Privacy Notice

DRAFT — not yet reviewed by counsel. Version 0.1-draft. The reviewed text replaces this before any real payment is taken; the app asks you to accept the version in force.

1. Who we are

Vis Aeternum, Lagos, Nigeria, is the data controller. Contact: privacy@visaeternum.example.

2. What we collect and why

• Waitlist: your email, role, and what you type in the form; a hashed IP address and browser identifier for abuse prevention. Used only to tell you when your side opens. Unsubscribe with the link in any email.
• Account: phone number, profile details you enter, and for engineers a CV if you upload one.
• Identity check: your NIN and a selfie are checked by our identity provider (Smile ID). We store the outcome, a verified name, and a one-way hash used to keep one account per person — never the ID image or the selfie.
• Money: payments, payouts, refunds and tax records; for engineers the bank account's last four digits, the account name returned by the bank, your TIN and state of residence (needed to remit withholding tax).
• Contracts: the exact text you accepted, when, and from which address.

3. Who processes it

Cloudflare (hosting), Smile ID (identity), Paystack (payments and payouts), Twilio (SMS codes), Expo (push notifications). Each is bound by a data processing agreement.

4. How long we keep it

Account and profile data until you delete your account, then anonymised within seven days. Payment, payout, refund, invoice and credit-note records, including the PDFs, for six years as tax records, with your name replaced by an anonymous reference after deletion. Contract acceptance records for the life of the contract plus six years.

5. Your rights

Under the Nigeria Data Protection Act you may ask what we hold, correct it, object, or delete your account (from the app's Settings). Deletion is refused only while an engagement, payout or refund is still open, and completes after a seven-day grace.