Privacy Policy

TreatHour is a trading name of Craza Technologies Limited (RC 9932233), 1, Antarex off Okoribi, Uwvie, Asaba, Delta State, Nigeria. We are the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (NDPA).

Privacy questions and requests: privacy@treathour.com, or the contact form (topic: privacy). Our privacy inbox is read only by the TreatHour team members allowed to (the Superadmin and Admin roles).

This policy covers the TreatHour website, the TreatHour app and businesses' own websites that run on TreatHour, for customers, guests, business owners and their teams, and anyone who contacts us.

Your account

Your name, email address, phone number (if you add one), a profile photo (if you add one), your password (stored only in scrambled form, so nobody can read it), how you want booking updates (text or email), whether your email and phone are verified, and which version of our terms you agreed to.

Bookings, including as a guest

Your name, mobile number, email (if you give it), the business, service, team member, date and time, any note you write for the business, whether you asked for the business's offers, how you booked (website, app or the business's website, and any campaign tags in the link you followed), and what happened to the booking (accepted, moved, cancelled, completed).

Payments and refunds

Amounts, dates and references, and from Paystack the payment method, card type, the card's last 4 digits and the bank. We never receive your full card number, PIN or OTP. If you book with only a phone number, we give Paystack a stand-in email address made from your number, and Paystack shows your number on its checkout page. If a refund can't go back to your card, we ask for the bank account to send it to.

Gift vouchers

The buyer's name and email (or account), and the recipient's name, phone number or email, and the gift message. The recipient sees the buyer's name and message.

Walk-in queue

Your name, phone number, email (if you give it), the service, any team member you chose, your place in line and what happened (called, served, skipped), and the payment.

Reviews

Your rating, your comment, the name and (in the app and home-page highlights) the profile photo shown with it, the date, the business's reply, and any report about the review.

Messages

• Contact form: your name, email, phone (if given), topic, booking reference, message, the page you sent it from, your account (if you're signed in), and, to protect us from abuse, your IP address and browser type.
• Emails you send to any treathour.com address (with their attachments, as sent), and our replies.
• Enquiries you send through a business's own website: your name, email, phone, message and how you found the site (campaign tags in the link). They go to that business.
• The texts and emails we send you about bookings, vouchers and queues, and after a visit, a request to review it (and at most one reminder). We keep a record of each text: the number, the words with private links, one-time codes and gift voucher codes hidden, and whether it arrived.

Location

• Your precise location, only with your permission (your browser or phone asks first): when you tap "near me", we use your position rounded to about 100 metres to find businesses near you; and once you've allowed it, a business's page works out how far away it is, in your browser only. We don't save it to your account or our database. A "near me" search puts it in the search address (URL), so it can appear in your browser history and in our hosting provider's short-term request logs. The app uses your location only while it's open, never in the background, and finds your position again when it opens if you left "near me" on.
• Your city: to choose which city to show first, we may use the approximate city that our hosting provider works out from your IP address. We remember the city you're browsing in a cookie (see Cookie notice).
• Business owners: setting the map pin with "I'm at my business now" saves that position as the business's location.

Businesses and their teams

The business's name, address, phone, email, photos, services and prices, opening hours and map pin (or only its area, if the owner chooses); the owner's bank account for payouts (we keep the bank, account name and last 4 digits; Paystack holds the full number); plan payments (we keep the card type, last 4 digits and expiry for the plan, and each payment's reference, amount, status and plan; not the payer's IP address, the card's first digits, the cardholder's name or email from Paystack's messages); and team members' names, titles, photos, contact details for their login, and, if the business adds it, their gender, which customers see so they can choose a female or male professional.

Technical data

• Your IP address, used for a short time to limit how often things can be done (for example sign-in attempts); most of these counters delete themselves within 24 hours (daily text-message limits per number within 2 days).
• Cookies and storage on your device (see Cookie notice).
• Counts of how often a business's page is viewed (just a number per day, with no information about who viewed it).
• Our team's security log: every change our team makes in the admin area (apart from their own email drafts and mailbox settings), some views of personal data (for example a former team member's mailbox or an export), sign-in attempts to team accounts and to any treathour.com address, and anyone who tries to open an admin page without access, with the time, name or email, IP address and browser.

