Privacy Policy
Last updated: 11 July 2026 · Applies to the Ngozi service by Bamaja Integrated Online Services Ltd ("Bamaja", "we")
1. Who this policy covers
This policy covers three groups: (a) Merchants — business owners who employ Ngozi; (b) Customers of merchants — people who message a merchant's WhatsApp number that Ngozi answers; and (c) Website visitors. We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA).
2. Data we collect
| Category | Examples |
|---|---|
| Merchant account data | Business name, WhatsApp number, business type, delivery areas, displayed bank account details, catalogue items, prices and photos, opening hours, preferred language/tone. |
| Conversation data | Messages exchanged between the merchant's number and customers while Ngozi is active, including order details, questions, and images such as payment-receipt screenshots. |
| Contact metadata | Names of contacts saved on the merchant's phone, used only to protect friends and family from automated replies. We do not message saved contacts. |
| Billing data | Subscription status and payment references. Card details are processed by Paystack; we never see or store full card numbers. |
| Technical data | Connection status, error logs, and basic usage statistics needed to keep the service running. |
3. How we use data
- To operate Ngozi: reply to customers, capture orders, forward receipts, and send the nightly business report.
- To generate AI replies: relevant conversation text and the merchant's business information are sent to our AI language-model provider for processing (see Section 5).
- To provide the merchant dashboard, support, alerts, and billing.
- To improve reliability and safety (for example, loop protection and connection monitoring).
We do not sell personal data, use customer conversations for advertising, or message a merchant's saved contacts.
4. Customers of merchants — who is responsible
For conversations between a merchant and their customers, the merchant is the data controller and Bamaja acts as a data processor on the merchant's instructions (see our Data Processing Agreement). Customers who want their chat history corrected or deleted should contact the business they were chatting with; we act promptly on the merchant's instruction, and we also honour direct, verified deletion requests where the law requires.
5. Service providers (sub-processors)
| Provider | Purpose | Notes |
|---|---|---|
| AI language-model provider (currently DeepSeek) | Generating Ngozi's replies | Receives conversation text and business facts needed to answer; instructed not to be used for other purposes. |
| Paystack | Subscription payments | PCI-DSS compliant; handles all card data. |
| Cloud hosting providers | Servers and storage | Servers may be located outside Nigeria (currently within Europe). We apply appropriate safeguards for international transfer under the NDPA. |
| WhatsApp (Meta) | Message transport | All chats travel through WhatsApp's own end-to-end encrypted network under Meta's terms. |
6. Retention and deletion
- Account and conversation data are kept while the merchant's account is active.
- When an account is closed, or on a verified request, we delete associated personal data within 30 days, except records we must keep by law (for example, payment records).
- Merchants can delete individual customers and their chat history from the dashboard at any time.
7. Security
We use HTTPS/TLS encryption, per-business data isolation, access controls, and monitored infrastructure. Receipt images and media are stored in access-controlled storage. No system is 100% secure, but we notify affected parties of any breach as required by the NDPA.
8. Your rights (NDPA)
You may request access to, correction of, or deletion of your personal data; object to certain processing; and complain to the Nigeria Data Protection Commission. Contact us on WhatsApp at 0912 000 9870 and we will respond within a reasonable time, at most 30 days.
9. Cookies
The dashboard uses a single session cookie to keep you logged in. We do not use advertising or tracking cookies.
10. Children
The service is intended for business owners aged 18 and above and is not directed at children.
11. Changes and contact
We may update this policy and will show the new date above. Material changes will be announced to merchants. Contact: Bamaja Integrated Online Services Ltd, Lagos · WhatsApp 0912 000 9870.