Ojú Privacy Policy

1. Who controls your data

Xpiffmobile Limited (RC 8560480) owns and operates Ojú and is the controller of information used to create, secure and administer Ojú accounts and Platform services. Contact us at admin01@xpiffmobilelimited.com, +234 816 438 8087, or Shop 17 & 18, Funmine Castle, FUTA South Gate, Akure, Ondo State, Nigeria.

When a Business User records its own customers, suppliers, staff and transactions, that business is responsible for collecting and using those records lawfully, while Ojú processes them to provide the selected service.

This Privacy Policy is intended to comply with the Nigeria Data Protection Act 2023 and other applicable Nigerian data-protection requirements.

2. Information we collect

Account information: name, email, phone, account type, password credentials in protected form, accepted legal version, profile settings, sign-in and active-device information.

Business and professional information: business or practice name, RC/BN and CAC results, industry, address, stores, certificates, logo, website, social-media links, tax details, consultant services, fees, states covered, credentials and references.

Inventory and transaction information: product, make, model, IMEI or serial number, colour, storage, condition, supplier, customer, stock quantities, purchase and selling prices, expenses, debts, sales, swaps, repairs, receipts, signatures and transaction history.

Identity and evidence: government identification, identity-verification results, customer or representative photographs, proof of ownership, police reports, business certificates and other documents submitted during intake, verification or investigation.

Stolen-item information: reporter and owner details, identifiers, incident details, police station and investigating-officer details, evidence, status, reward information, search matches and case actions.

Public and community information: marketplace listings, business profiles, ratings, reviews, anonymous-review preference, follows and consultant listings.

Payment and subscription information: plan, allowances, payment reference, status and provider-supplied card brand or last digits where available. Ojú does not store card PINs, OTPs or complete card details.

Technical and audit information: IP address, browser and device information, timestamps, errors, security events, searches, record changes, administrative actions and communications with support.

3. How information is collected

We collect information directly from users, from staff operating Ojú at a business counter, from uploaded documents and spreadsheets, from device and browser activity, from payment and verification providers, from the public CAC register, and from lawful police or government sources.

If you give Ojú another person's information, you must have a lawful basis and provide any notice or obtain any consent required, especially before capturing identity documents, photographs or signatures.

4. Why we use information

We use information to create and verify accounts, provide inventory and transaction tools, generate receipts, operate listings and reviews, process subscriptions and paid checks, deliver support, enforce plan and seat limits, secure one active device session, prevent fraud and maintain audit trails.

We use device and case information to operate the shared stolen-item registry, review reports, notify authorised recipients of matches, assist investigations, correct records and respond to lawful requests.

We use contact details to send receipts when an email is supplied, service notices, security alerts, case updates, payment confirmations, support responses, followed-listing notifications and legal updates. Marketing is sent only where permitted, and consent can be withdrawn.

Our legal bases include performance of our agreement, consent where required, compliance with legal duties, and legitimate interests in secure records, fraud prevention, responsible commerce and protection of users and property.

5. What may be public

A Business User may publish its business name, logo, industry, area, selected contact channels, website, social links, rating and in-stock marketplace listings. Trade and end-user prices may be shown differently according to the viewer's account type.

Consultant profiles may show practice information, services, states covered, fees, credentials or verification status and ratings. Private direct contact information is disclosed only through authorised Platform flows.

Published reviews may show a masked identity, verification label or Anonymous where the reviewer chooses that option. Ojú administrators can retain the underlying account link for moderation and legal purposes.

Approved stolen-item records may expose the minimum information needed to identify and avoid the item, such as a masked identifier, description and case status. Full identity documents, reporter contact details and investigation records are not public.

6. Information that is kept private

Passwords, full identity documents, customer photographs, full IMEIs in ordinary public listings, bank credentials, expenses, debtors, internal financial reports, private receipt signatures and business-only records are not made publicly available.

Business records are normally limited to that organisation and authorised Ojú personnel. Resellers do not receive another organisation's private records or customer identity documents.

7. Stolen-item matches and investigations

If a searched identifier matches a reported item, Ojú may preserve the searching account, time, identifier, IP and device information, business or staff details and relevant intake information entered before the match.

Relevant case information may be disclosed to authorised Ojú staff, the reporter, the investigating officer, the handling police station, a court or another lawful authority. We consider relevance, safety, privacy and applicable law and avoid disclosing unrelated information.

Reporter self-checks may be recorded without triggering the same notifications as an unrelated search. A recorded search does not by itself mean that the searcher committed an offence.

8. Who receives information

We use carefully selected providers for cloud hosting, database and file storage, email, payments, identity verification, error monitoring and other functions needed to run Ojú. They may process information only for the contracted service and under applicable safeguards.

