Privacy Policy

1. Who we are and what this covers

Seed is operated by Bia’net Tech Ltd. (“we”, “us”). This policy covers the Seed web application at seed.bianettechltd.com and applies to every kind of account on Seed: Buyers, Farmers, Traders, Suppliers, Agro Investors and Logistics Providers. Seed administrators are our own staff and are covered in Section 5.

For any privacy question, or to use the rights in Section 10, contact bianettechltd@gmail.com.

Some sections of the app, such as Jobs and Bartar (the commodity exchange), are currently shown as “coming soon” and are not in use. We will update this policy if they open and change how we handle information.

2. What other people can and cannot see

The short version. The rest of this policy gives the detail.

3. Information we collect

3.1 Account and sign-in information

• Your name, email address, phone number, country, state, and account type (Buyer, Farmer, Trader, Supplier, Agro Investor or Logistics Provider). Accounts other than Buyers can add a business name later, on their profile or during business verification. Logistics Provider accounts also choose whether they offer Pick-up or Delivery.
• Your password, stored only as a one-way hash, never in readable form.
• Your preferred language, and the time you accepted our Terms when you signed up.
• One-time verification codes we email or text you (sent to the email or phone you choose to verify). Codes and password-reset tokens are stored hashed and expire.
• If you sign in with Google: your name, email address and Google account ID, which we receive from Google. We do not receive your Google password.
• Sign-in protection data: a count of recent failed sign-in attempts and a temporary lock time on your account.
• Session tokens (see Section 7).

3.2 Profile information

Depending on your account type you can add:

• Buyers (an individual’s personal profile): full name, profile photo, a short bio (“About me”, up to 500 characters), the product categories you are interested in, and your address. Buyers do not have a business name or business description in the app.
• Other account types: profile photo, business name (optional), business description, and the product categories you sell or deal in.
• Address and location (optional, all account types): a written address and, if you choose, GPS coordinates with the accuracy reported by your device (see Section 3.9).

Files you upload are checked for type and size. Profile photos uploaded by Buyers are also resized and their embedded metadata (such as camera location data) is removed before they are stored.

3.3 Identity verification (personal)

Seed has built optional identity checks using outside verification partners. They are used only if Seed switches them on or you choose to use them from your Profile, and only where a partner is available in the app. If a check is not available, nothing is sent.

• NIN and BVN. You give us the number, your first and last name as on the ID, and optionally your date of birth, and we send them to Smile ID to confirm they match. We use the full number once to make that request and keep only the last four digits, plus the result (matched, did not match, or could not be checked), a provider reference and the time.
• Identity photo (selfie and liveness check). You take a selfie and a short burst of camera frames, which we send to Smile ID together with your name, email address, phone number, ID type and ID number. Seed does not store the images. We keep the job reference, the result and a confidence score.
• Bank account link (Mono). If you link a bank account, you sign in to your bank inside Mono’s own flow; Seed never sees your bank login. We keep the reference numbers Mono returns, the account holder name it resolved, and the result of comparing that name with your name. We use only the account holder name for this check, and we do not store an account number, balance or transaction history from it.
• Consent records. Before each type of check we ask for your consent for that specific purpose. We record whether you agreed or withdrew, when, the version of the notice, and the IP address and browser details of that action.
• Status and review. We keep your overall verification status (not started, pending, verified, failed, or under review). If a result is unclear, an administrator reviews it and we keep the reason and their decision.

Other users only ever see a tick showing “Identity verified”. They never see your NIN, BVN, the last four digits, your selfie, or any verification result details.

3.4 Business verification and seller information

To list products for sale, Farmers, Traders and Suppliers apply for business verification. We collect:

• Your registered or trading business name and a verification level request (Verified or Premium Verified).
• Documents you upload: either a CAC business certificate, or proof of business ownership (for example a business bank statement or utility bill) together with a bank account you have saved in your wallet, whose account holder name we compare with your business name.
• Your notes to the reviewer, our review decision, and any rejection reason.

Verification documents are stored in a private storage area that is not publicly accessible. They can be opened only by you and by administrators reviewing your request.

