Privacy notice

Who we are

Gisted (the app at staygisted.com) and GistSend (the platform at gistsend.com that businesses and groups use to send updates) are run by GistSend Services, in Nigeria. We are the data controller for the personal data described here. Questions about your data go to support@staygisted.com.

We follow the Nigeria Data Protection Act 2023. This notice explains what we collect, why, who helps us process it, how long we keep it, and your rights.

What we collect

Your account

• The phone number or email address you sign in with. We send a one-time code to it; there is no password.
• Your username and display name, and a profile picture if you add one. Your name and picture are visible to people who add you in Contacts.
• A device identifier and a push-notification token, so updates reach your phone.

What you follow and receive

• The groups and businesses you follow (pair with), and your mute and notification settings.
• The updates they send you, and whether you have read them.
• Your replies and poll answers, including any text or photo you attach. A sender can choose to collect answers anonymously, in which case they see the answers but not who gave them.

Contacts and SOS

• The people you add in Contacts (by username), the labels you give them, your saved groups, and the messages you send them, including scheduled ones.
• Your phone's address book is read only when you choose to pick people from it (for example to invite them to a group), and only after you allow it. We read names, phone numbers and email addresses. Only the people you tick are sent to us; the rest of your address book never leaves your phone.
• Your location is taken only when you send an SOS, and only if you allow it, so your emergency contacts can find you. We do not track your location at any other time.

Finance (dues, levies and ajo)

• The groups you belong to, what each member owes and has paid, and payment receipts.
• For group admins and anyone who receives money (such as an ajo recipient): the bank account that payments settle to (bank, account number and account name). Your BVN is passed to Paystack once, to check that the account belongs to you; we keep the result of that check and the last four digits of the BVN, never the full number.
• Card and bank details you enter to pay are collected by Paystack, our payment processor. We never see or store your full card number.

Businesses and groups using GistSend

• The name, contact details and team members of the business or group, the updates it sends, and its billing details.

Technical data

• Logs of requests to our servers and crash reports from the app, used to keep the service working and secure.

How we use it

• To run your account and sign you in (to perform our contract with you).
• To deliver the updates you asked to receive, and to send your messages, replies and SOS alerts (contract).
• To take payments and pay them to the right group or recipient, and to keep the records the law requires (contract and legal obligation).
• To keep the service secure, stop abuse and fraud, and fix problems (our legitimate interests).

We do not sell your personal data, and we do not use it for advertising. Groups and businesses can only reach people who chose to follow them; they cannot upload contact lists.

Who we share it with

Your data is shared with the groups and businesses you follow only as far as needed: they see that you follow them and the replies you send them, and a group's admins see what members owe and have paid. We also use these service providers, under contracts that limit them to processing data for us:

• Paystack: card and bank payments, settlement to group bank accounts, and bank account and BVN checks.
• Google Firebase: delivering push notifications to your phone.
• Postmark: sending sign-in codes and other emails.
• Cloudflare: storing photos and attachments, and serving our websites.
• Sentry: crash and error reports.
• SMS and WhatsApp providers, when a code or an urgent update is sent to your phone by text.
• Our cloud hosting providers, which run our servers and databases.

Some of these providers process data outside Nigeria. Where they do, we rely on the safeguards the Nigeria Data Protection Act allows, such as contractual protections. We also share data when the law requires it, or to protect someone's safety.

How long we keep it

• Inbox updates are deleted from our servers 90 days after they are sent. You can keep your own copy with the in-app backup, which is stored where you choose and protected by your passphrase; we cannot read it.
• Payment and ledger records are kept for as long as financial and tax law requires, even after an account is closed.
• Your account is kept until you ask us to delete it. After deletion we remove or anonymise your personal data, except records we must keep by law.

Your rights

You can ask to see the personal data we hold about you, correct it, delete it, receive a copy in a portable form, or object to or restrict how we use it. You can withdraw consent (for example to your address book or location) at any time in your phone's settings. To make a request, or to delete your account, email support@staygisted.com from the email address on your account, or tell us your username and the phone number you sign in with. We will reply within the time the law sets.

If you are unhappy with how we handle your data, you can complain to the Nigeria Data Protection Commission.

Security

Data is encrypted in transit, payment credentials are held by Paystack, and access to our systems is limited to the people who need it. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

Children

Gisted is not meant for children under 13. A parent can follow their child's school; the school's updates go to the parent.

Changes

We will update this notice when our practices change, and tell you in the app before a significant change takes effect. The date at the top shows the latest version.