Privacy Policy

Movodb (“we”, “us”, “our”) provides physical access control software for residential estates, apartment buildings, and similar properties. This policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and your rights under the Nigeria Data Protection Act 2023 (“NDPA”).

Controller. Movodb is the data controller for the personal data described in this policy. Contact: privacy@movodb.com.ng. Address: [REGISTERED OFFICE ADDRESS].

1. Who this policy covers

This policy covers:

• Estate administrators and their staff who create and manage an account on Movodb.
• Residents of estates using Movodb.
• Guards and other gate operators whose activity is recorded at estate gates.
• Visitors, vendors, and contractors who receive a PIN credential to enter an estate.
• Platform owners of Movodb itself.

If you are a resident or a visitor at an estate using Movodb, the estate is the data controller for your data. Movodb is a data processor acting on the estate’s instructions. Requests about your data should be directed to the estate in the first instance; we will assist the estate in responding.

2. What we collect

Account data. Name, email address, phone number (optional), password hash, account status, signup timestamp, and — for estate administrators — the estate’s name and organisation type.

Estate and property data. Property names, unit numbers, gate names, guard shift records. This data identifies physical places, not people, but may be combined with access events to identify who entered where.

Access credentials. Six-digit PIN credentials issued to residents, visitors, and vendors. Credentials are stored hashed; the underlying PIN is never stored in plain text.

Access events. Every entry attempt, exit attempt, and gate operator action. This includes the credential used, the gate, the guard on shift, the timestamp, the result (granted, denied, unresolved), and any reason recorded.

Payment data. When an estate pays for a subscription: the amount, currency, status, provider reference, and — for card payments — a tokenised record held by our payment processor (Paystack). We do not store full card numbers, CVVs, or bank account credentials. Those are held by Paystack and their banking partners.

Technical data. IP address, user-agent string, request path, and timestamp, logged by our infrastructure provider (Cloudflare) when you access the service.

Error data. When the software encounters an unexpected error, we capture a stack trace, the account ID associated with the request, and the environment name, via our error-tracking provider (Sentry).

3. Data we do not currently collect

To be explicit about the scope of this policy: Movodb does not currently collect:

• Product usage telemetry (feature clicks, session recordings, page-view analytics).
• Marketing or advertising identifiers.
• Data from cookies set for advertising or cross-site tracking.
• Customer relationship management (CRM) or sales pipeline data about prospective customers.
• Biometric data of any kind.

If we begin collecting any of the above in future, this policy will be updated, the update will be announced in-product, and existing users will be asked to review the change.

4. Why we process your data

We process personal data on the following lawful bases under Section 25 of the NDPA:

Where we rely on legitimate interest, we have carried out a Legitimate Interest Assessment (LIA) and can provide a summary on request.

5. Who we share data with

We share personal data with the following service providers, each of whom processes data on our behalf under written contract:

• Supabase — database hosting, authentication. Data stored in the EU (eu-west-1).
• Cloudflare — web application hosting, edge network, request logging.
• Paystack — payment processing (Nigeria).
• Sentry — error tracking.
• Brevo (planned) — transactional email delivery.

We also disclose data where required by Nigerian law, court order, or a lawful request from a regulator.

We do not sell personal data. We do not share personal data with advertisers.

6. Cross-border transfers

Some of our service providers store data outside Nigeria — currently in the European Union (Supabase’s eu-west-1 region) and in Cloudflare’s global edge network. Where data is transferred outside Nigeria, we rely on the NDPA’s cross-border transfer provisions and ensure that the receiving jurisdiction offers an adequate level of protection, or that appropriate safeguards are in place.

7. How long we keep data

• Account data: for the lifetime of the account, plus 90 days after account closure.
• Access events: for as long as the estate’s subscription is active, plus 12 months. Estates may configure a shorter retention period.
• Payment records: 7 years, to comply with Nigerian tax and accounting requirements.
• Technical logs (IP, user-agent): 30 days.
• Error events: 90 days.

8. Your rights

Under Sections 34–38 of the NDPA you have the right to:

• Be informed about how your data is processed.
• Access a copy of the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data, where no lawful basis requires us to keep it.
• Restrict or object to certain processing.
• Receive your data in a portable, structured format.
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise any of these rights, contact privacy@movodb.com.ng. We will respond within 30 days.

Residents and visitors: your data is held by the estate as controller. Requests should be directed to the estate in the first instance. Where the estate requires our assistance, we will cooperate.

9. Cookies

Movodb uses cookies strictly necessary for authentication and session management. We do not use advertising or tracking cookies. If we begin using analytics cookies in future, we will ask for your consent before setting them and update this section.

10. Security

We apply industry-standard security measures, including: encryption in transit (HTTPS/TLS), hashed storage of credentials, access controls scoped by role, append-only audit logs, and signature-verified payment webhooks. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the Nigeria Data Protection Commission as required by the NDPA.

11. Changes to this policy

If we change this policy in a way that materially affects your rights, we will notify you in-product and update the “Last updated” date above. Continued use of the service after the effective date of a change constitutes acceptance of the updated policy.

12. Contact

• Questions or requests: privacy@movodb.com.ng
• Registered address: [REGISTERED OFFICE ADDRESS]
• Data Protection Officer: [DPO NAME OR “not yet appointed — contact via the address above”]