Privacy policy

This policy explains how [Registered company name] Ltd (“we”, “us”) handles personal data when you visit our website, use Orkesta (the “Service”), or talk to a business that uses the Service. We process personal data in line with the Nigeria Data Protection Act 2023 (“NDPA”) and other applicable law.

1. Who is responsible for your data

• Our customers’ end-customers. When you message a business that uses Orkesta, that business is the data controller for your conversation. We process it on their behalf, as a data processor, under our agreement with them. Please contact that business first about your data; we will help them respond.
• Account users and website visitors. For people who create an account, are invited to a workspace, contact us or browse our website, we are the data controller.

2. Data we collect

Account and workspace data

• Name, email address, password (stored only as a one-way hash), role and workspace membership.
• Business details, configuration, knowledge-base content and documents you upload.
• Security and audit records: sign-ins, IP address, browser information and actions taken in the Service.

Conversation data processed for our customers

• Messages exchanged with a business through WhatsApp or website chat, and attachments.
• Identifiers such as phone number, WhatsApp display name, or the name and email provided in website chat.
• Order, payment or delivery details retrieved from the business’s own systems to answer a request.
• Records of what the AI did: the route taken, tools used, sources cited, and whether a person took over.

Contact and website data

• The details you submit through our contact form: name, email, company and message.
• Essential cookies described in section 7.

3. How and why we use data

We do not sell personal data. We do not use our customers’ conversation data to train our own or third-party AI models, and we do not make decisions with legal or similarly significant effects about individuals solely by automated means — sensitive actions such as refunds require a person’s approval.

4. AI providers

To generate replies, the Service sends the parts of a conversation and the business’s knowledge needed for that reply to the AI provider(s) the business has chosen. We minimise what is sent: contact details are not included unless required for the request, and record lookups return summaries rather than full customer profiles. We use providers’ business APIs, which under their terms do not use API data to train their models by default.

5. Sub-processors

6. International transfers

Some providers above process data outside Nigeria. Where we transfer personal data abroad we rely on the safeguards permitted by Part VIII of the NDPA, such as contractual commitments that provide an adequate level of protection, and we assess providers’ security before using them.

7. Cookies

We use one essential cookie: a secure, HttpOnly session cookie that keeps you signed in. We do not use advertising or third-party tracking cookies. The website chat widget stores a random identifier in the visitor’s browser storage so an ongoing conversation can continue.

8. Retention

• Workspace and conversation data is kept for as long as our customer’s account is active, or shorter where the customer deletes it.
• After an account is closed, we delete or anonymise its data within 90 days, except where law requires us to keep it longer.
• Audit and security logs are kept for up to 24 months.
• Contact-form submissions are kept for up to 24 months after our last correspondence.

9. Security

We protect data with encryption in transit, encryption at rest for integration credentials, strict separation between business workspaces, role-based access, Argon2id password hashing, and an append-only audit log. Read more on our security page. If a personal data breach is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission within 72 hours and inform affected customers without undue delay, as required by the NDPA.

10. Your rights

Under the NDPA you have the right to:

• be informed about, and access, the personal data we hold about you;
• have inaccurate data corrected, and data erased where there is no lawful reason to keep it;
• restrict or object to processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time where processing is based on consent; and
• lodge a complaint with the Nigeria Data Protection Commission.

To exercise a right, email [privacy@your-domain.com] or use our contact form. We respond within the time required by law. If your request concerns a conversation with one of our customers, we will pass it to that business and support their response.

11. Children

The Service is intended for businesses and is not directed at children under 18. We do not knowingly collect their personal data.

12. Contact and Data Protection Officer

[Registered company name] Ltd, [Registered office address], Lagos, Nigeria.
Data Protection Officer: [Data Protection Officer name] — [privacy@your-domain.com]

13. Changes

We will post updates to this policy here and notify account owners of material changes by email before they take effect.