Privacy Policy

1. Introduction

SAYN Digital (“we”, “our”, “us”) operates estateFLOW, a property management platform (“the Service”). This Privacy Policy explains how we collect, use, disclose, and protect personal information in accordance with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR).

By using estateFLOW, you consent to the practices described in this policy.

2. Data Controller

The data controller for your personal information is:

3. Information We Collect

We collect the following categories of personal data:

• Account data: Name, email address, phone number, and password (hashed).
• Business data: Company name, RC Number, and business address.
• Tenant data: First name, last name, phone number, and tenancy information entered by property managers using the Service.
• Sensitive data: National Identification Number (NIN) and Bank Verification Number (BVN) where provided. This data is encrypted at rest and is never shared with third parties.
• Usage data: IP addresses, browser type, pages visited, and actions taken within the Service (for security and analytics).

4. How We Use Your Information

We use your personal data to:

• Provide and operate the estateFLOW platform
• Send transactional emails (account verification, password reset, payment receipts)
• Send service notifications (lease expiry alerts, rent reminders) where you have opted in
• Detect and prevent fraud or abuse
• Comply with legal obligations under Nigerian law
• Improve the Service through aggregated, anonymised analytics

5. Legal Basis for Processing

We process your personal data on the following legal bases under the NDPA 2023:

• Contract performance: To provide the Service you signed up for.
• Legitimate interests: For security monitoring, fraud prevention, and service improvement.
• Consent: For marketing communications and optional notifications. You may withdraw consent at any time.
• Legal obligation: Where required by Nigerian law.

6. Data Sharing

We do not sell your personal data. We share data only with trusted service providers who process it on our behalf under strict data processing agreements, including:

• Neon (database hosting) — United States
• Vercel (application hosting) — United States
• Resend (transactional email) — United States
• Anthropic (AI features) — United States, only when you use AI Assistant features

All international data transfers are conducted under standard contractual clauses and appropriate safeguards in line with NDPA requirements.

7. Data Retention

We retain your account data for as long as your account is active and for 12 months after deletion, unless a longer period is required by law. Tenant data is retained for the duration of your subscription plus 24 months to support audit requirements. You may request deletion of your data at any time (see Section 9).

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Passwords hashed using bcrypt (cost factor 12)
• All data transmitted over HTTPS/TLS
• Sensitive identifiers (NIN, BVN) encrypted at rest
• Access controls ensuring users only access their own data
• Rate limiting on all authentication endpoints

9. Your Rights

Under the NDPA 2023, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data.
• Right to data portability: Receive your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests.
• Right to withdraw consent: Withdraw consent for marketing or notifications at any time.

To exercise any of these rights, email privacy@estateflow.app. We will respond within 30 days.

10. Cookies

We use only essential cookies required for authentication (session tokens) and security. We do not use advertising or tracking cookies.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via an in-app notification at least 14 days before they take effect.

12. Contact Us

For privacy-related queries or to exercise your rights, contact our Data Protection Officer:

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.