Privacy policy 

Who we are

ISCALIDAFRICA LIMITED, trading as ISCALID AFRICA ("we", "us"), is a private company

limited by shares, registered in Nigeria with registration number 7186745. Our

registered address is No 4, F.O. Ogunbajo Close, T.A. Gardens, Warewa, off Lagos–Ibadan

Expressway, Ogun State, Nigeria.

We build sales and revenue systems for African businesses. In practice that means we help

business owners handle the customer enquiries they already receive — particularly on

WhatsApp — so that an enquiry does not sit unanswered, and so that leads generated from

advertising are followed up properly.

This policy explains what personal information we handle, why, how long we keep it, and

what rights you have. It is written to meet the Nigeria Data Protection Act 2023

(NDPA).

Who this policy covers

Two groups, handled differently:

Business customers — the businesses and business owners who use our systems. We act

as a processor for much of what we hold on their behalf, following their instructions.

End customers — members of the public who message, or are contacted by, a business

that uses our systems. We handle their information so that the business can answer them.

If you have messaged a business on WhatsApp and want to know what happens to your

information, the short version is: your message goes to that business, we help it get

there and get answered, and the business remains responsible for its own relationship with

you.

Information we handle

About business customers: business name, contact name, email address, phone number,

and the WhatsApp account and phone number details needed to connect the service.

About end customers, when they message a business using our systems:

the WhatsApp phone number the message came from the display name shown in WhatsApp the content of the messages, including any order or enquiry details in them voice notes and images sent with a message delivery and read status timestamps

About leads: where a business generates leads through Facebook or Instagram

advertising or similar channels, we may handle the contact details and enquiry content that

come from those leads, so the business can follow them up.

We do not ask for and do not want sensitive personal information — nothing about

health, religion, ethnicity, political opinion, or biometric data. Please do not send it.

How we use it, and our legal basis

What we do Why   Legal basis under the NDPA

Deliver an end customer's message to the business, and the business's reply back That is the service Performance of a contract

Keep a record of an order or enquiry made by message So the business can fulfil it, and so there is a record of what was agreed

Performance of a contract; legitimate interest of the business

Help a business follow up its own leads That is the service the business bought Legitimate interest of the business

Bill the business for the service To get paid Performance of a contract; legal obligation

Fix faults, prevent abuse, keep the service secure To run a reliable service Legitimate interest

We do not advertise our own services to the people who message a business, and we never

put one business's message into another business's conversation.

Artificial intelligence and voice notes

Some of our systems use automated tools to help a business handle enquiries: voice notes

are transcribed into text, and a language model may draft a reply or help prioritise the

enquiry. Where these tools are involved:

they assist the business; they do not make decisions about individuals that produce

legal effects on them a human at the business remains responsible for what is sent to you a human at the business can always be asked to review what was sent

we do not use end customers' messages to train third-party models

How long we keep it

Media — voice notes and images — is deleted after 30 days, unless the business

asks us to keep it longer.

The order and enquiry log is append-only on purpose. We add to it; we do not edit or

erase entries. It is the record of what a business and its customer actually said, and it

is the page we produce when someone says "I never agreed to that." Where you ask us to

delete your information from this log, we restrict access to the entry and tell you we

have done so, rather than erase it.

Lead data is kept while the business is actively following up, and deleted on request.

Billing records are kept for the period Nigerian tax law requires.

Security logs are kept briefly, then deleted.

Who we share it with

The business you contacted. They receive your message because that is the purpose of

the service. They are a separate controller of your information, and their own privacy

practices govern what they do with it.

Meta Platforms, Inc., which operates WhatsApp, Facebook and Instagram, and which

delivers the messages and the leads.

Our transcription and language providers. Where a voice note needs transcribing or a reply needs drafting, we send the single message being answered to a specialist provider. Each sees only that one message, is bound by contract, and does not train on your information. The providers we currently use are named below.

Current providers: Groq (voice-note transcription) · OpenAI (reply drafting). Last updated 13 October 2026

Our hosting and infrastructure providers, which store and process information on our

behalf under contract.

We do not share personal information with anyone else, except where a court, regulator or

law enforcement body with lawful authority requires it.

Where information is stored

Information is stored on servers which may be located outside Nigeria. Where it is

transferred out of Nigeria, we take the steps the NDPA requires to keep it protected.

Security

We encrypt information in transit (TLS), and at rest where our provider supports it.

We restrict access to the staff who need it and review those controls regularly. No online

service can promise perfect security. If a breach affects you, we will notify the Nigeria

Data Protection Commission within 72 hours, and we will notify you too where the law

requires it.

Your rights

Under the NDPA you have the right to:

know what information we hold about you, and get a copy of it

have inaccurate information corrected

have your information deleted, where we have no lawful reason to keep it. Order and

enquiry records that document what a business agreed are kept in an uneditable log so we

can prove what was said; for those we will restrict access and tell you we have done it,

rather than erase them

receive the information we hold about you in a usable electronic format, so you can

move it elsewhere (data portability, NDPA section 39)

ask that no decision about you be made by a system alone — a human at the business

can always be asked to review it (NDPA section 41)

object to, or ask us to restrict, how we handle it

withdraw consent where we relied on your consent

lodge a complaint with the Nigeria Data Protection Commission

To exercise any of these, email hello@iscalidafrica.name.ng. We answer requests about

your own information within 30 days. If you are an end customer, it is usually fastest to

ask the business you were dealing with — they hold the relationship and can act on it

directly, and we will help them do so.

Children

Our services are for businesses. We do not knowingly collect information from anyone under

18. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If we change this policy we will update the date at the top and, where a change is

significant, tell our business customers directly.

Contact us

ISCALID AFRICA — ISCALIDAFRICA LIMITED

No 4, F.O. Ogunbajo Close, T.A. Gardens, Warewa, off Lagos–Ibadan Expressway, Ogun State,

Nigeria

Registration number: 7186745

Email: hello@iscalidafrica.name.ng

Phone: +234 913 033 8596