DRAFT. Not final. A Nigerian lawyer has not yet reviewed this page, and Zappol is not taking real payments yet. It is written against the Nigeria Data Protection Act 2023 and may change before Zappol opens to the public. Draft of 27 October 2026.
1. Who is responsible
KIROWAYZ ENTERPRIZE LIMITED, a company registered in Nigeria, runs Zappol and decides why and how your personal data is used. For privacy questions and requests, write to privacy@zappol.com or use Help & support. Whether Zappol must appoint a data protection officer or register with the Nigeria Data Protection Commission (NDPC) has not yet been confirmed with a lawyer.
2. The short version
- We collect what we need to run Zappol: your account, your bookings, your payments, your reports and help requests, and records that keep the site safe. - We never see or store your card details. Paystack processes card payments. - People who apply to be agents, landlords or caretakers give us their NIN (we keep only its last 4 digits as text), a photo of their NIN slip or card, and a selfie holding it, so a person at Zappol can check who they are. Renters who book visits are not asked for these. - The exact address of a house and the agent's phone number are shown only to a renter who has paid for that house. - We do not sell personal data, and we do not use advertising cookies or advertising trackers. Zappol keeps its own security record of site visits, described in 3.15 and section 7. - You can ask to see, correct or delete your data (section 11).
3. What we collect and why
3.1 Account: full name, email, phone number, username, the campus you pick, and your password (handled by our sign-in provider; we never see it). If you sign in with Google, your name and email from Google. Why: to create and run your account and contact you about bookings and support.
3.2 Preferences: houses you save, houses you recently viewed, your Feed price and feature choices. Why: to show you the right houses.
3.3 Payments: the amount, payment reference, receipt code, status and time of each inspection fee, and whether you paid with Paystack or a credit. Why: to confirm your booking, give a receipt, keep financial records and prevent fraud.
3.4 Bookings: which house, when you paid, your inspection window, and whether you opened the address. Why: to reveal the address, run the visit and handle problems.
3.5 Help tickets and problem reports: what you write, up to 4 photos, the other side's statement, our replies and private team notes, and our decision with its reason. Why: to answer you, decide fairly within 72 hours, and protect renters and agents.
3.6 Cash refunds (renters): if you ask for a credit to be paid as cash, the bank name, account number and account name you type. Why: to pay you by hand.
3.7 Applications to be an agent, landlord or caretaker: full name as on your NIN, phone, WhatsApp, home address and areas you cover; your 11-digit NIN, of which only the last 4 digits are kept as text; a photo of your NIN slip or card (which itself shows your full NIN, your photo and other details printed on it); a selfie holding the same slip or card; and your acceptance of the rules. Why: to check you are who you say you are before you can list houses, and to protect renters from fraud. For the ID photo and selfie we rely on your consent, which you give by ticking a box in the application (section 4).
3.8 Listings: house details and photos, the exact address and directions, and the contact name and phone for visits. Why: to show the listing and reveal the address and phone to renters who paid.
3.9 Earnings and payouts: earnings per booking, withdrawal requests, and payouts marked as sent. An agent's bank details are given to Zappol staff by phone or message and are not stored on the site.
3.10 "List your house" offers, if you use that form: your name, phone, the house's location, type and rent, your move-out date, notes, and up to 6 photos. Why: to follow up and possibly list the house.
3.11 Testimonials: your name and role as you give them, what you write, and a star rating. Why: to publish approved testimonials.
3.12 Newsletter: your email address, if you give it in the Subscribe box. We have not sent any newsletter yet. Every newsletter will carry an unsubscribe link.
3.13 Sign-in records: sign-in times, a device label such as "Chrome on Android", and a one-way coded fingerprint of your network (IP) address. We do not store the IP address itself. For Zappol team accounts we also note whether a sign-in came from a new device. Why: to keep accounts safe and spot unusual sign-ins.
3.14 Activity log: who did what and when, for example a payment started, an address opened, or a decision saved. It cannot be edited or deleted. Why: accountability, investigating misuse, and evidence.
3.15 Site-visit record: every time a page loads, Zappol records a visit. It holds a random visit ID kept in your browser's own storage, the page address, a device label, the first part of your browser's identity text, a one-way coded fingerprint of your network address (not the address itself), and your account ID if you are signed in, so a signed-in visit is linked to your account. Why: to spot fraud and abuse and keep the site safe. You cannot switch this record off. We treat it as needed for security; whether the law agrees has not yet been confirmed with a lawyer.
