Legal
Privacy policy
Last updated 21 October 2026
Privacy Policy
Last Updated: 21 October 2026
Version: 1.0.0
1. Introduction
NairaCloud ("we", "us", "our") respects your privacy. This policy explains what we collect, why we collect it, how long we keep it, and the rights you have. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and, where it applies, the EU/UK General Data Protection Regulation (GDPR).
Data Controller: NairaCloud Technologies Limited, Lagos, Nigeria
Data Protection Officer: dpo@nairacloud.xyz
2. Information we collect
2.1 Account information
- Name, email address, and password (stored hashed, never in plain text)
- Organisation name and billing details you provide
- Payment references and tokens from our payment processor; we do not store full card numbers
2.2 Service and usage data
- API requests, resource consumption (CPU, RAM, disk, network), and instance metadata
- Instance metrics, restart events, and service health
- IP addresses, browser information, and device signals used for security and fraud prevention
2.3 Communications
- Support tickets, emails, and chat transcripts
- Feedback and survey responses
2.4 Security and audit data
- Authentication events, failed logins, SSH and administrative actions
- Edge access logs, control-plane audit records, and abuse reports
2.5 Cookies and local storage
- Essential authentication and CSRF cookies
- Optional preferences and analytics, where you have consented
See the Cookie Policy for the full list.
2.6 Special category data
We do not intentionally collect special category data (health, biometric, racial, political, religious, or sexual orientation data). If you upload such data to your instance, you are the controller for it and we act as your processor.
3. How we use your information
| Purpose | Lawful basis (GDPR Art. 6) | NDPA basis |
|---|---|---|
| Providing the service, authentication, and support | Contract | Contract |
| Billing, invoicing, and tax compliance | Legal obligation | Legal obligation |
| Security, fraud prevention, and abuse detection | Legitimate interest | Legitimate interest |
| Operating and improving the platform | Legitimate interest / consent where required | Legitimate interest / consent |
| Service and product communications | Consent | Consent |
| Legal defence and regulatory compliance | Legal obligation / legitimate interest | Legal obligation / legitimate interest |
We do not sell your personal data. We do not use your content for advertising.
4. Data sharing
4.1 Service providers (processors)
We use vetted providers for payment processing, transactional email, managed data and caching, infrastructure hosting, and monitoring. They process personal data only on our documented instructions and under contracts that protect it. A current list of providers is available on request. We give notice before adding a provider that processes personal data, and you may object.
4.2 Legal and regulatory
We disclose data only when required by valid legal process, to tax authorities where required by Nigerian law, or to a court or tribunal with jurisdiction. We verify the authority and scope of every request.
4.3 Business transfers
If we merge with, acquire, or sell assets to another organisation, data may transfer subject to confidentiality and this policy.
5. International transfers
Data may be processed outside Nigeria or the EEA. Where we transfer personal data internationally, we rely on appropriate safeguards such as Standard Contractual Clauses and adequacy decisions, supplemented by technical and organisational measures where required. We conduct transfer impact assessments for higher-risk transfers.
6. Data retention
We keep data only as long as we need it for the purpose we collected it, or as required by law. This table is the published retention schedule.
| Record | Contents | Retention |
|---|---|---|
| Account and profile data | Email, name, plan, verification state, payment reference | Life of account + 2 years |
| Billing and tax records | Invoices, payment references, tax identifiers | 7 years |
| Edge access logs | Timestamp, hostname, method, path, status, bytes, client IP, user agent | 30 days hot, 90 days archive |
| Control-plane audit log | Instance created, site added, domain attached, port published, suspension, legal disclosure | 2 years |
| SSH and administrative logs | Login events, key changes, administrative actions | 2 years |
| Abuse evidence | Content snapshots, notices, correspondence, actions taken | As long as the matter requires, then 3 years |
| Instance metrics | CPU, memory, disk, network counters, restart events | 13 months |
| Support tickets and communications | Tickets, emails, chat transcripts | 3 years after closure |
| Security incident records | Incident reports, response logs, notifications | 7 years |
| Deleted instance data | Instance disk and customer content | 30 days recovery, then purge |
| Backups | Encrypted backup copies | 90 days rolling |
Deletion. We securely delete data using industry-standard methods. Some records are kept longer where law requires it, or where they are needed for an active legal or abuse matter. We can confirm deletion on request.
7. Your rights
| Right | How to exercise it |
|---|---|
| Access | Dashboard data export, or email dpo@nairacloud.xyz |
| Rectification | Dashboard profile, or email dpo@nairacloud.xyz |
| Erasure | Dashboard delete account, or email (subject to legal holds) |
| Restriction | Email dpo@nairacloud.xyz |
| Portability | Dashboard data export |
| Object to processing | Email dpo@nairacloud.xyz; marketing unsubscribe link |
| Automated decision-making | We do not make solely automated decisions with legal or similarly significant effects |
| Withdraw consent | Dashboard privacy settings, or email |
We respond within 30 days, extendable by up to 60 days for complex requests. There is no fee unless a request is manifestly unfounded or excessive.
Complaints: Nigeria Data Protection Commission (NDPC) -- ndpc.gov.ng. EU/UK users may complain to their national supervisory authority.
8. Security
We maintain a security programme designed to protect your data, including:
- encryption of data in transit and at rest;
- least-privilege access controls and multi-factor authentication for staff;
- network isolation between tenants, the host, and the control plane;
- continuous monitoring and audit logging;
- vulnerability management and timely patching;
- encrypted backups with periodically tested recovery;
- documented incident response and breach notification.
No system is perfectly secure. If we become aware of a personal data breach, we notify the affected controller and the relevant authority where the law requires it, without undue delay.
9. Data protection impact assessments
We conduct DPIAs for new or high-risk processing, systematic monitoring, large-scale special category data, and new technologies. We maintain a DPIA register and make it available to a supervisory authority on request.
10. Records of processing
We maintain records of processing activities as required by the NDPA and GDPR Art. 30. These are available to a regulator on request.
11. Children
The service is not intended for anyone under 18. We do not knowingly collect children's data. If we discover it, we delete it.
12. Automated decision-making and profiling
We use automated risk signals for fraud and abuse prevention. Account actions that significantly affect you are reviewed by a person. We do not make solely automated decisions with legal or similarly significant effects.
13. Cookies
See the Cookie Policy.
14. Changes
Material changes get 30 days' notice by email and a dashboard banner. We keep version history and can provide it on request.
15. Contact
Data Protection Officer: dpo@nairacloud.xyz
Privacy: privacy@nairacloud.xyz
Abuse: abuse@nairacloud.xyz
Postal: NairaCloud Technologies Ltd, Lagos, Nigeria