Cutz Legal

Privacy Policy

Plain-English summary

This summary is here to help. The full policy below is what governs how we handle your information.

• Your phone number or email is your identity on Cutz. We need one of them to create your account and send you a one-time code.
• We do not sell your personal information. Not to advertisers, not to data brokers, not to anyone.
• We only collect what the product needs to work — who you are, which queue you're in, and enough technical data to keep your account secure.
• Location is optional. We use it to show salons near you. You can say no, and most of the app still works.
• Salons and barbers see your name and queue history at their salon. That's how they know who to call next.
• We share data with a small number of service providers — an SMS provider for your one-time code, Google for maps and sign-in, Paystack for salon subscriptions, and our cloud hosting and storage providers.
• You have rights under the Nigeria Data Protection Act 2023: to see your data, correct it, delete it, object to how we use it, and complain to the regulator.
• To exercise any right, or to ask us anything about privacy, email hello@cutz.ng.

1. Who we are and what this policy covers

1.1 This Privacy Policy explains how Johnremy Agbor, trading as Cutz, of Abuja, Federal Capital Territory, Nigeria ("Cutz", "we", "us", "our") collects, uses, stores, shares, and protects personal information. Cutz is not yet incorporated as a limited liability company; the data controller is Johnremy Agbor until a Nigerian company is formed and these documents are updated.

1.2 For the purposes of the Nigeria Data Protection Act 2023 ("NDPA"), Cutz is the data controller for the personal information described in this policy. This means we decide why and how it is processed, and we are accountable for it to you and to the Nigeria Data Protection Commission ("NDPC").

1.3 This policy applies to all of our services (the "Services"): the Cutz customer app and website, the Cutz Barber app, the Cutz Salon app, cutz.ng and its subdomains, our progressive web apps, any native mobile apps we release, and our APIs.

1.4 It applies to everyone whose information we handle in connection with the Services, including Customers, Barbers, Salon Operators and salon staff, people added to a queue as walk-ins, visitors to our website, and people who contact our support channels.

1.5 It does not apply to: third-party websites or apps you reach through a link from us; a Salon's own separate systems, records, or marketing; or what a Salon or Barber does with your information outside the Services. Those are governed by their own practices, and a Salon that uses your information for its own purposes is a controller in its own right.

1.6 Terms used here have the meanings given in the Terms of Service.

2. A note on the roles of Cutz and Salons

2.1 Cutz is the controller of the platform. We decide how accounts, queues, notifications, ratings, and analytics work, and we are responsible for the security and lawfulness of that processing.

2.2 Salons and Barbers use the Services to run their own business. When a Barber records that you were served, adds you as a walk-in, or reads your name from their queue, they are using our platform — but they are also handling your information as part of their own business. If a Salon takes your information out of Cutz and uses it for its own purposes (for example, its own customer list), the Salon is a separate controller and is responsible for that use.

2.3 Our Terms of Service require Salons and Barbers to use information they access through the Services only to serve their customers, to keep it secure, and to comply with the NDPA in their own right. If you believe a Salon has misused your information, tell us at hello@cutz.ng and we will investigate and may suspend their access.

3. Information we collect

We collect the categories below. Not all of them apply to every user — what we hold depends on which app you use and what you do.

3.1 Account and identity information

We do not collect government identity numbers (NIN, BVN), date of birth, gender, or any special category data such as health, biometric, religious, or political information. Please do not send us any of these.

3.2 One-time codes

When you sign in, we generate a numeric code and send it to your phone or email. We store only a cryptographic hash of the code, in temporary memory, and it expires automatically after a short period (currently 10 minutes). It is deleted as soon as it is used. We also count code requests against your identifier to enforce rate limits and prevent abuse.

3.3 Queue information

3.4 Reviews and content

Star ratings, written comments, quick tags, saved or bookmarked salons, salon photographs and cover media, barber biographies and specialties, and salon business descriptions.

3.5 Salon and business information

For Salon Operators: business name, business address, geographic coordinates of the salon, description, website, operating hours, service list and prices, photographs, and subscription status. Business addresses and coordinates are published to all users — that is the point of the listing.

3.6 Device, technical, and security information

3.7 Location information

If you grant permission, we collect your device's approximate or precise location while you are using the customer app to show nearby salons and estimate distances. We do not track your location in the background, we do not follow your movements between sessions, and we do not build a location history about you. You can refuse or withdraw permission at any time in your browser or device settings; discovery will then fall back to search and manual selection.

Separately, we store the fixed coordinates of each salon — that is business information, not personal location tracking.

3.8 Push notification information

If you enable push notifications, your browser or device generates a subscription consisting of an endpoint URL and two encryption keys. We store these so we can send you notifications. They do not let us read anything on your device.

