Privacy Policy

1. Introduction and Policy Updates

CASE TECHNOLOGIES LTD respects your privacy. This policy outlines how we collect, use, and protect your personal data in strict compliance with the Nigeria Data Protection Act (NDPA), the Nigeria Data Protection Regulation (NDPR), and Central Bank of Nigeria (CBN) guidelines. You must be at least 18 years old to use our software infrastructure.

Policy Updates: We may update this Privacy Policy periodically to reflect changes in our platform or legal requirements. Material changes will be communicated to you via electronic notice (email or platform notification) prior to taking effect. Continued use of the platform after such updates constitutes your acknowledgment of the revised policy.

2. Information We Collect

When you register for CASE, we collect basic profile information including your name, email, and location. To operate our public ledger securely, we also collect:

• Google User Data: If you choose to register or log in using Google Sign-In, we will request access to your Google account's primary email address and basic profile information (such as your name and profile picture). This data is strictly used to provision your account, authenticate your login sessions securely, and populate your public profile avatar.
• Identity Data: BVN, NIN, and CAC Registration details (for Organizations) to legally verify project organizers.
• Financial Data: Official Bank account details (NUBAN) for direct project withdrawals and transaction histories. To maintain compliance and enable our non-custodial routing model, project allocations are disbursed directly to verified Organizer bank accounts. Unallocated donor funds are held securely in a master balance by our payment provider, not by CASE. We do not store, process, or transmit raw credit card details on our servers; all payment card information is securely captured and tokenized directly by our PCI-DSS compliant payment provider (Paystack).
• Platform Data: Project descriptions, milestone proofs (receipts/photos/delivery logs), confirmed in-kind contribution logs, and AI prompts generated by users.
• System Logs & Observability: To trace failed transactions, prevent double-charging during network drops, and provide customer support, our servers securely log structured system events, metadata, and error reports.
• Cookies & Tracking: We use cookies and similar tracking technologies to maintain user sessions, secure accounts, and analyze platform traffic.

3. How We Use Your Data

Your data is primarily used to ensure trust and transparency on the platform. Specifically, we use it for:

• Platform Operations: To verify project organizers, provision digital visual ledgers, facilitate direct resource routing, and provide milestone updates. To maintain compliance and ensure swift resource deployment, project funds are routed directly to the Organizer's verified external bank account, while unallocated donor balances are managed entirely within our payment provider's regulated master holding balance.
• Platform Promotion: Displaying verified user-generated content (photos, milestones) to highlight community impact.
• Fraud Prevention & Troubleshooting: To prevent money laundering, ensure funds reach legitimate community actors, and utilize our system logs to trace and resolve timeout errors effectively.
• The Public Audit Trail: CASE operates on a model of transparency for resource mobilization. Your platform profile (projects funded and resources mobilized) forms a public record of your impact. To maintain the public ledger, all incoming financial allocations to project ledgers are publicly tracked. External donations from unauthenticated users are recorded semi-anonymously; the financial value and timestamp are public, but personal identifying data from the bank transfer is stripped and masked to protect the sender's privacy.

4. Data Sharing and Transparency

We never sell your personal data to third parties. We only share necessary data under the following conditions:

• Google Limited Use Compliance: Our use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. We will never sell your Google data or use it for unapproved advertising purposes.
• Public Ledger: Impact metrics and all inbound financial allocations to project ledgers are public. External donations from unauthenticated users are semi-anonymized (value shown, identity hidden) by default. Authenticated donors using their digital visual ledgers can also choose to make their specific financial donations anonymous on the public feed.
• Trusted Partners: We share necessary identity data (such as BVN/NIN) and transaction records with our licensed payment partners (e.g., Paystack) to facilitate the platform's core financial routing operations, execute identity verification for AML/CFT compliance, and process external withdrawals.
• Cloud Infrastructure & Data Residency: CASE utilizes trusted cloud providers (including Supabase) to securely host and manage platform data. Where data is processed on servers outside of Nigeria, we ensure our subprocessors comply with standard contractual clauses and data protection mechanisms equivalent to strict NDPR standards.
• AI API Processing: We utilize third-party Artificial Intelligence (AI) providers to power our optional project structuring tools. User prompts are transmitted securely via API for processing, but we strictly enforce data privacy agreements ensuring your inputs are never logged by the provider to train third-party foundational public models.
• Legal Authorities: We will immediately disclose information to law enforcement or financial regulators (e.g., EFCC, NFIU) if an account is flagged for fraud, or suspected of funding dangerous or illegal activities.

5. Your Rights, Communications, Account Closure, and Deletion

You have the right to access, rectify, or request an export (data portability) of your personal data at any time through your account settings or by contacting our support team. If you believe your data privacy rights have been violated, you also maintain the right to lodge a formal complaint with the Nigeria Data Protection Commission (NDPC).

However, to protect the financial integrity of the ledger and comply with Nigerian law:

• Communications: You may opt out of promotional emails at any time, but you cannot opt out of critical transactional emails, such as donation receipts, milestone progress alerts, or security notifications.
• The Transaction Integrity Lock: If your account has zero transaction history, it can be permanently deleted upon request. However, accounts with any transaction history (you have funded a project, received funds, or withdrawn money) cannot be completely deleted.
• Account Closure & Statutory Retention: If you have a transaction history and wish to leave the platform, your account will be "Closed." This prevents any future logins or use of the profile. However, to comply with strict Anti-Money Laundering and Combating the Financing of Terrorism (AML/CFT) laws, historical financial ledger data and associated identity logs are retained for a minimum of five (5) years following the transaction or account closure. This statutory requirement supersedes standard NDPR data erasure requests during this period to ensure the community audit trail remains legally verifiable.

Contact Us

If you have questions about this policy, your data, or wish to exercise your privacy rights (such as data portability or deletion requests), please contact our designated Data Protection Officer (DPO) and compliance team at:

Email: support@casebeheard.com (Please include "DATA PROTECTION INQUIRY" in the subject line to ensure rapid escalation to the DPO)

Address: No 47, Market Road, Kabala Costain, Kaduna, Nigeria