Privacy notice

This notice explains how NaijaReception AI ("we") processes personal data when businesses use NaijaReception AI and when their customers speak to an AI receptionist. We aim to process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and guidance from the Nigeria Data Protection Commission.

Two roles

• Business account data (owners and staff): we are the data controller.
• Caller data (people who call a business): the business is the controller and we act as its processor, following its instructions and our data processing terms.

What we collect

• Account data: name, email, hashed password (handled by our authentication provider), workspace details.
• Call data: phone numbers, call times and duration, transcripts and summaries, and recordings only where the business enabled recording and the caller was informed.
• Lead data: details a caller chose to share (name, phone, email, interest), together with a record of their consent to be contacted.
• Billing data: top-up amounts, references and status. Card details are handled by Paystack; we never receive or store full card numbers.
• Technical data: IP address, device and log information needed for security and abuse prevention.

Why we process it (lawful bases)

• To provide the service under our contract with the business.
• To meet legal obligations, such as financial record keeping.
• Legitimate interests in securing the platform and preventing fraud, balanced against your rights.
• Consent, where required — for example before a caller's contact details are saved for follow-up.

AI and recordings

Callers are told they are speaking to a virtual assistant. We do not use transcripts or recordings to train AI models unless a separate, documented consent and data-governance process allows it.

Sharing and processors

We use sub-processors to run the service, including our hosting provider, our database provider, our voice/telephony provider and our payment processor. Some may process data outside Nigeria; where they do, we rely on the transfer mechanisms permitted by the NDPA.

Retention

Each business sets how long its call transcripts are kept (default 180 days). Financial ledger records are kept for as long as the law requires, with personal details minimised. Provider-held recordings follow the provider's retention period.

Your rights

You may request access, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent. Callers should contact the business they called; we will assist the business. You can also complain to the Nigeria Data Protection Commission.

Security

We use encryption in transit, tenant isolation enforced in the database, least-privilege access, audit logs for privileged actions, and redaction of secrets in logs.

Contact

Email support@example.com. Where required, our Data Protection Officer can be reached at the same address.