1. Who this policy is for
This Cookie Policy is issued by Keyvata Ltd and applies to people who visit or use:
- the public website at keyvata.com (including www.keyvata.com);
- the marketplace, auth, and hub at app.keyvata.com; and
- embedded checkout or maps that those sites load.
The iOS and Android apps do not use browser cookies. They store session tokens in the operating system's secure store. Those tokens are described here so the picture is complete; app permissions (camera, location, notifications) are covered in the Privacy Policy.
Controller: Keyvata Ltd, Shop 17, KC Plaza, Ushafa Bwari Road, Bwari, Abuja. Privacy: privacy@keyvata.com.
2. What cookies and similar technologies are
A cookie is a small text file a site stores on your device. We also use technologies that the law treats like cookies:
- HttpOnly cookies — set by our servers so scripts on the page cannot read session tokens.
- Local storage / session storage — used only after you allow the Preferences category, for theme and compare-tray state.
- Pixels and third-party scripts — for example Google Maps JavaScript, which may set cookies on Google's domains when you allow Functional cookies.
Cookies can be first-party (keyvata.com / app.keyvata.com) or set on another site when checkout or sign-in opens. We cannot switch off another site's cookies on their checkout or sign-in page; we can refuse to load that script until you agree where the script is optional (maps).
3. The consent standard we follow
We treat optional cookies as requiring a freely given, specific, informed, and unambiguous indication of wishes before they are used. That matches:
- Nigeria Data Protection Act 2023 transparency and lawful-basis duties;
- EU ePrivacy Directive article 5(3) and UK PECR (consent before non-essential storage), which app stores and many payment partners expect as the international baseline;
- Google Play User Data and Apple App Store privacy disclosures that must match what the product actually does.
kv_consent cookie so we can honour that choice.Consent is valid only if:
- Reject optional and Accept optional are both available and equally easy;
- no box is pre-ticked for an optional category;
- you can change your mind from Cookie settings in the footer, at any time;
- we do not bundle consent for maps with consent for ads — each category is separate.
We store your choice for up to 180 days, then we ask again. If we change the categories or add a new optional cookie, we bump the consent version and ask again.
4. How to give, refuse, or withdraw permission
- On first visit a blocking sheet appears. It does not disappear if you click the page behind it. You must choose.
- Reject optional — only strictly necessary cookies. Maps will not load. Theme and compare lists will not be saved. You can still browse listings as a list and sign in.
- Accept optional — Preferences, Functional (maps), and Diagnostics. Marketing stays off unless you switch it on in Customize. Keyvata does not currently set marketing cookies.
- Customize / Cookie settings — turn each category on or off, then Save my choices.
Withdrawal is as easy as giving consent: open Cookie settings from any footer, or delete site data in your browser (that also signs you out).
5. Categories and lawful bases
| Category | Default | Lawful basis | What happens if you refuse |
|---|---|---|---|
| Strictly necessary | Always on after you make a choice | Contract / legitimate interests in securing the service (NDPA). ePrivacy exception for storage that is strictly necessary to provide a service you requested. | You cannot stay signed in or have us remember this choice. |
| Preferences | Off until you allow it | Consent | Theme and compare tray reset when you close the tab. |
| Functional (maps) | Off until you allow it | Consent | Listing maps and Places search do not load. Address search by text still works. |
| Diagnostics & analytics | Off until you allow it | Consent | We receive fewer crash reports; the product still works. |
| Marketing | Off. Not in use today | Consent — we will not switch this on in code without a new yes | No advertising cookies either way, unless a future version asks you first. |
6. Cookie and storage inventory
Strictly necessary (first-party, keyvata.com and app.keyvata.com)
| Name | Type | Purpose | Duration |
|---|---|---|---|
| kv_consent | First-party cookie | Stores the categories you allowed, the policy version, and the time of the choice so we do not re-ask every page load and so we can prove we waited for permission. | 180 days |
| keyvata.cookie-consent | Local storage (mirror of kv_consent) | Backup of the same choice if cookies are blocked mid-session. Written only after you choose. | Until you clear site data |
| kv_access | HttpOnly cookie | Short-lived signed-in access token. Set only after you authenticate. Scripts cannot read it. | About 15 minutes, then rotated |
| kv_refresh | HttpOnly cookie | Refresh token so we can rotate access without keeping a password in the browser. | 7 days, or until you sign out |
| kv_admin_access / kv_admin_refresh | HttpOnly cookies | Separate staff-console session. Not set for ordinary members. | Aligned with staff session policy |
Preferences (only if you allow Preferences)
| Name | Type | Purpose | Duration |
|---|---|---|---|
| keyvata.theme | Local storage | Light, dark, or system colour scheme. | Until you clear it or withdraw Preferences |
| keyvata_compare_listings | Local storage | Up to three listing IDs in the compare tray. | Until you clear it or withdraw Preferences |
Functional (only if you allow Functional)
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Google Maps / Places cookies (third-party) | Set by Google on maps.googleapis.com and related hosts | Render map tiles, Places autocomplete, and listing pins. Google is an independent controller for those cookies. | Set by Google; see Google's privacy policy |
Diagnostics (only if you allow Diagnostics)
If we enable a crash reporter (for example Sentry) it will only initialise after this category is on. Names and durations will be listed here before that ships. Today the toggle reserves consent so we cannot enable diagnostics silently.
Marketing
No first-party advertising cookies, no Meta/Google ads pixels, no sale of browsing data. The category exists so a future campaign cannot go live without a recorded yes and an update to this table.
7. Third parties you may meet
Some steps take you off Keyvata's origin. Those companies set their own cookies under their own policies. We list them so you are not surprised:
- Card checkout — loaded when you start a payment you requested (strictly necessary for that transaction). That checkout may set its own cookies.
- Google Sign-In / Apple Sign-In — only if you choose those buttons. Google and Apple process the sign-in as independent controllers.
- Google Maps Platform — only after Functional consent. Google's maps cookies are not strictly necessary to use Keyvata; list search still works without a map.
- Identity-verification vendor — KYC webviews may set cookies on the vendor origin while a check you started is running.
If a processor is outside Nigeria, we use contractual safeguards consistent with the NDPA before the transfer, as described in the Privacy Policy.
8. Browser, device, and Do Not Track
You can also delete cookies in the browser (Settings → Privacy → Cookies) for keyvata.com and app.keyvata.com. That signs you out and forgets this consent, so we will ask again on the next visit.
Global Privacy Control / DNT signals: where we can detect a user-agent GPC signal we treat it as a refuse of optional categories on first visit. You can still opt in later via Cookie settings.
Mobile: sign out or uninstall to remove tokens. OS settings control location, camera, and notifications independently of this policy.
9. Children, contact, changes
Keyvata is for people 18 or older. We do not use cookies to target children.
Questions or a complaint about cookies: privacy@keyvata.com. You may also contact the Nigeria Data Protection Commission at ndpc.gov.ng.
Material changes (new optional cookie, new vendor, shorter withdrawal path) are posted on this page with a new effective date and a new consent version so the sheet appears again.
Related policies: Terms of Service, Privacy Policy, and Cookie Policy.