The NDPA lets us use personal data only with a lawful basis. Ours are:

TreatHour doesn't send its own marketing or newsletters. If we ever want to, we'll ask first.

Automatic decisions

We don't profile you. A few booking rules run by themselves, without a person deciding each time:

• an unpaid booking hold or queue place ends when its time runs out;
• a request the business doesn't accept in time is declined, and you're refunded what you paid towards the price;
• a booking completes by itself 24 hours after the appointment (unless it was cancelled or marked a no-show); an unrecorded deposit balance then counts as paid at the venue, and the business's money is released;
• in a walk-in queue, someone who doesn't come when called is moved back, and the third time is taken out of the queue.

If you think one of these went wrong for you, contact us and a person will look at it.

The business you book with

When you book, join a queue or use a voucher with a business, it gets your name, contact details, the booking details and your note, so it can serve you. The business keeps its own list of clients on TreatHour and can download it (names, emails and phone numbers) as a file. For that list, and for any offers it sends you, the business is responsible for your data, and TreatHour handles it on the business's behalf.

The TreatHour team

New TreatHour team members get the Staff role by default, so they can help with support: they can see bookings (the customer's name and contact details, the business, the time and the amounts) and read the messages sent to support@treathour.com and contact@treathour.com (including the contact form). Payments, refunds, payouts, accounts and settings need a role that only some team members have, and the privacy inbox (privacy@treathour.com) is open only to the Superadmin and Admin roles (and any role the Superadmin gives that permission).

Companies that help us run TreatHour

They only use your data to provide their service to us:

Other people

• Reviews are public, with your name as described in our Review guidelines.
• A gift voucher's recipient sees the buyer's name and message.
• Authorities, courts and regulators, when the law requires it, and our professional advisers.
• If TreatHour's business is sold or merged, the new owner, who must respect this policy.

We never sell your personal data, and we don't use advertising networks or tracking cookies.

Most of our service runs outside Nigeria, mainly in the United States: the website and its servers (Vercel), our company email files and email sending (Vercel and Resend), and, depending on the region each one uses, our database (MongoDB Atlas) and photos (Cloudinary). Paystack and Termii operate in Nigeria, but they may also store or process data in other countries. When personal data leaves Nigeria, we do so under the cross-border transfer rules of the NDPA (Part VIII), relying on the safeguards in our agreements with these companies.

• Your account: until you delete it, in the app (Profile → Your data) or on the website (Account → Settings → Your data). We sign you out everywhere at once and delete the account 14 days later; until then, signing in offers Keep my account. (During those days we don't send password reset links: if you've forgotten your password, contact us and we'll cancel the deletion.) How to delete your account lists exactly what is deleted and what we keep.
• When the account is deleted, your name, email address, phone number, photo and password go, and so do the contact details and notes on your bookings and walk-in tickets, the client records businesses kept about you on TreatHour, enquiries you sent through a business's website, and our record of texts sent to your numbers. Your email address and number can then be used for a new account.
• Money records (bookings, payments, refunds, payouts, gift voucher purchases and receipts) are kept, because Nigerian tax and company law requires it. After an account is deleted they show "Deleted customer": the amounts, dates, references and the card's last 4 digits stay, your name and contact details don't. We don't delete money records automatically after a set number of years.
• Reviews stay up after an account is deleted, shown as written by a "Former customer" and no longer linked to you.
• Gift vouchers stay valid until they expire: a voucher is a code that belongs to whoever has it. The buyer's name and email are removed from a voucher they bought.
• Businesses: when an owner deletes their account, the business closes: its client list, team, photos, website and bank details are deleted, its name and address stay on past bookings, receipts and payout statements, and its web address is held for 90 days so nobody else can take it straight away.
• Messages to our team (the contact form and emails) are company correspondence and are kept, also after an account is deleted. Messages our team moves to the bin, and mail filed as spam, are deleted 30 days later.
• Text message records: we keep a record of each text we send (the number, the words with private links, one-time codes and gift voucher codes hidden, and whether it arrived). When an account is deleted, the records of texts sent to its numbers are deleted.
• Photos: a photo you replace or remove is deleted when you save the change (if our photo service can't be reached then, it may stay there); an upload that was never used is deleted after 24 hours; your profile photo is deleted with your account. A team member a business removes is hidden, and their profile (photo, contact details) stays with the business's records until the business closes. Images attached to emails sent to us are kept as they arrived.
• Security counters delete themselves within 24 hours (daily text limits per number within 2 days). Our team's security log is kept: it records an account deletion by account number only, not your name or email, but earlier entries that mention you (for example a team member changing your account) stay.
• Backups: our database backups aren't edited, so an older backup may still hold a copy of deleted details until it's replaced on our backup schedule. Backups are kept secure and only used to recover the service after a fault. Copies of company email that our team downloads as a backup are kept with the team's records.
• Copies we can't reach: emails and texts already delivered, and Paystack's own records of card payments (kept under its own legal duties).