3.9 Payment information (Salon Operators only)

Subscription payments are processed by Paystack. We never see or store your full card number, CVV, or PIN. Paystack returns to us, and we store: a transaction reference, the amount, the payment channel (card or bank transfer), the payment status, the subscription period purchased, and — if you save a card for automatic renewal — a Paystack authorisation token plus the card brand, last four digits, and expiry month and year. We share your email address (or, for a bank transfer where you have no email on file, a system-generated placeholder address) with Paystack so it can identify the transaction.

3.10 Communications with us

Support requests, emails, messages, feedback, and our replies, including any information you choose to include in them.

3.11 Referral information

Where a barber referral programme is running: the referral code used, which barber referred which user, and whether a referral qualified for a reward.

3.12 Usage and analytics information

We generate operational statistics from activity on the platform — how long services take, how many people are served, no-show rates, peak hours, and new-versus-returning customer counts. These are shown to authorised Salon Operators for Salons they manage, and used by us in aggregate to run and improve the Services.

We do not currently use any third-party product analytics, advertising, or tracking SDK — no Google Analytics, no Meta Pixel, no Mixpanel, no advertising identifiers. If that changes we will update this policy and, where the law requires it, ask for your consent first.

3.13 Server logs

Our servers keep technical logs of requests and errors, which can include IP addresses, timestamps, requested URLs, and error details. These are used for reliability, debugging, and security.

4. How we collect information

4.1 Directly from you — when you create an account, verify a code, complete your profile, join a queue, leave a review, upload a photo, configure a salon, buy a subscription, or contact support.

4.2 Automatically — device, browser, session, IP, and usage information is collected as you use the Services, as described in section 3.6.

4.3 From a barber or salon on your behalf — if you are added to a queue as a walk-in, a barber may enter your name and the service you want. Our Terms require them to have your authority to do so and to tell you that they are entering you into a queue system. If you were added without your agreement, contact us at hello@cutz.ng and we will remove the record.

4.4 From third parties —

• Google, if you choose to sign in with Google: we receive your Google account identifier and email address, and confirmation that Google verified them. We do not receive your Google password or your contacts.
• Paystack, for subscription transaction results and saved card metadata.
• Our SMS provider, for delivery status of one-time codes.

4.5 From public and mapping sources — when a Salon Operator searches for a business address, we send that search text to Google Maps Platform and receive back address suggestions and coordinates.

5. Why we use your information, and our lawful basis

Under section 25 of the NDPA we must have a lawful basis for every use of your personal information. The table below sets out ours.

Legitimate interests. Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we believe it is not. You can object to any processing based on legitimate interests — see section 10.

Consent. Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already happened, and some features will stop working (for example, disabling location removes the "nearby" sort).

No automated decision-making. We do not make decisions about you that produce legal or similarly significant effects using automated processing alone. Queue ordering, position calculations, automatic completion of stale services, and rating aggregation are automated, but they are operational calculations, not decisions of that kind. Enforcement decisions such as suspending an account are reviewed by a person.

6. Who we share information with

We do not sell your personal information, and we do not share it for anyone else's advertising.

6.1 Other users of the platform

Before you post a review, remember it is public and cannot be made private later. See the Community & Review Guidelines.

6.2 Service providers (data processors)

We use a small number of providers who process personal information on our instructions and under contract. They may not use it for their own purposes.

We keep this list current. If we add or change a provider that handles personal information, we will update this table.

6.3 Legal and protective disclosures

We may disclose information where we reasonably believe it is necessary to: comply with a law, court order, or a lawful request from the NDPC, the police, or another competent authority; enforce our Terms; investigate fraud, security incidents, or abuse; or protect the rights, property, or safety of Cutz, our users, or the public. Where we are permitted to tell you about such a request, we will.

6.4 Business transfers

If we are involved in a merger, acquisition, financing, restructuring, or sale of assets, information may be transferred as part of that transaction. We will require the recipient to honour this policy, and we will notify you before your information becomes subject to a materially different policy.

6.5 Aggregated and de-identified information

We may create and publish statistics that cannot identify you — for example, average wait times by area or typical peak hours. This is not personal information and is not restricted by this policy.

7. Where your information is stored and international transfers

7.1 Our primary application servers and database are hosted on Google Cloud. Our websites, CDN, DNS, and media object storage are hosted on Cloudflare. Exact regions may change as we scale; processing may occur outside Nigeria.

7.2 Some of our providers process information outside Nigeria. In particular, Google Cloud, Cloudflare, Zoho, Brevo, and browser push infrastructure operate internationally.

7.3 Under sections 41 to 43 of the NDPA, we may transfer personal information out of Nigeria only where an appropriate basis exists. We rely on one or more of the following: the recipient is subject to a law or scheme that provides an adequate level of protection; the transfer is governed by contractual terms imposing equivalent protection; or the transfer is necessary for the performance of a contract with you or in your interest.

7.4 We take reasonable steps to satisfy ourselves that any recipient outside Nigeria protects your information to a standard consistent with the NDPA. You can ask us for details of the safeguards we rely on by emailing hello@cutz.ng.