3.5 Listings, offers and reviews

• Listings: product name, quantity, unit, price and currency, country and state, description, photos, status, and how many times it was viewed.
• Buyer activity: listings you save, price offers you make, and the sellers’ replies.
• Investor activity: Agro Investors can send an expression of interest in a listing and the seller can accept or decline it. The investment-interest feature does not handle any money.
• Reviews: after a payment is released, a buyer can rate the seller; after an accepted investment interest, a Farmer or Supplier can rate the investor. A review is a star rating with an optional comment, and your name or business name is shown with it on the reviewed user’s profile.

3.6 Wallet, payments and Premium

• Wallet: your wallet currency (based on your country), balance, and a history of wallet entries: top-ups, payments held and released, refunds, withdrawals, reversals, Premium payments, and adjustments an administrator makes to correct errors.
• Top-ups: when you add money, you are sent to Paystack’s payment page and enter your card or bank details there. Seed does not receive or store your card number or other payment credentials. Seed receives and keeps the transaction reference, amount, currency, status and Paystack’s transaction ID.
• Withdrawals and bank accounts: to withdraw, you save a bank account (bank name and code, account number and account holder name). We store these, and we send the account number and bank code to Paystack to look up the account holder name and to send the payout. We also keep the withdrawal amount, status, provider reference and any failure reason.
• Payments between users: the amount, quantity, currency, description, the Seed commission rate applied, status and timestamps, and any dispute you open (including the reason you write).
• Seed Premium: your plan, start and end dates, status, and the payments made from your wallet.

3.7 Logistics (Pick-up and Delivery)

• Logistics Providers give a business profile (business name and description, contact person, phone, email, logo, business registration information and office address), the areas they serve, and their rates. New providers are reviewed by an administrator before they are listed.
• Buyers requesting a Pick-up or Delivery job enter an offered price and, for Pick-up requests, a drop-off address and optional instructions for that job. This is separate from the address saved on your profile.
• For a paid job we record the amount, commission rate, status and timestamps, and a delivery code that the buyer gives the provider at handover. The code is stored only as a hash, with the number of tries and any temporary lock.
• If a buyer chooses to collect an item themselves, or to use Bolt’s own service, we record that choice.

3.8 Messages, community, reports and support

• Messages: the text of messages between users, who took part, the listing it relates to, and whether it was read. The app does not support file attachments in messages.
• Notifications: notifications shown in the app, translated into your language. Some events also send an email; for a new message the email includes a short preview of the message.
• Community: posts, photos, comments and likes you make.
• Reports and support: reports you file about a user or listing (with your written reason) and support messages you send us. Support messages are emailed to Seed administrators, and our replies are shown to you in the app.

3.9 Location

Seed uses location only in these ways:

• The address you type (Sections 3.2 and 3.7).
• Device location, only when you ask for it. If you press “Use my current location” in your profile, your browser asks your permission and gives us your coordinates and accuracy. We save them on your profile and send the coordinates to OpenStreetMap’s Nominatim service to suggest a readable address. You can drag the map pin to correct it. We do not collect your location in the background.
• Live delivery map, only during a paid delivery. If you are the rider on a delivery and press “Start trip”, your device shares your position with that delivery’s buyer every few seconds while the Seed page or app stays open, until you press “Stop sharing location” or the delivery ends. If you are the buyer, you can share a drop-off point (your current location or your saved profile location) with that delivery’s rider. Only the buyer and the assigned rider can see the map; the rider also sees the pick-up points of the sellers they collect from, the buyer does not. We keep only the latest position, not a trail, and delete the rider’s position, the drop-off point and the route as soon as the delivery is completed or disputed. To draw the road route and estimate the arrival time, our server sends the start and end coordinates (no names or account details) to OpenRouteService.
• The map on your profile is loaded from OpenStreetMap by your browser, so OpenStreetMap receives your IP address, browser details and the map area being viewed.
• Your state and country are used to show local weather (sent to Open-Meteo), to choose your wallet currency, and to convert prices to your local currency for display.

3.10 AI Plant Diagnosis

When you use AI Plant Diagnosis, the photo you choose is resized in memory and sent to OpenAI with a fixed instruction asking it to identify the plant and any visible disease. We do not send your name, account details or location with it. The result is shown to you. Seed does not save the photo or the result. How OpenAI handles the image on its side is governed by OpenAI’s own terms and policies, which we do not control.

