Privacy Policy

MyNigerianGuide Limited ("MyNigerianGuide", "we", "us", or "our") operates the MyNigerianGuide website and platform (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have over it, in accordance with the Nigeria Data Protection Act 2023 ("NDPA") and its General Application and Implementation Directive ("GAID").

By using MyNigerianGuide, you agree to the collection and use of information as described in this policy.

1. Who we are

MyNigerianGuide Limited is the data controller responsible for your personal data. You can contact us about anything in this policy, or to exercise any of your data rights, at:

mynigerianguide@gmail.com

We currently act as our own Data Protection Officer while the company is at an early stage. We intend to appoint a dedicated Data Protection Officer as the platform grows.

2. Information we collect

We collect the following categories of personal data:

Account information

Email address, name, profile photo, and password (or, if you sign in with Google, Facebook, or LinkedIn, the name, email address, and profile photo those providers share with us).

Business page information

If you create a business page: business name, category, description, address, location, phone number, email, website, WhatsApp number, opening hours, and any photos you upload.

Verification documents

If you apply to verify a business, we collect your CAC registration number and supporting documents. We retain verification documents indefinitely, whether your application is approved or rejected, as part of our trust and safety record-keeping and to prevent repeated fraudulent verification attempts. You may request deletion of this data subject to the exceptions described in Section 6.

Content you create

Posts, comments, reviews, ratings, and any images you attach to them.

Usage and activity data

Businesses you follow, and — if you run an advertising campaign — impressions and clicks your campaign receives.

We also record the searches made on the platform: the words searched for, the location searched in, and how many results came back. If you are signed in when you search, that search is recorded against your account. If you are not signed in, it is recorded without any account attached to it. We use this to improve search relevance, to identify gaps in our directory, and to show business owners what people in their area are looking for.

Visitor measurement

When you view a business page, we record that a visit happened, which business page it was, and where you arrived from — for example, from a search on MyNigerianGuide, from another page on our site, or from an external link.

We do not store your IP address. Instead, we convert it into an irreversible cryptographic hash using a secret value known only to us, and store that hash. The hash cannot be converted back into your IP address.

We do this so we can tell repeat visits apart from separate visitors, and so we can filter out automated traffic such as search engine crawlers and link previews. Without it, the visitor numbers we show business owners would be inflated and unreliable.

Because this hash may allow us to recognise that two visits came from the same device, we treat it as personal data under the NDPA rather than as anonymous data, and we protect it accordingly. We do not use it to build advertising profiles, and we do not share it with third parties.

Payment information

Payments for advertising campaigns are processed by Paystack. We do not collect or store your card details ourselves — see Section 4 for more on this.

3. Why we process your data, and our legal basis

• To provide the Service — creating your account, displaying business pages, enabling search, posts, reviews, and messaging between you and businesses. Legal basis: performance of a contract with you.
• To verify businesses — reviewing CAC numbers and documents to award the verified badge. Legal basis: legitimate interest in maintaining a trustworthy directory, and your consent when you submit a verification request.
• To run advertising campaigns — processing payments, showing sponsored placements, and reporting performance to the business that purchased them. Legal basis: performance of a contract with the purchasing business.
• To improve search relevance and pricing — aggregated search and demand data helps us rank results and price advertising fairly. Legal basis: legitimate interest.
• To measure visits accurately — the hashed visitor identifier described in Section 2 lets us count distinct visitors rather than raw page loads, and exclude automated traffic, so the figures we report to business owners are honest. Legal basis: legitimate interest in providing accurate analytics to the businesses listed on our platform, balanced against the limited and non-identifying nature of the data stored.
• To keep the platform safe — investigating reports, moderating content, and preventing fraud or abuse. Legal basis: legitimate interest and, where applicable, legal obligation.
• To communicate with you — account-related emails (verification confirmations, security notices) and, where you have agreed, product updates. Legal basis: contract and, for optional communications, consent.

4. Who we share data with

We do not sell your personal data. We share data with the following categories of third parties, only as needed to run the Service:

• Supabase — our database, file storage, and authentication provider. Supabase stores your account data, business page data, uploaded photos, and verification documents on our behalf.
• Paystack — our payment processor for advertising campaign purchases. Paystack handles your payment card details directly; we never see or store your full card number.
• Resend — our transactional email provider, used to send account and notification emails.
• Google, Facebook, and LinkedIn — if you choose to sign in using one of these providers, they share your name, email, and profile photo with us to create your account.
• Vercel — our hosting provider, which runs the MyNigerianGuide website.
• Our staff — authorised staff with specific admin permissions may access relevant data to review verification applications, moderate reports, or provide customer support. Access is permission-gated and logged.
• Legal and regulatory bodies — where we are required to disclose data to comply with a legal obligation, court order, or valid request from the Nigeria Data Protection Commission or another competent authority.

Some of these providers may process or store data on servers located outside Nigeria. Where this happens, we take reasonable steps to ensure your data is protected to a standard consistent with the NDPA, including relying on providers with recognised international security and privacy certifications.

5. Cookies

We use essential cookies to keep you signed in and to remember your session. We do not currently use third-party advertising or tracking cookies. If this changes, we will update this policy and provide cookie controls where required.

6. How long we keep your data

• Account and business page data — kept while your account is active, and for a reasonable period after deletion in case of disputes, fraud investigation, or legal requirements.
• Verification documents — kept indefinitely, for both approved and rejected applications, as explained in Section 2.
• Payment records — retained as long as required under Nigerian financial and tax record-keeping obligations.
• Search records — kept for 12 months, after which they are either deleted or reduced to aggregate counts that do not identify any individual.
• Visitor measurement records — the hashed visitor identifiers described in Section 2 are kept for 12 months, after which they are deleted. Aggregate visit counts derived from them may be kept for longer, as those no longer relate to any individual visitor.

7. Your rights

Under the NDPA, you have the right to:

• Be informed about how your data is processed (this policy)
• Request access to the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your data, subject to the exceptions in Section 6
• Object to or request restriction of certain processing
• Request a copy of your data in a portable format
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any of these rights, contact us at mynigerianguide@gmail.com. We will respond within a reasonable time and at no cost, except in exceptional circumstances permitted by law.

8. Children

MyNigerianGuide is not directed at or intended for use by anyone under 18 years of age, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

9. Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), database-level access controls, and a permissions-based system restricting which staff can access which data. No method of transmission or storage is ever 100% secure, and we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by posting the updated policy on this page with a new "last updated" date, and, where appropriate, by email.

11. Contact us

If you have questions about this policy or how we handle your data, contact us at:

mynigerianguide@gmail.com