1. Who We Are
1.1 The data controller is Domesty Technologies Limited ("Domesty", "we", "us"), a company incorporated in Nigeria.
1.2 You can reach us about this Policy or any privacy matter at hello@domesty.co. Formal data-protection requests should also identify the request type (for example, "Data Access Request") in the subject line.
1.3 In line with the NDPA 2023, Domesty operates as a data controller of personal data submitted by Users and as a data processor for any data we handle on behalf of business customers.
2. Information We Collect
2.1 Identity and account data: legal name, profile photo, date of birth, phone number, email address, login credentials, account preferences, and where signed up via a third-party provider, the limited identifiers shared by Google or Facebook.
2.2 Verification (KYC) data: government-issued identification details, liveness video or photograph, address proof, business registration details and licences (where applicable), and the verification status returned by the underlying check.
2.3 Contact and location data: billing address, service address, and approximate location for in-person Tasks. Where you grant precise location permission in the application, that location is used only while you are interacting with a Task.
2.4 Payment and financial data: card last-four digits, card brand, expiry, tokenised card identifiers held by our payment processor, bank account name and number for payouts, and transaction history. Domesty does not store full card numbers or CVVs; these are handled by our payment processor.
2.5 Task and platform-activity data: Tasks you post, Offers you submit or receive, accepted assignments, completion records, time-stamped messages exchanged in the Platform chat, condition records and photographs uploaded for Tasks, ratings and reviews you give and receive, support tickets, and dispute evidence.
2.6 Device and usage data: IP address, device type and operating system, browser type, app version, language, time-zone, screen size, referring URLs, pages and features used, search queries within the Platform, error logs, and approximate location derived from IP.
2.7 Cookies and similar technologies: see section 9.
2.8 Communications data: emails, in-app messages, SMS, and WhatsApp messages exchanged with us, including support and verification communications.
2.9 Special-category data: we do not intentionally collect health, biometric, or other special-category data, save for the liveness video or selfie used for KYC, which is used solely to confirm your identity.
3. How We Collect Information
3.1 Directly from you: when you create an account, complete your profile, post a Task, submit an Offer, communicate with another User or with us, upload media, or contact support.
3.2 Automatically: when you use the Platform we automatically collect device and usage data and information from cookies and similar technologies (see section 9).
3.3 From third parties: identity verification results from Dojah, OTP delivery confirmations from Twilio, payment outcomes from Flutterwave, social-login profile fields from Google or Facebook (where you choose to sign in via those providers), and analytics signals from PostHog and Google Analytics.
4. Lawful Basis for Processing
We process your personal data only where we have a lawful basis under the NDPR/NDPA. The bases we rely on are:
4.1 Performance of a contract: to operate your account, fulfil Tasks, process payments and refunds, deliver platform features you have asked for, and provide customer support.
4.2 Compliance with a legal obligation: to meet KYC and anti-money-laundering requirements, to keep tax and financial records, to comply with regulatory requests, and to respond to law-enforcement requests where lawful.
4.3 Legitimate interests: to detect and prevent fraud, to keep the Platform secure, to develop and improve our services, to communicate with you about your account, to enforce these terms, and to defend legal claims. Where we rely on legitimate interests, we balance those interests against your rights and freedoms.
4.4 Consent: for non-essential cookies and analytics, optional marketing communications, and any other processing for which we expressly ask your consent. You can withdraw consent at any time.
4.5 Vital interests: in the unlikely event that processing is necessary to protect a person's life or physical safety.
5. How We Use Your Information
We use your data to:
5.1 Provide and operate the Platform, including matching Customers with Service Providers, processing Offers, holding funds in escrow, releasing payments under the Auto-Release Period, and supporting the dispute process.
5.2 Verify your identity, run KYC and anti-fraud checks, and assess account risk.
5.3 Process payments, payouts, refunds, and Penalty Charges.
5.4 Provide insurance protection on Approved Tasks under the Insurance Policy, including sharing relevant data with Cornerstone Insurance PLC for underwriting, claims, and recovery.
5.5 Communicate with you about your account, security, transactions, support, and (where you have consented) marketing.
5.6 Enforce our Terms and Conditions, Community Guidelines, and Insurance Policy, and detect circumvention of the Platform.
5.7 Improve the Platform through analytics, A/B testing, and product research, in each case using aggregated or pseudonymous data where reasonably possible.
