Privacy Policy

Zuri provides an AI-powered website and social media platform for small businesses in Nigeria and across Africa, operated at buildzuri.com and app.buildzuri.com (the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over it.

Zuri is currently operated as an independent project by its founder and is not yet incorporated as a registered legal entity. We're telling you this plainly rather than hiding behind vague language — see the section below on who you're actually dealing with for what this means for you.

This policy is written to comply with the Nigeria Data Protection Act 2023 ("NDPA") and guidance from the Nigeria Data Protection Commission ("NDPC"). If you are located outside Nigeria, other laws (like GDPR) may also apply to you, and we aim to meet those standards too, but our primary compliance framework is Nigerian law.

1. What Data We Collect

a) Account & business data (from business owners)

• Name, email address, phone number, password (hashed)
• Business name, business category, business address, business description
• Logo, product/service images, and any other content you upload
• Social media handles you connect or provide

b) Generated content

• Website content, layout choices, and copy generated for you using AI (Google Gemini)
• Social media captions, posts, and content calendars generated for you

c) Payment data

• Subscription plan, billing status, and transaction history
• We do not store your card or bank details ourselves — these are collected and processed directly by Flutterwave, our payment processor. See Section 4.

d) Visitor/analytics data (from your customers who visit your generated site)

• Page views, click events, approximate location (city/country level, from IP), device/browser type, referral source
• This data belongs functionally to you (the business owner) as the site operator — we process it so we can show it to you in your dashboard.

e) Technical/usage data

• Log data, IP address, device identifiers, cookies, and similar technologies used to keep you logged in and understand how the Service is used

We do not intentionally collect sensitive personal data (health, religion, political opinion, biometric data) and ask that you do not upload such data about your customers into the platform.

2. Why We Collect It (Legal Basis)

Under the NDPA, we process your data on these bases:

• Creating and running your account, generating your website — Performance of a contract with you
• Processing subscription payments — Performance of a contract with you
• Sending you AI-generated content via Gemini — Performance of a contract with you
• Showing you visitor analytics for your own site — Performance of a contract with you
• Improving the Service, fixing bugs — Legitimate interest
• Marketing emails about new features — Consent (you can opt out anytime)
• Sharing limited data with agencies (future feature) — Consent — opt-in only, see Section 6

3. How AI Generation Works With Your Data

When you use Zuri to generate a website, social media captions, or content calendars, the business information and prompts you provide are sent to Google's Gemini API via Google Cloud's Vertex AI platform to generate content on your behalf.

• Google acts as a data processor for this purpose — they process the data to return generated content to us, not to build their own product with your data.
• Per Google Cloud's enterprise terms, data submitted via Vertex AI's API is not used to train Google's general-purpose models, unlike some free consumer AI tools. We rely on Google's published policy for this and encourage you to review it directly if this matters to you: Google Cloud Vertex AI data governance documentation.
• Generated content is stored in our database (Supabase) and delivered to your dashboard and your live site.

We do not send your customers' personal analytics data (Section 1d) to Gemini — only business-level content (business name, description, category, uploaded images/text) is used for generation.

4. Third Parties We Share Data With

We don't sell your data. We share it only with service providers who help us run Zuri, under agreements that require them to protect it:

• Google Cloud / Vertex AI (Gemini API) — AI content generation — Business info, prompts, uploaded content
• Supabase — Database & authentication hosting — All account, business, and analytics data
• Vercel — Application hosting — Technical/log data
• Flutterwave — Payment processing — Billing/subscription data, payment details (handled directly by Flutterwave, not stored by us)

We may also disclose data if required by Nigerian law, court order, or to protect the rights, safety, or property of Zuri or our users.

5. Where Your Data Is Stored (Cross-Border Transfers)

Some of our service providers — including Google Cloud (Vertex AI), Supabase, and Vercel — process and store data on servers located outside Nigeria. Under the NDPA, we're only allowed to do this if the receiving country offers an adequate level of data protection, or if appropriate safeguards are in place.

• We rely on our providers' standard contractual and security safeguards to protect your data during cross-border processing.
• By using Zuri, you consent to this transfer as necessary to provide the Service to you.
• We will update this section if the NDPC publishes a formal whitelist of approved countries or if our infrastructure setup changes.

6. Agency Marketplace (Planned Feature — Not Yet Live)

We are building an Agency Marketplace where verified web/marketing agencies will be able to view limited business profile data (business name, category, general needs) to offer their services to you.

• This feature is not live yet. When it launches, participation will be opt-in — your data will not be shared with agencies unless you explicitly enable this.
• We will update this policy with the specific data fields shared before this feature goes live, and notify existing users.

7. Data Retention

• We keep your account and business data for as long as your account is active.
• If you delete your account, we delete your personal and business data within 30 days, except where we're required to keep records longer (e.g., transaction records for tax/audit purposes, typically up to 6 years under Nigerian financial regulations).
• Generated website content tied to a deleted account is removed from public access immediately and permanently deleted with the rest of your data.

8. Your Rights Under the NDPA

As a data subject under Nigerian law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to fix inaccurate data
• Deletion — ask us to delete your data ("right to erasure")
• Withdraw consent — for anything we process based on consent (e.g., marketing emails, future agency sharing)
• Object — to certain processing based on legitimate interest
• Data portability — request your data in a portable format
• Lodge a complaint — with the Nigeria Data Protection Commission (NDPC) if you believe we've mishandled your data

To exercise any of these rights, email us at hello@buildzuri.com. We'll respond within a reasonable time and no later than the timeframe required under NDPA regulations.

9. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and access-controlled databases (Supabase Row Level Security). No system is 100% secure, and we cannot guarantee absolute security. If a data breach occurs, we will notify the NDPC within 72 hours of becoming aware of it, as required under Section 40 of the NDPA. If the breach poses a high risk to your rights (for example, exposure of your login credentials or payment data), we will also notify you directly, without undue delay, along with steps you can take to protect yourself.

10. Children's Data

Zuri is intended for business owners aged 18 and above. We do not knowingly collect data from children under 18.

11. Changes to This Policy

We may update this policy as Zuri grows. If we make material changes, we'll notify you by email or in-app notice before they take effect.

12. Who You're Actually Dealing With (Plain Talk)

Zuri is currently built and operated by an individual founder (student-led project), not yet a registered company. We're telling you this directly instead of implying otherwise. As Zuri formalizes into a registered business entity, this policy will be updated to reflect the legal entity responsible for your data, and you'll be notified of the change.

13. Contact Us

Questions, data requests, or complaints: hello@buildzuri.com

If unresolved, you may contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.