Privacy Policy

1. Introduction

Ilanaa ("we", "us" or "our") is committed to protecting the privacy of everyone who uses our AI-powered commerce platform (the "Service"). This Privacy Policy explains how we collect, use, store, share and protect your personal data when you access our website, mobile interfaces, WhatsApp/Instagram/Telegram integrations and related services.

This Policy is made in compliance with the Nigeria Data Protection Regulation 2019 ("NDPR") and other applicable Nigerian data-protection laws. By using the Service, you acknowledge that you have read and understood this Policy.

2. Data Controller

The data controller responsible for your personal data is Ilanaa Technologies. If you have any questions about this Policy or how we handle your data, please contact us using the details at the end of this page.

3. Personal Data We Collect

We collect only the personal data necessary to provide and improve the Service. This may include:

• Account information — name, email address, phone number, business name and password.
• Channel data — WhatsApp Business Account number, Instagram/Telegram identifiers and message content processed through your connected channels.
• Customer data — names, phone numbers, addresses, order histories and payment information submitted by your customers through the Service.
• Usage data — log data, device information, IP address, browser type and interactions with the Service.
• Voice data — audio files you submit for voice-note bookkeeping, which are converted to text and stored as transaction records.
• Payment data — billing address and transaction records handled by our payment partners.

4. How We Collect Personal Data

• Directly from you when you register, update your profile, connect a sales channel or contact support.
• Automatically through cookies, analytics tools and server logs when you use the Service.
• From third parties such as Meta (WhatsApp/Instagram), Telegram, payment processors and authentication providers, when you choose to connect those services.

5. Purpose and Legal Basis for Processing

We process personal data for the following purposes, relying on the lawful bases permitted under the NDPR:

• To provide the Service — performance of our contract with you.
• To maintain and improve features, fix bugs and train AI models that power automation.
• To communicate with you about updates, support and security alerts.
• To comply with legal and regulatory obligations.
• To protect our rights, prevent fraud and ensure platform safety.
• For marketing, where you have given your explicit consent or where the law permits us to do so on the basis of legitimate interest.

6. How We Share Personal Data

We do not sell personal data. We may share it only with:

• Service providers — cloud hosting, analytics, payment processing and customer-support partners bound by confidentiality and data-protection obligations.
• Channel partners — Meta and Telegram, as necessary to deliver WhatsApp, Instagram and Telegram integrations you enable.
• Legal authorities — when required by law, court order or to protect our rights and users.
• Business successors — in the event of a merger, acquisition or sale of assets, under confidentiality commitments.

7. International Transfers

Some of our service providers operate outside Nigeria. Whenever personal data is transferred internationally, we ensure that appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your data in line with NDPR requirements.

8. Data Retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with legal obligations, resolve disputes and enforce agreements. When data is no longer needed, we securely delete or anonymise it.

9. Security Measures

We implement industry-standard technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, encryption in transit, regular security reviews and staff training. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

10. Your Data Protection Rights

Under the NDPR, you have the right to:

• Request access to the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your personal data, subject to legal or contractual exceptions.
• Object to or restrict certain processing activities.
• Request a copy of your data in a portable format, where technically feasible.
• Withdraw consent for processing based on consent, at any time.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or the National Information Technology Development Agency (NITDA).

11. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences and analyse usage. You can manage cookie settings through your browser. Essential cookies required for the Service to function cannot be disabled without affecting your experience.

12. Children's Privacy

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes will be notified through the Service or by email where appropriate. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions, concerns or requests relating to this Privacy Policy or your personal data, please contact us: