1. Who we are

Ughoron Cloud is operated by Ughoron Group Limited (RC No. forthcoming), a company registered in Nigeria with its principal office at Benin City, Edo State. References in this policy to "we", "us", and "our" mean Ughoron Group Limited and its affiliates.

For questions about this policy or to exercise any of the rights described below, write to privacy@ughoron.cloud or to our postal address. We respond within 30 calendar days; in most cases within 72 hours.

2. The data we collect

We collect only what is necessary to deliver, secure, and improve our services, and to meet legal obligations. The categories we collect are:

Identity and contact data — name, email, phone, profile photo, role, and the organisation you belong to.
Account and billing data — your plan, invoices, payment method tokens (we never see your full card number; that is held by our PCI-compliant payment partners), tax identifiers where applicable.
Content you create — files, messages, projects, customer records, transactions, and any other data you upload to the platform.
Usage and device data — IP address, device type, browser, operating system, pages visited, actions taken, timestamps. Used to keep the service stable and secure.
Communications — emails, WhatsApp messages, and phone calls with our support and sales teams. Calls may be recorded for quality and training; you will be informed at the start of the call.
Cookies and similar technologies — session cookies for authentication, preference cookies, and a minimum of analytics cookies. We do not run third-party advertising cookies.

3. Why we collect it

We use your personal data for the following purposes, and we explain the lawful basis under the Nigeria Data Protection Act (NDPA) 2023 and the EU General Data Protection Regulation (GDPR), where relevant.

To deliver the services you have signed up for (lawful basis: performance of a contract).
To bill you and meet our tax and accounting obligations (legal obligation, legitimate interest).
To keep the service secure — detect fraud, abuse, and intrusion (legitimate interest, legal obligation).
To improve the product — analyse aggregated, de-identified usage to make Ughoron Cloud better for everyone (legitimate interest).
To send service updates — outage notices, security advisories, and product change notes (legitimate interest).
To send marketing — only with your consent, and only via channels you can unsubscribe from at any time (consent).

4. AI and your data

Ughoron Cloud's AI assistant is grounded in your workspace's own data. We never train shared or third-party AI models on the content of your customer records, files, books, or messages. We may train models on telemetry and on data that you explicitly opt in to share, with clear notice.

When you use the AI assistant, prompts and the relevant context window are processed through our LLM provider under a data-processing agreement that prohibits training on your data. Outputs are stored in your workspace and accessible only to authorised users.

5. Who we share it with

We share personal data only where it is necessary to deliver the service and only with parties who are bound by appropriate contractual safeguards. Specifically:

Cloud infrastructure providers — MainOne (Nigeria), Amazon Web Services (Frankfurt, Cape Town) and Cloudflare (global CDN and security).
Communications providers — Twilio (SMS, voice) and Meta (WhatsApp Business Platform).
Payment processors — Paystack, Flutterwave, Stripe (international card), and bank partners for direct debit and transfer.
Analytics — first-party only. We do not pass identifiable data to third-party advertising networks.
Professional advisers — auditors, lawyers, and accountants, under strict confidentiality.
Authorities — when legally required (court order, law enforcement), and only after careful review.

6. International transfers

If you are based outside Nigeria, your data may be transferred to and processed in countries other than your own. When we transfer personal data internationally, we rely on adequacy decisions where they exist (e.g. EU–UK), and on standard contractual clauses backed by additional technical safeguards everywhere else.

Enterprise customers may pin their workspace to a specific region (Nigeria, EU, or South Africa) at no additional charge. Contact us for details.

7. How long we keep it

We keep personal data only for as long as we have a legitimate need to. Practically:

Account data — for the life of your account, plus 90 days after termination to allow recovery.
Billing records — 7 years from creation, as required by Nigerian and most international tax law.
Logs and security telemetry — 13 months, then aggregated or deleted.
Backups — encrypted, region-pinned, with a 35-day rolling retention.
Marketing data — until you unsubscribe, plus 30 days for unsubscribe processing.

8. Your rights

Subject to local law, you have the following rights over your personal data. To exercise any of them, write to privacy@ughoron.cloud.

Right of access — get a copy of the personal data we hold about you.
Right to rectification — correct inaccurate or incomplete data.
Right to erasure — ask us to delete your personal data, subject to our legal retention duties.
Right to restriction — ask us to limit how we use your data.
Right to portability — get your data in a machine-readable format and have it transmitted elsewhere.
Right to object — to processing based on legitimate interests, including marketing.
Right to withdraw consent — at any time, without affecting prior processing.
Right to complain — to the Nigeria Data Protection Commission (NDPC) or your local supervisory authority.

9. Children

Ughoron Cloud is a business platform and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact privacy@ughoron.cloud and we will remove it promptly.

10. Changes to this policy

We may update this policy from time to time. The "Effective from" date at the top of this page tells you when it was last updated. If we make material changes, we will notify you by email and in-product at least 14 days before they take effect.

Privacy Policy