Privacy Policy.

Crab (“Crab”, “we”, “us” or “our”) provides a platform that allows business owners to create a simple online page for their business, products and services.

We respect your privacy and are committed to handling personal information responsibly and transparently.

This policy applies when you use Crab, including our website at crab.ng, create or manage a Crab account or business page, or interact with a business page hosted on Crab.

1. Information we collect

When you create or use a Crab account, we may process information such as your name, email address and authentication or account information.

When you create a business page, we process the information you provide about the business. This may include its name, category, description, location, phone or WhatsApp number, availability, products or services, prices, descriptions and uploaded images.

Some information is optional, while other information may be necessary for us to provide a particular Crab feature. We may also process limited technical and activity information necessary to operate and protect the service.

2. Information you choose to publish

Crab is designed to help businesses create public business pages. Information you enter while managing your account is not automatically public simply because it has been provided to Crab.

When you publish a business, however, information intended for that business page may become publicly accessible on the internet. This can include the business name, description, category, location, phone or WhatsApp number, business images, products or services, prices and other information you choose to publish.

3. How we use information

We process information where appropriate to provide and operate Crab, perform our agreement with users, comply with applicable legal obligations, protect the platform and its users, pursue legitimate interests where permitted, and obtain consent where consent is the appropriate lawful basis.

We may use information to:

• Create and authenticate accounts.
• Create, save and display business pages.
• Allow business owners to manage products and services.
• Provide public business links.
• Enable visitors to contact businesses through WhatsApp.
• Provide basic business-performance information.
• Maintain security and prevent abuse.
• Troubleshoot and improve Crab.
• Respond to support or privacy requests.
• Comply with applicable law.

We do not sell personal information to advertisers.

4. Crab business analytics

Crab provides business owners with basic information about activity on their published business pages.

At present, this includes page views when a Crab business page is opened and WhatsApp clicks when someone uses the WhatsApp contact button on a business page.

Our current Crab analytics system is intentionally limited. We do not deliberately use these events to record the visitor's name, email address, phone number, precise location or create a visitor advertising profile.

Analytics associated with a business are available to the authorised owner of that business and are not intended to be publicly displayed.

We may improve Crab's analytics in the future. If this materially changes the personal information we collect or the way we use it, we will update this Privacy Policy and implement any additional notice or consent mechanisms required by applicable law.

5. Cookies and browser storage

Crab does not currently operate advertising pixels or third-party behavioural analytics services such as Google Analytics or Meta Pixel.

Crab's authentication technology may use browser storage or similar technologies that are technically necessary to keep users signed in, maintain account sessions and provide secure functionality.

We do not currently use those technologies to build advertising profiles of visitors.

If Crab later introduces non-essential cookies, advertising technologies or comparable tracking systems, we will review the appropriate notice and consent requirements before deploying them.

6. Service providers and third parties

Crab relies on third-party infrastructure and services to operate.

Supabase provides infrastructure used for functions including authentication, database services and file storage.

Cloudflare provides infrastructure used to deliver and operate Crab's website.

jsDelivr is used to deliver certain software resources required by the website.

Crab business pages may also contain links that open WhatsApp when a visitor chooses to contact a business. When you leave Crab for WhatsApp or another third-party service, that service processes information according to its own terms and privacy practices.

We may also disclose information where required by law, to protect legal rights or platform security, or in connection with a legitimate corporate transaction subject to appropriate safeguards.

7. International processing and transfers

Some of the technology providers used to operate Crab may process or store information using infrastructure located outside Nigeria.

Where personal data is transferred internationally, Crab will take reasonable steps to ensure that transfers are handled in accordance with applicable Nigerian data-protection requirements and appropriate safeguards.

As Crab grows, we will continue reviewing the locations and safeguards used by our service providers.

8. How long we keep information

We aim to keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide Crab's services, meet legitimate operational needs, resolve disputes, maintain security and satisfy legal obligations.

Different categories of information may therefore have different retention periods.

When information is no longer reasonably required, we will take appropriate steps to delete, anonymise or otherwise securely dispose of it, subject to legal or legitimate retention requirements.

As part of Crab's privacy controls, we are implementing mechanisms that allow owners to remove businesses and request deletion of their accounts and associated information.

9. Security

We use reasonable technical and organisational measures intended to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

These measures include access controls designed so that business owners can manage their own private account and business information, while information intended for public business pages can be accessed publicly after publication.

No internet service can guarantee absolute security. Users should therefore also protect their login credentials and notify us if they suspect unauthorised access to their account.

10. Your privacy rights

Depending on the circumstances and applicable law, you may have rights relating to your personal data, including rights to be informed about processing, access your information, request correction, object to or restrict certain processing, request deletion, request portability, withdraw consent where processing relies on consent, and raise concerns regarding certain automated decisions.

You may also have the right to lodge a complaint with the Nigeria Data Protection Commission.

To exercise a privacy right relating to Crab, contact privacy@crab.ng. We may need to verify that a request relates to you before providing, changing or deleting personal information.

11. Children's privacy

Crab is intended as a platform for people who are legally able to operate or represent businesses and enter into the relevant agreements required to use the service.

Crab is not designed as a service for children to independently create business accounts.

If we become aware that personal information relating to a child has been processed in circumstances that do not comply with applicable requirements, we will take appropriate steps to address it.

12. Information belonging to other people

Business owners must ensure they have the appropriate authority or lawful basis before uploading or publishing personal information belonging to another person.

For example, you should not publish another person's private phone number, photograph or other personal information on a Crab business page without appropriate authority.

13. Public information and external sharing

Once a business page is published, people may access and share its public URL and the information displayed on it.

Crab cannot fully control what third parties do with information after it has legitimately been made publicly available, including where another person copies or shares a public business link or information from that page.

Unpublishing or deleting a Crab page may prevent future access through Crab but may not immediately remove copies previously stored or shared by independent third parties or search engines.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Crab develops, our technology changes, or legal requirements evolve.

When we make changes, we will update the date shown at the top of this policy. Where a change materially affects how personal information is processed, we will provide additional notice where appropriate or legally required.