If you booked as a guest and want your details deleted, write to privacy@treathour.com. We'll delete or anonymise them, keeping only what the law requires.

Under the NDPA you have the right to:

• know what we do with your data (this policy) and get a copy of it: on the website, Download my data in Account → Settings → Your data; in the app, Email me my data (Profile → Your data), sent only to an email address you've confirmed. That file has your account, bookings, reviews, gift vouchers, walk-in visits, receipts and the businesses you said yes to. For anything else (your messages to us, the texts we sent you, what businesses noted about you), ask us;
• have it corrected: change your name, phone and photo in Account settings, or ask us (for example to change your email);
• have it deleted: delete your account yourself in the app or on the website (how), or ask us if you can't sign in;
• take it elsewhere (data portability): your data comes as a machine-readable JSON file;
• object to how we use it, or ask us to restrict it, where we rely on legitimate interests;
• withdraw consent at any time: switch off location in your browser or phone, or use the unsubscribe link in any business's email;
• complain to the Nigeria Data Protection Commission (NDPC) if you think we've got something wrong. We'd appreciate the chance to put it right first.

To use a right, write to privacy@treathour.com or use the privacy form. We may ask you to prove it's you (for example from the email on your account). We'll reply without undue delay and within the time the law allows. It's free.

• When you book, you can tick "Send me news and special offers" from that business. It's unticked unless you tick it, and it only covers that one business.
• If you booked as a guest, we email you first to confirm. If you're signed in, your tick counts straight away.
• We keep a record of when and how you said yes (the booking, the words of the box, and when you confirmed), so the business can show it.
• Offers come by email only. Every one has an unsubscribe link: confirm, and that business's offers stop.
• Businesses can only send offers through TreatHour to customers who said yes, and can't add you themselves. A business can also download its client list; what it does with that copy is its own responsibility.

• Everything travels over encrypted connections (HTTPS). Passwords are stored only in scrambled form.
• Your private booking and ticket links are stored in scrambled form too, and our record of the texts we sent hides the private links, one-time codes and gift voucher codes in them. If you shared a booking link by mistake, use Send me a new link on the booking page.
• Card payments are handled by Paystack, which is certified to the card industry's security standard. We never handle your card number.
• Team members see only what their role allows (see "The TreatHour team" above), and every change our team makes in the admin area (apart from their own email drafts and mailbox settings) is logged, with some views of personal data.
• Photos have location and camera details removed when they're uploaded.
• If a data breach puts your rights at risk, we'll tell the NDPC and, where the law requires, you.

TreatHour isn't for children. You must be 18 or over to have an account. A parent or guardian may book a service for a child, giving their own details. If you think a child has given us personal data, write to privacy@treathour.com and we'll delete it.

We use two cookies of our own (one to keep you signed in, one to remember your city) and no advertising or tracking cookies. Maps from Google may set their own. Details are in our Cookie notice.

Craza Technologies Limited (TreatHour), 1, Antarex off Okoribi, Uwvie, Asaba, Delta State, Nigeria. Email privacy@treathour.com or use the privacy form. If you're not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

We'll update this document when our service or the law changes. The date at the top shows when it last changed, and earlier versions stay readable below. If a change matters to you, we'll tell you before it applies: we email account holders and show a notice in your account on the website.

• 14 October 2026: First version.