Your public identity can be pseudonymous. Your personal data still deserves careful handling.

1. Who is responsible and how to contact us

27Naira, the Nigeria-focused operator of the 27Naira platform, is the data controller for the personal data described in this Notice. Questions, rights requests and complaints can be sent to privacy@27naira.com. Signed-in members may also open a tracked Privacy request from the Safety & appeals section of their account.

If your concern relates to a seller’s handling of information after you leave 27Naira or contact the seller through another channel, that seller may be independently responsible for that processing.

2. The principles we follow

We aim to process personal data fairly, lawfully and transparently; for specified purposes; in a way that is adequate and limited to what is necessary; accurately; no longer than needed; and with security appropriate to the risk. We review new features for privacy, data minimisation and access control before release.

3. Personal data we collect

Account and profile data

• Email address, Firebase account identifier, email-verification state and authentication/security events.
• Username, display name, avatar, biography, broad region, theme, language and low-data preferences.
• Account status, Sub-Sphere memberships, reputation, contributor levels and verified-expertise application and review details.

Content and activity

• Posts, questions, comments, replies, images, clips, captions, links, votes, saves, edits and timestamps.
• Reports, corroborations, restoration reports, source links, support requests, appeals and moderation decisions.
• Broad state and locality entered for 27Signal. We do not ask for GPS coordinates or a precise street address.

Marketplace and opportunity data

• Store name, description, broad location, approval records, listings, prices, images, availability and fulfilment status.
• Buyer enquiries, seller replies, listing reports and related timestamps. We do not request or process payment-card details, online-banking credentials, one-time passwords, orders, escrow or settlement data.
• Opportunity submissions, organisation names, eligibility, location, source links and verification notes.

Technical and service data

• IP address, browser/device type, request and security logs, error data, storage paths, file type and size, and approximate network-derived location where generated by infrastructure providers.
• Limited visit, navigation, device-category and performance events through Google Analytics unless you turn analytics off. Advertising and ad-personalisation consent signals are denied.
• Theme, language, data-saving mode and analytics choice stored locally in your browser.

Images and videos can contain embedded metadata added by your device. Review files before uploading and do not include precise location or private information you do not want to share.

4. Where the data comes from

Most data comes directly from you. We also generate service data when you use 27Naira, receive account and file information from Firebase and Google Cloud, receive reports or transaction context from other members, and receive source information from public publishers or administrators reviewing NaijaPulse and opportunities. We may receive lawful requests from courts, regulators or authorised public bodies.

5. Why we use data and our lawful bases

• Provide the service and perform our agreement: create and secure accounts; publish and organise contributions; deliver voting, saving, translation, read-aloud, messaging and support; process seller and listing applications; and remember requested settings.
• Legitimate interests: keep the platform reliable and secure; prevent fraud, spam and abuse; moderate content; calculate reputation; investigate reports; protect users and the public; measure aggregated visits and feature use; improve accessibility and performance; and defend legal claims. We document and balance these interests against your rights and reasonable expectations, minimise analytics data, disable advertising signals and provide an immediate opt-out.
• Consent: processing for which we specifically ask permission. You can withdraw consent without affecting earlier lawful processing. If law requires consent for a new analytics or advertising purpose, that processing will not start before consent.
• Legal obligation: preserve or disclose records where Nigerian law, a valid court order or an authorised regulator requires it; respond to data-protection requests; and manage qualifying security incidents.
• Vital interests: use or disclose limited information where reasonably necessary to protect someone from an imminent threat to life or serious harm.

Where we introduce a materially different purpose, we will provide notice and obtain consent where the law requires it.

6. What is public and what is restricted

Usernames, public profiles, reputation and expertise badges, posts, comments, questions, approved store pages, approved listings, published opportunities, published NaijaPulse articles and broad-area 27Signals can be public and may be indexed or reshared by others.

Email addresses, password credentials, saved-post records, private buyer/seller conversations, support requests, unpublished applications, anonymous-author mappings, internal review notes and administrator records are restricted to authorised access. “Anonymous” posting hides the author from other users; it is pseudonymous, not anonymous to 27Naira, and the protected author mapping may be accessed for safety, appeals or lawful obligations.

7. Analytics, browser storage and your choice

Essential storage is used for authentication, security, theme, reading language, data-saving mode and other settings you request. These functions cannot work reliably without it. Limited Google Analytics is on by default under our legitimate interest in measuring visits, reliability and feature use so we can improve 27Naira. We do not enable Google advertising, ad-user-data or ad-personalisation signals through this implementation.

A conspicuous first-visit notice explains the purpose and provides an immediate “Turn analytics off” control. You can change the choice at any time, and turning analytics off does not reduce access to 27Naira. Opting out stops future analytics collection on that browser; earlier lawfully collected events may remain in aggregated reports until their retention period ends.