3.11 Referrals

• Your referral code: every account except administrators gets a personal referral code and link (Referral Users get a link code; other accounts a code starting with “SEED-”). We record which accounts were created with it, when, and whether each one has verified itself.
• If you sign up with someone’s referral code or link: we record who referred you. Entering a code is optional. You still choose your own account type, and the referral cannot be changed afterwards.
• Link visits: when someone opens a referral link, we count one visit for that link. We store only which link and when, with no IP address, browser details or visitor identifier. A cookie in your browser remembers the code until you sign up (Section 7).

4. How we use your information

• To create and secure your account, and to verify your email or phone with one-time codes.
• To run the marketplace: showing listings and profiles, handling offers and saved items, converting prices for display, and helping buyers and sellers message each other.
• To operate payments: wallet top-ups, holding a payment until it is released, refunds, withdrawals, commission, Premium, receipts, and resolving disputes.
• To operate Pick-up and Delivery: matching buyers with approved Logistics Providers, and handing over goods.
• To verify businesses and, where used, individuals, and to show verification badges.
• To provide AI Plant Diagnosis, weather and market-price features, and Community.
• To keep Seed safe: detecting suspicious sign-in activity, limiting abuse, reviewing reports, moderating content, and suspending accounts that break our Terms.
• To send service emails, texts and in-app notifications about your account and activity, and to reply to support requests.
• To keep records, and to meet legal obligations that apply to us.

Our legal basis is generally that the processing is necessary to provide the service you signed up for (contract), our legitimate interest in running and securing the platform, or your consent where we ask for it separately. We ask for separate, purpose-specific consent before NIN/BVN checks, identity-photo checks and bank-account linking. We do not sell your personal information, and we do not use it for advertising.

5. Who can access your information

Other users

See the table in Section 2. In addition, a few situations share a specific piece of information for a specific purpose:

• Your buyer address is not shared with sellers or Logistics Providers because you have an account. A Logistics Provider only sees the drop-off address you type into a Pick-up request for that job, and only the provider you send that request to.
• A seller’s name, phone number and address are shown to the buyer who chose to collect that purchase themselves, and to the Logistics Provider assigned to a paid job that includes the seller’s item (so the provider can collect it).
• Sellers and Logistics Providers taking part in an order see the buyer’s name, profile photo, and state and country on that order (not the saved address), and sellers see buyers in their customer lists. Anyone you message sees what you write to them.
• If you signed up with someone’s referral code or link, the person who shared it sees your name, your account type, when you signed up and whether you have verified your account. They do not see your email, phone number, address or anything else.

Seed administrators

Seed administrators are our staff. The admin panel needs a separate panel password, and each administrator only has the permissions they were granted (for example: users, orders, finance, verification, disputes, support, privacy requests). With the right permission an administrator can see account details (including your email, phone and saved address), listings, payments and wallet history, verification documents and results, reports, support messages, disputes, and an audit log of actions taken. The admin panel does not include a tool for browsing users’ private conversations. Administrator actions such as suspending an account or resolving a dispute are logged.

Our service providers

The companies in Section 6 process information for us, only as needed for the feature involved.

Legal and safety

We may disclose information where the law requires it, or to protect the safety and rights of users and of Seed.

6. Third-party services we use

These are the outside services the app actually uses, what they receive, and when.

Links that leave Seed. If you choose “Continue with Bolt” for delivery, or “Open in Google Maps” on your profile, your browser opens Bolt’s or Google’s own site or app. Seed does not send Bolt any of your information; Bolt is a separate service with its own terms and privacy notice. “Open in Google Maps” opens a link that contains the coordinates you saved. Seed’s pages load their fonts from Seed itself, not from a font provider.

Requires client/legal confirmation: Confirm whether Sentry error monitoring is switched on in production, and whether any of the providers above have been changed or added since this date.

7. Cookies, logs and technical data

These cookies are needed for sign-in and for the features you use. Seed does not include advertising or analytics trackers. Our hosting providers may keep their own basic technical logs.