5.8 Comply with our legal and regulatory obligations and to defend or pursue legal claims.
6. How We Share Your Information
6.1 With other Users. Your profile, ratings, and reviews are visible to other Users. The Customer and Service Provider for a given Task share Task and chat data with each other for the purpose of completing the Task.
6.2 With our processors and partners. We share data with the following categories of recipients, each acting under written terms that restrict their use of the data to the purpose stated:
6.2.1 Identity verification: Dojah Inc (KYC, liveness, government-data checks).
6.2.2 Communications: Twilio Inc (WhatsApp OTP delivery and transactional messaging); Resend, Inc. (transactional email delivery, including account, verification and notification emails, receiving your name and email address).
6.2.3 Payments: Flutterwave Technology Solutions Limited and Paystack Payments Limited (payment processors).
6.2.4 Media storage and delivery: Cloudinary Limited.
6.2.5 Hosting and infrastructure: cloud hosting providers used to operate the Platform.
6.2.6 Analytics and product diagnostics: PostHog Inc, Google LLC (Google Analytics and Tag Manager).
6.2.7 Authentication: Google LLC and Meta Platforms, Inc, only where you choose to sign in using those providers.
6.2.8 Insurance: Cornerstone Insurance PLC, and any loss adjusters or legal advisers engaged in connection with a claim.
6.2.9 Content moderation: Anthropic, PBC, whose AI service we use to screen submitted text and uploaded images for prohibited content (for example contact details, scams, illegal material, or explicit imagery). Images and text are sent for this check and are not used by the provider to train its models.
6.3 With professional advisers. Lawyers, accountants, and auditors bound by professional confidentiality, where reasonably necessary.
6.4 With regulators and law-enforcement authorities. Where required by law, court order, or regulator request, including the Nigeria Data Protection Commission (NDPC), the Federal Inland Revenue Service (FIRS), the Central Bank of Nigeria (CBN), the National Insurance Commission (NAICOM), the Federal Competition and Consumer Protection Commission (FCCPC), and law-enforcement agencies acting under valid authority.
6.5 In a corporate transaction. If Domesty is involved in a merger, acquisition, financing, or sale of assets, your data may be transferred as part of that transaction, subject to confidentiality and applicable law.
6.6 We do not sell your personal data.
7. International Transfers
7.1 Some of our processors operate outside Nigeria, including in the United States and the European Economic Area (for example, PostHog, Google, Cloudinary, Anthropic).
7.2 Where we transfer your data outside Nigeria, we rely on one of the following safeguards under the NDPR/NDPA: a NDPC-recognised adequacy decision, contractual data-protection terms equivalent to NDPR/NDPA standards, or your explicit consent.
7.3 You may request a summary of the safeguards in place by contacting us at hello@domesty.co.
8. Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this Policy or as required by law.
8.1 Active accounts: we retain account, profile, and Task data for as long as your account is open.
8.2 KYC and anti-fraud data: at least seven (7) years from the end of the relationship with you, in line with anti-money-laundering and customer-due-diligence rules, or longer where required.
8.3 Transaction and financial records: at least six (6) years from the date of the transaction, in line with tax and accounting laws.
8.4 Communications: messages exchanged on the Platform are retained for the lifetime of the Task and for the period necessary to handle disputes and legal claims, typically up to six (6) years thereafter.
8.5 Cookies and analytics: see section 9 for cookie-specific retention.
8.6 Marketing data: until you withdraw consent or object, whichever is earlier.
8.7 After expiry of these periods, your data is deleted or fully anonymised so that it can no longer be linked to you.
8.8 When you delete your account, we anonymise it rather than leaving your details in place: your name is masked as “Deleted User”, your email address is released so it can be reused, and your profile photo, bio, contact details, identity data and portfolio are removed, along with your settings and login. Content you contributed (reviews, comments, and task history) and records we are legally required to keep (for tax, financial, and anti-fraud purposes) are retained but no longer identify you. See the Delete Policy for the full detail.
9. Cookies and Similar Technologies
9.1 We use cookies, local storage, and similar technologies to operate the Platform and to understand how it is used.
9.2 Cookie categories:
9.2.1 Strictly necessary: required for the Platform to function (login, security, escrow checkout). These are set without your consent and cannot be turned off through our cookie banner.
9.2.2 Functional: remember your preferences (language, time-zone, saved filters).
9.2.3 Analytics: help us understand usage patterns and improve the Platform (Google Analytics 4 via Google Tag Manager; PostHog).
