Definitions

"Personal data" means any information relating to an identified or identifiable person, you. "Processing" means anything we do with that data, from collecting it to erasing it. "Controller" means the party deciding why and how data is processed; "processor" means a party processing it on the controller's instructions. Under the Nigeria Data Protection Act 2023, the terms "data controller" and "data processor" carry the same meanings used here.

Personal data we collect

We collect: identity data, being your name, date of birth and nationality as given in identity documents; contact data, being your email address, phone number and residential address; account data, being your login credentials, security settings and API keys you add; transaction data, being deposits, withdrawals, trading activity and balances; content data, being the messages and documents you send us, including verification uploads; and technical data, being IP address, browser type, device identifiers and similar information logged when you use the site. The registration form collects name, email and phone number; verification adds the documents listed on the AML / KYC page. We do not collect special-category data except where a selfie is used for a liveness check, which is used for that check alone.

Usage data

Usage data records how you interact with the site: pages viewed, features used, session duration, referral source and error events. It is collected through server logs and, where enabled, analytics tools. It serves security, debugging and rough measurement of which pages help users; it is not used to build advertising profiles of you and is not sold to anyone.

Cookie files

The site uses strictly necessary cookies for login sessions, security tokens and your language and currency preferences; the site does not work correctly without them. Optional analytics cookies, if enabled, help count visits anonymously. No advertising or cross-site tracking cookies are set by us. You can block or delete cookies in your browser at any time; blocking necessary cookies will prevent login and form submission rather than degrade them gracefully.

Controller and processors

Naija AI, 22 Adetokunbo Ademola Street, Victoria Island, Lagos, is the controller for the personal data described in this policy. Processors acting on our instructions include: hosting and infrastructure providers, identity-verification providers, email-delivery providers, analytics providers where enabled, and the payment processors involved in your deposits and withdrawals. Every processor is bound by a written contract requiring confidentiality, security and use of your data only for our instructed purpose.

Collection and use of information

We use your data: to create and operate your account; to verify your identity as required; to execute, record and support deposits, withdrawals and trading activity; to send service communications and, with consent, marketing; to secure the platform, detect fraud and investigate incidents; to meet legal, tax and regulatory obligations; and to improve the service in aggregate. Where a specific use falls outside these purposes, we ask first. We do not use your identity documents or selfie images to train any machine-learning model.

Legal bases for processing

Contract: processing needed to provide the account and services you requested, including credentials, transaction records and support history. Legal obligation: identity verification, transaction monitoring, record keeping and reporting under applicable Nigerian AML and tax requirements. Legitimate interests: platform security, fraud prevention, error correction and aggregate service improvement, balanced against your rights. Consent: marketing email and optional analytics, withdrawable at any time. Where processing rests on contract or law, refusing the data means we cannot provide the affected service; this is a consequence, not a penalty.

Data storage and retention

Identity and verification records: retained for the statutory period required by applicable Nigerian AML rules after the account closes. Transaction and accounting records: retained for the period required by applicable tax and company-law requirements. Account and support records: for the life of the account plus two years. Marketing consents: until withdrawn plus a short grace period to prove the withdrawal. Usage logs: up to 12 months. When retention ends, data is deleted or irreversibly anonymised; backups age out on a fixed cycle.

Data sharing and disclosure

We share personal data only with: processors performing functions for us as listed above; service providers and licensed counterparties involved in executing transactions on your account; affiliated companies within our group involved in providing the service; regulators, law-enforcement and tax authorities where disclosure is required by law or a valid order; and professional advisers under confidentiality. We do not sell personal data, and we do not share it with data brokers or advertising networks. In a sale or reorganisation of the business, data transfers with appropriate notice to you.

Security of your data

Technical measures include TLS encryption in transit, encryption of stored documents, salted password hashing, access control on a least-privilege basis and logged access to sensitive records. Organisational measures include role-based training, confidentiality undertakings and an escalation path for suspected breaches. No system is perfectly secure; if a breach affects your data, we notify you and the relevant authority as required by the Nigeria Data Protection Act 2023 without undue delay.

Your rights as a data subject

You have the right to: access your data and receive a copy; correct inaccurate data; delete data where no legal obligation requires us to keep it; restrict processing while a dispute over accuracy is resolved; object to processing based on legitimate interests or to direct marketing at any time; and withdraw consent for consent-based processing. To exercise any right, email [email protected] from your registered address. We respond within the periods the law requires and never charge for a first, reasonable request. Verification and AML records cannot be deleted while the statutory retention period runs, because the legal obligation overrides the deletion right for that period.

Service providers

Current categories of processors are listed in the controller section above; the specific providers change as the service evolves, and the categories and purposes stay as described here. Each provider receives only the data its function requires: an email-delivery provider receives your address and message content, not your trading history; a verification provider receives your documents, not your balances. We review providers' security at onboarding and periodically afterwards.

Analytics

Where analytics are enabled, they run on aggregated, pseudonymised data to answer questions like which guide pages new users read before their first deposit. Analytics data is retained for up to 14 months, is not combined with your identity for profiling, and plays no role in decisions about your account. If a future analytics tool introduces identifiers that could profile you, this page will say so before it switches on, and it will sit behind consent.

Advertising and retargeting

We run advertising to bring visitors to the site, but we do not run retargeting that follows you across other websites, and we do not buy or append data from data brokers. Where an advertising platform provides aggregate campaign statistics, the data is campaign-level, not personal. Marketing email we send ourselves is covered by your consent and the unsubscribe link in every message.

Links to third-party sites

The site links to external services, including payment providers' help pages and regulators' websites. Once you leave naija-ai.com, this policy no longer applies; the destination's own policy governs. We are not responsible for third parties' data practices, and we choose destinations that are relevant rather than promotional.

Children's privacy

The service is directed at adults. Accounts are available only to persons aged 18 and over, and verification makes underage registration practically impossible. We do not knowingly collect data from children; if we learn that we have, we delete it promptly. If you believe a minor has provided data to us, write to the contact address below and we will act the same working day.

Changes to this policy

We may update this policy to reflect changes in the service, providers or applicable law. The current version always lives at this address, and material changes are announced to registered users by email at least 14 days before taking effect. The version you accepted at registration is available on request throughout your relationship with us.

Contact us

For any privacy question, a rights request or a complaint about data handling, write to [email protected], Client Support & Compliance, 22 Adetokunbo Ademola Street, Victoria Island, Lagos. If you are not satisfied with our answer, you may escalate to the Nigerian Data Protection Commission, which supervises data-protection complaints in Nigeria.