8. AI-assisted features and human decisions

Authorised editors may use Google Vertex AI to turn linked source material into a proposed NaijaPulse structure. The source text and link supplied to the drafting tool are treated as editorial material. A human administrator must check the source and decide whether to save, verify or publish the draft.

Translation and other assistive features may process the text you request. AI does not autonomously publish NaijaPulse articles, approve stores or listings, award verified-expertise badges, suspend accounts or decide appeals. Moderation and other decisions with significant account effects remain subject to human review and can be contested.

9. Who we share data with

• Google Firebase and Google Cloud: authentication, database, application hosting, file storage, security, server functions, limited analytics unless disabled, and Vertex AI-assisted editorial drafting.
• Resend or a replacement transactional-email provider: account-related and approval notifications when that service is enabled.
• Other users and the public: information you choose to publish or send through marketplace conversations.
• Professional advisers and service specialists: only where necessary, under confidentiality and data-protection duties.
• Authorities or affected persons: when required by a valid legal process, to investigate unlawful activity, or where reasonably necessary to prevent serious harm.
• A successor operator: as part of a merger, financing, reorganisation or transfer, subject to confidentiality and continued protection.

We do not sell or rent personal data and do not provide it to third parties for their own behavioural advertising.

10. International processing

Some providers may process data outside Nigeria. Where personal data is transferred internationally, we use provider contracts and other safeguards recognised by applicable law, consider the destination’s protections and limit the transferred data to what the service requires. You may request information about the relevant safeguard through the privacy contact above.

11. How long we keep data

• Active account and profile: while the account remains open.
• Closed account: delete or de-identify the profile and non-required account data within 30 days after a verified request; residual encrypted backups may persist for up to 90 additional days.
• Public content: until the author deletes it where that control is available, the account is closed, or moderation removes it. We may retain a restricted copy for up to 12 months for appeals, abuse prevention and evidence.
• Marketplace conversations: two years after the last message or listing closure, to support disputes and safety investigations.
• Pending or rejected store and listing records: one year after the final decision; approved records remain while active and for up to two years after closure.
• Reports, moderation actions, expertise reviews, support requests and appeals: three years after closure, unless a shorter period is appropriate or a longer legal hold applies.
• 27Signals: removed from active display at expiry; restricted report and corroboration records may be retained for 12 months for integrity and abuse prevention.
• Security and request logs: ordinarily up to 12 months.
• Analytics: according to the configured Google Analytics retention period, which we aim to keep at no more than 14 months.

We may retain a specific record longer where litigation, fraud investigation, safety, tax, regulatory or other legal requirements make that necessary. When the reason ends, deletion or de-identification resumes.

12. Your rights and choices

Subject to the Nigeria Data Protection Act 2023 and applicable exceptions, you may ask to be informed about processing; access your data; correct inaccurate data; delete data; restrict or object to processing; receive portable data where applicable; withdraw consent; and obtain human review of a significant solely automated decision. You may also choose what to publish, update profile fields, remove eligible content, control browser preferences and close your account through a verified request.

We will not discriminate against you for exercising a privacy right.

13. Making a request or complaint

Use the account support workspace and select “Privacy request”, or email privacy@27naira.com. Describe the right you want to exercise and the account or content involved. We may request proportionate verification and will never ask for your password or one-time code.

We aim to acknowledge requests promptly and respond within 30 days. If a complex request requires more time, we will explain why and provide an updated date. You may complain to the Nigeria Data Protection Commission (NDPC) ↗ or seek another remedy available under law.

14. Children

27Naira is for people aged 18 or older. We do not knowingly permit a child to create an account, operate a store or submit personal data. If you believe a person under 18 is using the service, report the account through the Help Centre or privacy contact. We will investigate, restrict the account where appropriate and delete or de-identify the child’s personal data unless preservation is required for safety or law enforcement.

Never post sexual content involving a minor, identifying information that could endanger a child, or material that exploits or grooms a child. Such reports receive urgent handling and may be referred to the appropriate authorities.

15. Security and incidents

Measures include verified authentication, server-enforced permissions, least-privilege administrator access, private author mappings, protected review queues, file-type and size limits, audit records, access revocation and encrypted provider infrastructure. No online service can promise absolute security. Use a unique password, protect your email account and report suspected compromise promptly.

We assess personal-data incidents, contain them, preserve relevant evidence and notify the NDPC within the legally required period where a breach is likely to risk people’s rights. Where a breach is likely to create a high risk, we will also notify affected people without undue delay and provide practical protective steps.

16. Changes to this Notice

We may update this Notice when the service, providers or law changes. The current version and effective date will remain on this page. We will give prominent in-product or email notice before a material change where reasonably practicable and seek fresh consent if the new processing requires it.

17. Official references

This Notice is designed around the Nigeria Data Protection Act 2023 ↗, the NDPC’s data-protection guidance ↗ and applicable Nigerian platform and consumer-protection requirements.