Privacy Policy

1. Introduction

Kushi Digital Innovations Ltd ("Kushi", "we", "us") respects your privacy. This Privacy Policy explains how we collect, use, and protect your personal information when you use our website and mobile application (the "Platform"). For the purposes of the Nigeria Data Protection Regulation (NDPR), Kushi Digital Innovations Ltd acts as the Data Controller.

By using Kushi, you consent to the data practices described in this policy.

2. Information We Collect

We collect the following types of information to provide our services, verify identities, and process property transactions:

Identity Data: Full Name, Phone Number, Email Address, and Government ID (NIN/BVN) for identity verification. This includes your gender, profile photo, and any information provided through third-party sign-in providers (Google, Apple).
Authentication Data: Credentials used to access the Platform, including passwords (stored as hashed values), one-time passwords (OTPs) sent via SMS or email for verification, and OAuth tokens issued by Google or Apple when you choose to sign in through those providers.
Biometric Data: Facial imagery (selfie) used strictly for "liveness checks" to match your face to your ID during KYC verification.
Signature Data: Electronic signatures captured during the execution of digital tenancy agreements.
Property Data: Property addresses, listing titles, descriptions, photos, videos, and pricing details submitted by Hosts. Listing photos taken through the app may include GPS metadata captured at the time of upload for media integrity verification.
Location Data: General geolocation data derived from your device (with your permission) to display nearby listings on maps, enable location-based search, and perform reverse geocoding to assist with property address entry. This is collected only while the app is in use and is not stored persistently.
Transaction Data: Payment history, rent amounts, escrow balances, partial payment card details (last 4 digits, card type), and Host bank account details used for payouts and refunds.
Communication Data: Text messages sent between Users and Hosts through the in-app chat feature. Voice and video call sessions facilitated through the Platform (call content is not recorded or retained; room sessions are automatically deleted after two hours).
Review Data: Ratings and written reviews you submit about Hosts, properties, or tenants.
Saved & Preference Data: Listings you save or shortlist, notification preferences, and other in-app settings.
Device & Technical Data: IP address, device type, operating system, push notification tokens (FCM for Android, APNs/VoIP for iOS), and session identifiers used for security, fraud prevention, and delivering notifications.
Usage Data: Online presence indicators (e.g., "last seen" timestamps) within the messaging feature, and activity logs used internally for platform security and audit purposes.

3. How We Use Your Information

We use your data for the following purposes:

Verification: To confirm your identity against government databases, perform liveness checks, and prevent fraud.
Authentication: To create and manage your account, authenticate sign-in sessions via email/password, OTP, Google, or Apple, and keep your session secure across devices.
Service Delivery: To display property listings on maps, generate tenancy agreements, process rent payments through escrow, manage bookings, and surface relevant listings based on your location or preferences.
Communication: To send receipts, booking confirmations, support messages, and account alerts via email, SMS, and push notifications. To facilitate real-time in-app messaging and voice/video calls between tenants and hosts.
Media Integrity: To verify that property photos were taken at the listed property's location using GPS metadata captured at the time of upload.
Safety: To detect and prevent money laundering, fake listings, and unauthorized access.
Platform Improvement: Aggregated, anonymised usage data may be used to understand how the Platform is used and improve our services.

We do not sell your personal data. We only share data with the following categories of third parties, each bound by appropriate data processing agreements:

Identity Verification Partners: YouVerify, to verify your NIN/BVN and perform biometric liveness checks.
Payment Processors: Flutterwave, to process escrow payments, disbursements, and refunds securely.
Cloud Storage: AWS S3, to store property listing images, videos, and documents uploaded to the Platform.
Communication Services: Resend, for transactional email delivery (receipts, confirmations, alerts). Twilio, for SMS delivery of OTPs and verification codes.
Push Notifications: Firebase Cloud Messaging (Google), to deliver push notifications to Android devices and web browsers. Apple Push Notification service (APNs), to deliver push notifications and incoming call alerts to iOS devices.
Call Infrastructure: Daily.co, to facilitate encrypted real-time voice and video calls between users. Call room sessions are automatically deleted by Daily.co after two hours; call content is not retained by Kushi.
Mapping Services: Google Maps API, to display interactive property maps, enable location search, and perform reverse geocoding for address lookup.
Sign-In Providers: Google and Apple, when you choose to authenticate using their respective OAuth services. Only the identity information returned by those providers (name, email, unique identifier) is received and stored by Kushi.
Legal Authorities: If required by law, court order, or to report criminal activity.

5. Cookies and Local Storage

We use the following mechanisms to manage your session and preferences:

Web (Browser Cookies): HTTP cookies are used to maintain your authenticated session when you access Kushi via a web browser. Session cookies are deleted when you close your browser; persistent cookies may be retained for a limited period to keep you signed in.
Mobile (Local Storage): The Kushi mobile app uses AsyncStorage to store session tokens and user preferences locally on your device. This data is retained until you sign out or uninstall the app.

We do not use cookies or local storage for advertising or cross-site tracking purposes.

6. Data Retention

We retain your personal data only as long as your account is active or as needed to fulfill our legal obligations (typically 5-7 years for financial records). Chat messages are retained for the duration of your account to support dispute resolution. Call session metadata is deleted within two hours of a call ending. Location data captured during property photo uploads is stored with the associated media file for as long as that listing remains on the Platform. You may request account deletion at any time.

7. Security

We use industry-standard encryption (SSL/TLS) to protect your data during transmission and storage. Passwords are stored as cryptographic hashes and are never readable in plain text. Access to sensitive data is restricted to authorized personnel only.

8. Your Rights

Under the Nigeria Data Protection Regulation (NDPR), you have the right to:

Access the data we hold about you.
Request correction of inaccurate data.
Request deletion of your data (subject to legal retention laws).
Withdraw consent for data processing.
Object to the processing of your personal data for specific purposes.

To exercise these rights, contact us at the details below.

9. Contact Us

If you have questions about this policy, please contact us:

Kushi Digital Innovations Ltd (RC 9081945) Address: House 1, Three Brothers Street, Ado, Karu, FCT, Nigeria. Email: info@kushicorp.com