We may query the public CAC register for business verification and may share relevant information with police, courts, regulators or government bodies where lawfully required or reasonably necessary for an investigation or protection from harm.

We may disclose information during a genuine corporate restructuring or legal transfer, subject to confidentiality and applicable law. We do not sell personal data or customer records and do not share them for third-party behavioural advertising.

9. Payments

Payments are handled by the payment provider displayed at checkout. The provider receives the payment information needed to process the charge and applies its own privacy terms. Ojú receives references, amount, status and limited payment-method information needed for reconciliation, refunds and fraud prevention.

10. Storage, international processing and security

Information is stored in managed cloud systems and may be processed outside Nigeria where our providers operate. We use contractual and technical safeguards appropriate to the service and applicable law.

Safeguards include encryption in transit, protected authentication, access controls that separate organisations, role-based permissions, private document storage, audit logging, verified server-side actions and active-session controls.

No system is completely secure. Where a personal-data breach creates a legally reportable risk, we will notify affected people and the appropriate regulator as required.

11. Retention

Account and business information is kept while an account is active and afterwards for the period reasonably required for legal, tax, accounting, security and dispute purposes. Transaction, receipt and accounting records may be kept for at least six years.

Stolen-item reports, match records and case audit trails may be retained for an extended period or indefinitely where needed to preserve registry integrity, document resolution and support lawful investigations.

Technical and security logs are normally retained only as long as needed for security, troubleshooting and audit. Backups expire on managed schedules. We delete or anonymise information when there is no continuing lawful reason to keep it.

12. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, withdrawal of consent and information about how your data is used. You may also challenge a significant automated decision and ask for human review where applicable.

Most account and business details can be corrected in Ojú. Other requests should be sent to our contact address. We may verify identity before acting and may retain information where law, transactions, security, fraud prevention, disputes or investigations require it.

If you are dissatisfied, you may complain to the Nigeria Data Protection Commission or another competent authority.

13. Account deletion

Eligible users can request account deletion from account settings. The protected Ojú internal administrator account cannot be self-deleted. Closing an account removes or de-identifies information that is no longer needed, but does not erase lawful transaction records, receipts, security logs, reports, case evidence or audit trails that must be preserved.

14. Cookies and device storage

Ojú uses necessary cookies or similar storage for sign-in sessions, security, preferences, payment-return handling and active-device enforcement. We do not use third-party advertising trackers. Blocking necessary storage may prevent account features from working.

15. Personal vault and next of kin

If you use the personal vault, we store the entries you create: their names, website or bank names, usernames or account numbers, passwords, PINs, notes, and any files you attach. Passwords, PINs, notes and whole documents are encrypted with AES-256-GCM before they are stored, using a key held only on our server, so a stored file or record is unreadable on its own. The app, the website and every business account are barred by the database itself from reading those encrypted records. Opening an entry requires the vault passcode you create, which is stored only as a one-way hash and cannot be read or recovered by Ojú; too many wrong attempts lock the vault for a while, and every opening, failed attempt and release is recorded.

We also store your check-in settings: how often you check in, when you last checked in, how many reminders have been sent, how many check-ins were missed, and your next of kin's name, email address, phone number and relationship, along with any message you leave for them. Please make sure your next of kin agrees to their details being held for this purpose.

We use these details only to send you check-in reminders, to record your check-ins, and — if you miss the number of check-ins you set — to send your next of kin the entries you chose, by email and by a one-time secure link that expires. If you chose to include account access, your Ojú password is reset and sent to them. Every release is recorded, you are notified by email and in the app, and our team is alerted that a release took place so we can help if it was a mistake.

Vault content is never listed, sold, advertised, searched by other users, or shared with any business, and it is not used to build profiles or for marketing. Deleting an entry removes it and its attached file, and deleting your account removes your vault, its files and your check-in settings, except where a record must be kept by law.

16. Children

Ojú accounts are intended for people aged 18 or older. We do not knowingly create accounts for children. If you believe a child's information was submitted improperly, contact us so we can investigate and take appropriate action.

17. Changes and contact

We may update this Policy for new features, legal requirements, provider changes or security improvements. Material changes may be announced in Ojú and may require renewed acceptance. The effective date and version above identify the current policy.

Privacy contact: Xpiffmobile Limited, Shop 17 & 18, Funmine Castle, FUTA South Gate, Akure, Ondo State, Nigeria. Email: admin01@xpiffmobilelimited.com. Phone: +234 816 438 8087. Website: www.xpiffmobilelimited.com. Support hours: Monday to Friday, 8:30am – 6:00pm West Africa Time (excluding public holidays).