8. How long we keep information

8.1 We keep personal information only as long as we need it for the purposes in section 5, or as long as the law requires. Exact schedules will tighten as we add automated retention; until then we keep live data while accounts are active and delete or anonymise it when you close your account or ask us to erase it (see section 10), subject to the legal exceptions below.

8.2 We may keep information longer where we need it to establish, exercise, or defend a legal claim, to comply with a legal obligation, or where a regulator or court requires it. We will keep only what is necessary for that purpose.

8.3 When we introduce automated retention jobs that change the schedules above in a material way, we will update this section.

9. Security

9.1 We take the security of your information seriously and use measures appropriate to the risk, including:

• No passwords for ordinary users. Sign-in uses short-lived one-time codes, removing the risk of reused or leaked passwords.
• Codes are stored hashed and expire automatically.
• Encryption in transit. All traffic between your device and our servers uses HTTPS/TLS.
• Access tokens expire and can be revoked. You can see your active devices and sessions and revoke any of them.
• Rate limiting on code requests and sensitive endpoints.
• Role-based access control internally, so staff can only reach what their role requires.
• Hashed device identifiers, so we never store the raw identifier.
• Sign-in audit logging, so unusual access can be detected and investigated.
• Card data is never stored by us — it stays with Paystack.
• Uploaded media is stored in access-controlled object storage.

9.2 No system is completely secure. We cannot guarantee absolute security, and you share information with us at your own risk. Keep your device locked, never share a one-time code with anyone — we will never ask you for one — and tell us immediately at hello@cutz.ng if you think your account has been compromised.

9.3 Breach notification. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the NDPC within 72 hours of becoming aware of it, as required by section 40 of the NDPA, and we will notify you without undue delay where the risk to you is high.

10. Your rights

10.1 Under the NDPA you have the following rights in relation to your personal information.

10.2 How to exercise a right. Email hello@cutz.ng from the email address on your account, or contact us from your registered phone number. Tell us which right you want to exercise and what you are asking for.

10.3 Verification. We will verify your identity before acting, usually by sending a one-time code to your registered phone number or email. This protects you from someone else making a request in your name.

10.4 Timing and cost. We will respond within 30 days. If your request is complex we may extend this by a further 30 days and will tell you why. There is no charge, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline it and explain why.

10.5 What deletion means in practice. When you ask us to delete your account:

• your profile, contact details, saved salons, notification settings, and device records are deleted;
• your queue history is anonymised so the salon's own statistics remain accurate but no longer identify you;
• your reviews are anonymised rather than removed, because other users rely on the aggregate rating (tell us if you want a specific review taken down and we will consider it);
• payment and subscription records are retained for the statutory period in section 8;
• security logs are retained for their normal period; and
• residual copies persist in backups until those backups age out.

10.6 Limits. We may decline a request where the NDPA allows — for example where complying would infringe someone else's rights, or where we must keep the information by law. We will always tell you why.

10.7 Salon Operators and Barbers. Some information cannot be deleted while it is required to run a live business listing or an active subscription. Close your salon listing and cancel your subscription first.

11. Children's privacy

11.1 The Services are not intended for children. Under the NDPA a child is anyone under 18, and you must be 18 or over to hold a Cutz account.

11.2 We do not knowingly collect personal information from children. If we learn that we hold information about a child collected without the consent of a parent or guardian, we will delete it promptly.

11.3 A parent or guardian may join a queue on behalf of a child using their own account. In that case only the child's first name (or no name at all) should be entered, and no other information about the child should be provided.

11.4 If you believe a child has given us information, contact hello@cutz.ng.

12. Cookies, local storage, and similar technologies

12.1 We use a small number of strictly necessary cookies and browser storage mechanisms to keep you signed in, protect against cross-site request forgery, remember your appearance preference, and cache data so the app works offline.

12.2 We do not use advertising or third-party tracking cookies.

12.3 Full details are in the Cookie & Local Storage Policy.

13. Changes to this policy

13.1 We may update this policy to reflect changes to the Services, our providers, or the law.

13.2 We will post the updated policy at cutz.ng/legal/privacy with a new version number and effective date, and keep previous versions available.

13.3 For material changes we will give at least 14 days' notice through the Services, by email, or by push notification before they take effect. Where a change requires your consent under the NDPA, we will ask for it rather than assume it.

14. Contact us and how to complain

14.1 Our privacy contact:

14.2 If you are not satisfied with our response, you have the right to complain to the regulator:

Nigeria Data Protection Commission (NDPC) No. 5 Aguiyi Ironsi Street, Maitama, Abuja, Nigeria info@ndpc.gov.ng · ndpc.gov.ng

14.3 You may also seek a remedy in court. Complaining to the NDPC does not affect any other legal right you have.

Cutz Privacy Policy · Version 1.0 · Drafted 31 July 2026 · Effective 2 August 2026