9.2.4 Marketing: used where you have consented, to measure the performance of campaigns.
9.3 Non-essential cookies are set only after you accept them through our cookie banner. You can change your cookie choices at any time through the cookie-preferences link in the footer.
9.4 You can also block or delete cookies through your browser settings, but doing so may affect the Platform's functionality.
10. Data Security
10.1 We implement industry-standard technical and organisational measures to protect your personal data, including encryption in transit (HTTPS/TLS), encryption at rest for sensitive fields, access controls, audit logs, and regular reviews of our security practices and processors.
10.2 No online system can guarantee absolute security. You are responsible for keeping your account credentials confidential and notifying us at hello@domesty.co if you suspect unauthorised access to your account.
11. Your Rights
Subject to certain conditions and exceptions under the NDPR/NDPA, you have the right to:
11.1 Access: ask for a copy of the personal data we hold about you.
11.2 Rectification: ask us to correct inaccurate or incomplete data.
11.3 Erasure: ask us to delete your data ("the right to be forgotten") where there is no overriding lawful basis for us to keep it.
11.4 Restriction: ask us to limit how we use your data while a concern is investigated.
11.5 Portability: ask for a copy of your data in a structured, commonly used, machine-readable format and to transmit it to another controller, where technically feasible.
11.6 Objection: object to processing based on our legitimate interests, including profiling, on grounds relating to your particular situation.
11.7 Withdraw consent: withdraw consent at any time where consent is the lawful basis. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
11.8 Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, save where the decision is necessary for entering or performing a contract with you, is authorised by law, or is based on your explicit consent.
11.9 Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at info@ndpc.gov.ng or by visiting ndpc.gov.ng. We would appreciate the chance to address your concerns directly first; please contact hello@domesty.co.
11.10 To exercise any right above, email hello@domesty.co. We may need to verify your identity before responding. We aim to respond within thirty (30) days. We will tell you if we need an extension and why.
12. Marketing Communications
12.1 We send marketing communications only where you have consented or where applicable law permits us to rely on legitimate interests for direct marketing to existing customers in similar services.
12.2 You can opt out of marketing at any time using the unsubscribe link in any marketing email, the in-app notification settings, or by contacting hello@domesty.co. You cannot opt out of essential transactional and security messages while you maintain an account.
13. Automated Decision-Making
13.1 Some Platform decisions involve automated processing, including KYC checks (via Dojah), fraud-risk scoring, automated screening of the text you submit and the images you upload to detect prohibited content (such as contact details, off-platform circumvention, scams, illegal material, or explicit imagery, using rule-based checks and an AI content-moderation provider), and ranking of search results. A failing image is removed automatically and you are notified.
13.2 We do not make decisions producing legal or similarly significant effects on you based solely on automated processing without human review. Where automated checks raise an issue, a human reviews before any restriction or termination is applied, save where immediate action is necessary to protect Users or comply with law.
13.3 You may ask for a human review of any automated decision that materially affects you by contacting hello@domesty.co.
14. Children's Privacy
14.1 The Platform is not intended for users under the age of 18. We do not knowingly collect personal data from anyone under 18.
14.2 If you believe we hold data of a person under 18, contact hello@domesty.co and we will delete the data and close the account.
15. Third-Party Links
The Platform may contain links to other websites or services. This Policy does not apply to those external services. Please review their privacy notices before providing personal data.
16. Data Breach Notification
16.1 We maintain processes to detect, contain, and assess personal-data breaches.
16.2 Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you and the NDPC in line with the NDPA 2023 and the NDPR Implementation Framework, ordinarily within seventy-two (72) hours of becoming aware of the breach.
17. Changes to This Policy
17.1 We may update this Policy to reflect changes in our services, applicable law, or processor arrangements.
17.2 Material changes that adversely affect your rights or expand how we use your data will be communicated by email and on the Platform at least thirty (30) days before they take effect, in line with the Terms and Conditions, section 23.
17.3 Continued use of the Platform after a change takes effect constitutes acceptance of the updated Policy.
18. How to Contact Us
18.1 For all privacy enquiries, including data-subject requests, withdrawals of consent, breach notifications, or complaints, contact hello@domesty.co.
18.2 You also have the right to lodge a complaint with the Nigeria Data Protection Commission as set out in section 11.9.
By using Domesty, you agree to this Privacy Policy. If you do not agree, please do not use our services.