Privacy Policy

Section 1

Introduction

NaijaBase is operated by Telecity Technologies Ltd, a company incorporated in Nigeria. We provide Backend-as-a-Service infrastructure at naijabase.dev and app.naijabase.dev.

We are deeply committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, and how we protect it — in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and its implementing regulations.

This policy applies to all users of:

• Our marketing website at naijabase.dev
• Our application platform at app.naijabase.dev
• Any services provided under the NaijaBase brand

By using NaijaBase, you agree to the collection and use of data as described in this policy. If you do not agree, please discontinue use of our services.

Section 2

Data We Collect

We collect the following categories of data:

Account Data

• Full name and email address (required for signup)
• Company or organization name (optional)
• Password — stored as a bcrypt hash; we never store your plain-text password

Usage Data

• Number of API requests made per project
• Database storage consumed (in MB)
• File storage consumed (in MB)
• Number of active users in your projects

Billing Data

• Your subscription plan (Starter, Growth, Scale, Business, or Compliance Pro)
• Payment history and invoices
• Card details are handled exclusively by Paystack — we never see or store your card numbers

Project Data

• Database contents created within your NaijaBase projects
• Files and documents uploaded to NaijaBase Storage
• API keys associated with your projects

Log Data

• IP addresses at time of login and API calls
• Browser type and version
• Timestamps of significant events (login, project creation, etc.)

Section 3

How We Use Your Data

We use the data we collect strictly to operate and improve the NaijaBase platform:

• To create and manage your NaijaBase account
• To provision and operate your database, storage, and API infrastructure
• To process payments via Paystack
• To send transactional emails (welcome messages, invoices, usage alerts, monthly reports)
• To enforce our usage limits and fair-use policies
• To diagnose technical issues and maintain platform reliability
• To improve the NaijaBase platform based on anonymized usage patterns

Section 4

Data Storage & Residency

All data processed and stored by NaijaBase resides entirely within Nigeria:

We do not transfer your personal data outside Nigeria without your explicit written consent. This is not merely a policy choice — it is a technical reality: our entire infrastructure stack (compute, database, and storage) runs within Nigerian data centers.

This approach makes NaijaBase fully compliant with NDPA 2023, Section 41, which governs cross-border data transfers. Nigerian fintechs, healthtech companies, and government contractors using NaijaBase can demonstrate that all personal data of Nigerian citizens remains within Nigerian jurisdiction.

Section 5

Your Customer Data (Data You Store With Us)

When you build applications on NaijaBase, your end users' data is stored in your NaijaBase projects. The following principles govern how we handle that data:

• You own it: You retain full ownership of all data stored in your NaijaBase projects. We make no claim over it.
• We are your Data Processor: Under the NDPA 2023, NaijaBase acts as a Data Processor. You are the Data Controller. We process your customers' data only on your instructions and for no other purpose.
• We don't read your data: We do not access the contents of your databases or files except where you explicitly grant us permission for support purposes.
• Data Processing Agreement (DPA): Business plan subscribers and above receive a signed Data Processing Agreement confirming our obligations as your Data Processor under NDPA 2023.
• Data portability: You may export all your project data at any time through our API or dashboard.

Section 6

Data Retention

We retain your data for only as long as necessary:

• Account data — retained while your account is active, plus 90 days after account deletion (to allow for accidental deletion recovery)
• Project data — deleted immediately and permanently upon project deletion; not recoverable after deletion
• Billing records — retained for 7 years as required by Nigerian tax and financial regulations
• Log data (IP addresses, timestamps) — retained for 90 days, then permanently deleted

When you delete your account, we begin the deletion process immediately. Account data is fully purged within 90 days. Billing records are retained separately as required by law.

Section 7

Your Rights Under NDPA 2023

The Nigeria Data Protection Act 2023 grants you the following rights in respect of your personal data:

• Right to access — request a copy of all personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your personal data (subject to legal retention obligations)
• Right to data portability — receive your data in a machine-readable format
• Right to object — object to processing of your data for any purpose
• Right to withdraw consent — where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at ofatokun@telecitytech.com. We will respond within 30 days as required by the NDPA 2023. We will not charge a fee for reasonable requests.

Section 8

Cookies

NaijaBase uses only essential cookies necessary to operate the service. We do not use advertising, tracking, or analytics cookies.

• Session cookies — used to keep you logged in to app.naijabase.dev; expire when you close your browser or log out
• Authentication token — stored in localStorage on your device to maintain your logged-in state

We do not use Google Analytics, Facebook Pixel, or any third-party tracking cookies. Your browsing of the NaijaBase platform is not shared with advertisers or data brokers.

Section 9

Security

We implement technical and organizational measures to protect your data:

• Encryption in transit — all connections use TLS 1.3; unencrypted HTTP is rejected
• Password hashing — passwords are hashed using bcrypt with a strong cost factor; plain-text passwords are never stored or logged
• API key security — API keys are hashed before storage; the plain-text key is shown only once at creation
• Row Level Security — each NaijaBase project's data is isolated using PostgreSQL Row Level Security policies
• Access controls — internal access to production systems is restricted to authorized personnel via key-based authentication
• Regular security reviews — we review our security posture regularly and address vulnerabilities promptly

Despite these measures, no system is perfectly secure. In the event of a data breach affecting your personal data, we will notify you and the Nigeria Data Protection Commission (NDPC) within 72 hours as required by the NDPA 2023.

Section 10

Third-Party Services

NaijaBase uses a small number of carefully chosen third-party services. Each is used only for its stated purpose:

• Paystack (payment processing) — processes card payments on our behalf. Paystack is PCI-DSS certified and operates under Nigerian law. We share only the minimum necessary data (email address, plan amount) for payment processing. See Paystack's Privacy Policy.
• Resend (transactional email) — delivers transactional emails (welcome, invoices, usage alerts) on our behalf. We share your email address and name for this purpose only. See Resend's Privacy Policy.
• Nobus Cloud (infrastructure) — provides our Nigerian data center infrastructure. All servers are located in Nigeria. Nobus processes infrastructure-level data (compute, network) only.

We do not share your data with any other third parties. We do not use advertising networks, social media trackers, or data brokers.

Section 11

Children

NaijaBase is a developer platform intended for users aged 18 and above. We do not knowingly collect personal data from anyone under 18 years of age.

If you believe a minor has created a NaijaBase account, please contact us immediately at ofatokun@telecitytech.com and we will promptly delete the account and all associated data.

Section 12

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations.

For material changes — those that significantly affect your rights or how we handle your data — we will notify you by email at least 30 days before the changes take effect. The notification will clearly describe what is changing and why.

Continued use of NaijaBase after the effective date of updated terms constitutes acceptance of the revised policy. If you disagree with a material change, you may export your data and delete your account before the change takes effect.

The "Effective date" at the top of this page always reflects when the current version was published. Previous versions are available on request.

Section 13

Contact & Complaints

For any questions, requests, or concerns about this Privacy Policy or how we handle your data, contact our Data Protection team:

• Email: ofatokun@telecitytech.com
• Company: Telecity Technologies Ltd, Lagos, Nigeria
• Website: naijabase.dev

We aim to respond to all inquiries within 5 business days and to resolve data requests within 30 days.

If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to lodge a complaint with Nigeria's data protection authority: