the amount, the status and the card's channel (for example "card" or "bank transfer"). We never receive or store your card number, expiry date or CVV.
To keep the store working: a session cookie, a cart cookie, and a hashed form of your IP address used to rate-limit sign-in and checkout so the store cannot be brute-forced. The hash cannot be reversed to your IP address.
If you write to us: your name, email address and message.

Cookies

This store sets two cookies, both strictly necessary and neither used for advertising or tracking:

ozikoro_store_session — keeps you signed in. It holds a random token; the session itself lives on our server. It expires after 30 days.
ozikoro_store_cart — remembers your basket. It expires after 60 days.

There are no analytics cookies, no advertising pixels and no third-party trackers on this site. The only third party loaded in the page is Google Fonts, for typography.

Who we share it with

Paystack — to take the payment and to process refunds.
Our couriers — the name, address and phone number needed to deliver your parcel.
Cloudflare — this site is hosted on Cloudflare, which necessarily handles every request.

We do not sell your data, and we do not share it for advertising.

How long we keep it

Order records are kept for as long as tax and accounting rules require. Account details are kept until you ask us to close the account. Contact messages are kept for two years. Session records are deleted when they expire.

Your rights

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email store@ozikoro.com. Where an order record must be kept for tax purposes we cannot delete it, but we will tell you that rather than quietly refuse.

Security

Passwords are hashed with scrypt. Administrative access is authorised on the server for every action, not by hiding links. Payment webhooks are verified by HMAC signature over the exact bytes received, and every payment is confirmed independently with Paystack before an order is marked paid. Card details never touch this application.