- We use personal data to run NODRO for the businesses that use it, and for nothing else.
- We don’t sell personal data or use it for advertising.
- Each business’s records are kept apart and only its own team can see them.
- You have rights under the Nigeria Data Protection Act 2023, and we will help you use them.
1. Who we are and our role
NODRO provides software that technical-service businesses use to record jobs, customers, equipment and service reports. This policy follows the Nigeria Data Protection Act 2023 (NDPA).
- For the accounts of businesses and their staff, and for visitors to this website, we are the data controller.
- For the records a business keeps in NODRO about its own customers and their sites, the business is the controller and we process that data on its behalf, following its instructions and our Terms of Use. If you are a customer of a business that uses NODRO, contact that business first; we will help them answer you.
2. What we collect
- Account details: name, email or username, phone number, role, and a scrambled (hashed) version of the password. We never store passwords as written.
- Business details: business name, logo, phone, email and address.
- Demo requests: the name, company, phone, email, trade, team size, preferred time and message you send with the “Book a demo” form, used only to arrange and follow up on your demo.
- Partner applications: the name, company, phone, email, website and message you send with the partnership form, used only to reply to you and discuss working together.
- Records businesses enter: customers’ names and phone numbers, site addresses and map locations, equipment details, jobs, notes, parts used, photos, voice notes and their text, and service reports.
- Technical information: the sign-in session, the device’s browser and IP address in our logs, and the times changes were made, to keep NODRO secure and working. See our Cookie Policy.
3. Why we use it, and on what basis
- To provide NODRO to the business you belong to: this is necessary for our contract with that business.
- To keep NODRO secure, prevent misuse and fix problems: our legitimate interest in running a safe service.
- To meet legal duties, such as keeping records the law requires or answering lawful requests from authorities.
- Optional cookies, if we ever use them: only with your consent, which you can withdraw at any time.
We don’t sell personal data, use it for advertising, or make decisions about people by automated means that affect them legally.
4. AI features
When a business turns on these features, a technician’s voice notes are sent to a speech-to-text provider to be turned into text, and a job’s records can be sent to an AI provider to draft a service report. We only send what is needed for that job, and only use providers whose terms don’t allow them to use it to train their models. A person on the business’s team checks every draft before it reaches a customer.
5. Who we share it with
We use these service providers to run NODRO. They process data only on our instructions and must keep it secure:
| Provider | What for | Where |
|---|---|---|
| Neon | The database | Frankfurt, Germany (European Union) |
| Amazon Web Services (S3) | File storage | Frankfurt, Germany (European Union) |
| Render | Runs the NODRO servers | To be confirmed |
| Vercel | Hosts the website and the app’s screens | Global network, built in the United States |
| GitHub | Holds our software and a nightly backup of the database | United States |
| Sentryonly if switched on | Finding and fixing software errors | To be confirmed |
| Resendonly if switched on | Sending email from NODRO, such as report links and alerts. Not set up yet: it needs our own email domain first | To be confirmed |
| Anthropiconly if switched on | Drafting a service report from a job’s records, when a technician asks for a draft | United States |
| A speech-to-text providerto be confirmed | Turning voice notes into text | To be confirmed |
The full list, with what each one handles, is on our sub-processors page. We tell businesses before we add or change one.
Service reports are seen by whoever a business sends the link to. When someone chooses to share a report on WhatsApp or open directions in a map app, those services’ own privacy policies apply. We may also share data where the law requires it, or with a buyer of our business, who would have to respect this policy.
6. Data stored outside Nigeria
Some of our providers store or process data outside Nigeria, for example in the European Union or the United States. Where this happens, we rely on the safeguards the NDPA allows, such as contractual commitments that protect the data to a standard at least as high as Nigerian law.
7. How long we keep it, and deleting your data
We keep data only as long as it is needed. This is what happens to each kind:
| A business’s records (customers, jobs, reports, photos) | For as long as the business uses NODRO, then removed when it deletes its account |
|---|---|
| An account you ask us to delete | 30 days, so you can change your mind; then removed or made anonymous |
| Demo requests that did not lead to an account | 365 days |
| Partner applications that did not lead to a partnership | 365 days |
| Notices you have read | 180 days (any notice, 365 days) |
| Device sync receipts | 180 days |
| Expired sign-ins and one-time codes | Removed within a day of expiring |
| NODRO staff activity log | 2 years |
| Records that a deletion happened | Kept; they contain no names or personal details |
| Backups and old file versions | Age out within 35 days |
Deleting your account. You can do this yourself from Your account (or More, in the technician app), after entering your password. You are signed out at once, and nothing is removed for 30 days: signing in again in that time cancels the deletion. After that, a team member’s personal details are removed and the jobs and notes they worked on stay with the business as “Former team member”. If an owner deletes their account, the whole business is deleted: every customer, site, piece of equipment, job, report, photo and file, and every team member’s account. Download a copy first from Your account. Data on a technician’s phone is removed when they sign out.
Backups and earlier versions of files can still hold the data for up to 35 days after deletion, then they age out.
8. How we protect it
- Connections to NODRO are encrypted (HTTPS).
- Passwords are stored only in hashed form.
- Each business’s data is kept separate, and people only see what their role allows; technicians see the jobs assigned to them.
- Photos and voice notes are only reachable through links that expire after a short time.
- Important changes are recorded in an audit log.
- Two-factor sign-in is available to everyone and required for NODRO staff, who can only see counts, never a business’s records.
- You can see where you are signed in and sign out other devices from Your account.
- Sign-in attempts are limited, and a database backup is encrypted before it is stored.
If a breach puts people’s rights at risk, we tell the businesses affected without delay and the Nigeria Data Protection Commission within 72 hours, as the law requires.
9. Your rights
Under the NDPA you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, or limit how we use it;
- give your data to you, or another provider, in a common format;
- stop using it for a purpose you object to;
- withdraw consent you have given, at any time.
Most of this you can do yourself in Your account: download your data, correct your name, see your devices and delete your account. If you are a customer of one of our businesses, ask that business first: it decides how your data is used, and has tools to export or erase it. To ask us, see how to make a data request. Businesses that use NODRO are also covered by our Data Processing Agreement.
We will answer within the time the law sets. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
10. Children
NODRO is for businesses and is not meant for anyone under 18. We don’t knowingly collect children’s data.
11. Changes to this policy
We will update this policy when how we handle data changes, and tell businesses about important changes before they take effect. The date at the top shows the latest version.