• Server logs. When you use Seed, our servers record technical details such as your IP address, the page or endpoint requested, the time, and your browser type, for security and troubleshooting.
• Sign-in security records. Each failed sign-in, blocked sign-in and account lock is recorded with the email or phone that was typed, the IP address and browser details. After five failed attempts on an account, sign-in is locked for a period (currently 15 minutes).
• Rate limiting. To limit abuse, we count requests by IP address for a short time.
• Activity log. Important actions on your account are recorded (for example signing in, changing settings, submitting requests, or an administrator’s action), with your role at the time.
• Email and text delivery records. We record the recipient, the purpose label, the provider and whether delivery succeeded or failed, without the message content or codes.

8. How long we keep information, and deletion

We keep your information while your account is active. Seed does not currently run an automatic schedule that deletes old profile, listing, message or transaction records.

If you delete your account

You can delete your account from Profile → Privacy & Data. This permanently removes your profile, listings, saved items, offers, messages you sent, notifications, activity log, wallet and saved bank accounts, business verification requests, and your personal identity verification data and consent records.

Accounts with payment history cannot be self-deleted. If you have ever been part of a payment (as buyer or seller), opened a dispute, or made a withdrawal, the account cannot be fully deleted because we must keep the financial record. Contact us to have it deactivated instead.

Some records are not deleted with your account: sign-in security records and email/text delivery records are kept but are no longer linked to your account. Records that belong to other users, such as their own listings, wallets and conversations, stay with them.

Requires client/legal confirmation: Seed has not set retention periods for identity verification data, sign-in security records, delivery records, server logs, or backups. The admin settings include a field for an identity-data retention period, but it is empty and nothing deletes data automatically. The client and its legal adviser need to decide these periods; this section will then be updated with them.

9. Security

• Traffic between your browser and Seed uses HTTPS.
• Passwords are hashed with bcrypt. Verification codes, password-reset tokens, refresh tokens and delivery codes are stored hashed.
• Your session uses signed tokens in cookies that page scripts cannot read.
• We limit repeated attempts on sign-in, verification, password reset and payment actions, and lock an account temporarily after repeated failed sign-ins.
• Business verification documents are kept in a private storage area, and administrator access is limited by permissions and an additional panel password.
• Other users’ profile pages are built from a fixed list of public fields (Section 2), so private fields such as your address are not part of them.

Messages are not end-to-end encrypted. No system is completely secure. We take reasonable technical measures, but we cannot guarantee absolute security. Please keep your password private and tell us straight away if you think your account has been accessed by someone else.

10. Your rights and choices

Under GDPR and Nigeria’s Data Protection Act (NDPA), you have the right to access, correct, delete and export your data, and to object to certain processing. In the app:

• Access and correction: view and edit most of your profile on your Profile page.
• Portability: download a copy of your data from Profile → Privacy & Data.
• Deletion: delete your account from Profile → Privacy & Data (subject to Section 8).
• Privacy requests: submit a request for correction, deletion of specific data, or withdrawal of consent from Profile → Privacy & Data. An administrator reviews each request; we do not delete anything automatically, because we may have to keep records of payments or disputes.
• Withdrawing consent: you can withdraw the consent you gave for identity checks or bank-account linking at any time; see the privacy request option above or contact us.
• Location and camera: your browser asks permission before Seed can use your location or camera. You can refuse or change this in your browser settings.
• Other requests (objection, restriction, complaints): email bianettechltd@gmail.com.

Nigerian users may also complain to the Nigeria Data Protection Commission (NDPC); EU and UK users may contact their local data protection authority.

11. Where your information is processed

Some of our providers store or process information outside Nigeria. For example, our database is hosted by Neon in Germany (AWS eu-central-1, Frankfurt), our server runs on Render in the United States (Oregon), the website is served by Vercel from the United States, short-lived sign-in security data is held by Upstash in the United States (AWS us-west-1), and other providers listed in Section 6 operate internationally.

Requires client/legal confirmation: The client and its legal adviser need to confirm the lawful basis and safeguards for transferring personal data outside Nigeria, and the storage region of Supabase, which the app’s code does not state.

12. Children

Seed is intended for adults and is not directed at children under 18. Seed does not currently ask for your age at signup.

13. Changes to this policy

We will update this page when how we handle information changes (for example when identity checks are switched on, or Bartar or Jobs open), and update the date at the top.

14. Contact us

Bia’net Tech Ltd. — bianettechltd@gmail.com.

Requires client/legal confirmation: Add the company’s registered address, and the name and contact of a data protection officer if one has been designated. The app does not record either.