3.16 Messages we send you: what was sent and whether it was delivered. Why: to keep you informed and prove what was sent.
We do not knowingly collect health, religious, political or other sensitive data, and ask you not to put it in reports or tickets. Photos you attach should show the issue (a house, a message) and not other people.
4. ID photos and selfies
These are kept in private storage and are never shown on the public site. Only Zappol administrators (the super administrator and administrators) can open them, never staff. They open through a link that stops working after 5 minutes, and every opening is recorded in the activity log. Our team compares the photos by eye. We do not use automated face-recognition software. You can withdraw your consent. If you do, we can no longer verify you and your agent, landlord or caretaker status ends. Withdrawal does not affect checks already made, and we may keep records we must keep.
5. Who can see your information
Zappol's team, each only for their job. Staff hold limited powers that an admin gives them. Money pages, ID photos and admin pages are closed to staff without the right power. Admins and the super admin can see more, and sensitive looks (ID photos, exact addresses, report photos) are recorded.
Agents see, for a renter's paid booking, that a booking exists, its date and its house. They do not see the renter's name, phone number, email or payment details in the Agent panel. If you report a problem, the agent sees the words of your report, not your photos. If you call or message an agent, they will of course see the number or account you use.
Renters see an agent's name and listings. The exact address and the agent's phone number are shown only to a renter who paid for that house. Both sides of a problem report see Zappol's decision and its written reason. Authorities may receive data where the law requires it, or to report fraud or a crime.
6. Our service providers
Supabase: database, sign-in and private file storage (ID photos, report and ticket photos); London, `eu-west-2`. Cloudflare: hosting the site, house photos (stored in its EU region), and network security including a bot check at sign-in; Cloudflare also keeps its own technical request logs for the traffic it handles, under its own notice. Paystack: card, bank and transfer payments, under its own privacy notice. Resend: sending our emails; United States. Google: only if you choose "Continue with Google". Meta (WhatsApp): booking messages, which are switched off today.
We do not sell personal data or share it for advertising.
7. Cookies, browser storage and visit records
Zappol uses the cookies needed to keep you signed in. For team accounts there is also a cookie and a browser note that sign them out after 30 minutes idle. The random visit ID in 3.15 is kept in your browser's own storage.
The first time you visit, a banner offers "Necessary only" or "Accept all". Your choice is recorded. The security record in 3.15 is kept whichever you choose.
We do not use advertising cookies, analytics services from other companies, or advertising trackers.
8. Moving data outside Nigeria
Some providers above store or process data outside Nigeria. The Nigeria Data Protection Act allows this on certain bases, such as adequate protection, contract performance and consent. We are still confirming the safeguard for each provider with a lawyer.
9. How we protect your data
The exact address of every house is stored apart from public listing data and released only after a confirmed payment. ID photos, selfies, report photos and ticket photos are in private storage and open only through short-lived links, and opening them is recorded. Each person's account reaches only that person's own records. Team accounts are signed out after 30 minutes of inactivity, and team members are emailed when their account signs in from a new device. The activity log is sealed, so an edited or deleted entry can be detected.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell the NDPC within 72 hours of becoming aware of it. If the risk is high, we will tell you directly and plainly, with advice on what to do.
10. How long we keep data
The site does not yet delete anything automatically. Until a retention schedule is approved and built, data is kept. We plan to delete or anonymise data when it is no longer needed, for example sign-in and visit records after a short period, and we will update this notice when that is built.
11. Your rights
You can ask us to see your data and get a copy; correct what is wrong; delete it where we have no duty or good reason to keep it; restrict or object to some uses, including stopping the newsletter; move it to another service where the law gives that right; and withdraw consent you gave (this does not undo what was done before). Zappol makes no decisions about you by automated means alone: people decide applications, listings and reports.
To ask, email privacy@zappol.com from your account email, or open a ticket at Help & support. We may need to confirm it is you. We aim to answer within 30 days. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
12. Children
Zappol is for people aged 18 and over. Under the Nigeria Data Protection Act a child is anyone under 18. If you think a child has given us data, tell us and we will delete it.
13. Changes to this notice
We post changes here with a new date, and tell you by email or a notice on the site if a change is important.
14. Contact
KIROWAYZ ENTERPRIZE LIMITED (Zappol), Nigeria. privacy@zappol.com