Privacy notice

Two roles

Your account. For the details you give to sign in and use the service (your name, email address and sign-in activity), Vaedi Limited decides why and how they are used, so we are the controller.

Your organisation's working data. For the assessments, tasks, documents, evidence files and reports that your organisation puts into ComplyNG, your organisation decides what goes in and why, so it is the controller and we are its processor. We use that data only to provide the service.

The service asks you not to enter names or identity numbers of individuals. Please follow that: it keeps the personal data in the service small.

What we collect and why

• Account details (name, email address, password handled by our sign-in provider, optional authenticator app): to create your account and keep it secure. Lawful basis: performing our contract with you.
• Working data (readiness answers, tasks, documents, uploaded evidence, approvals and who approved them, an activity log): to run the service for your organisation.
• Agent records (what an agent was asked, what it proposed, and who approved or rejected it): to give your organisation an audit trail.
• Connector results (only if an owner or admin connects AWS or Microsoft 365): security settings read from the connected account, such as whether multi-factor sign-in is on. We do not read the content of files, mail or databases. Secrets you provide are stored encrypted.
• Technical data (such as IP address and error logs): to keep the service secure and fix faults. Lawful basis: our legitimate interest in running a secure service.

We do not sell personal data, and we do not use advertising or tracking cookies. We use only the browser storage needed to keep you signed in and remember simple preferences.

AI drafting

When someone asks an AI agent to draft a document, the question and the relevant organisation details are sent to an AI provider (OpenAI, which is based outside Nigeria). Email addresses, phone numbers and long identity numbers are removed first. Nothing the AI produces takes effect until a person with the right role approves it.

Who we share data with

Only with service providers that help us run ComplyNG, under agreements that restrict how they use it:

• Database, sign-in and file storage provider (Supabase, through Lovable Cloud).
• Hosting and delivery (Lovable and its infrastructure providers).
• AI provider (OpenAI), only when AI drafting is used.
• AWS or Microsoft, only for an account an owner or admin connects.

We may also disclose data where the law requires it.

Transfers outside Nigeria

Some of these providers store or process data outside Nigeria. Where that happens we rely on contractual safeguards and the provider's security commitments, as the NDPA requires. If you need to know where your organisation's data is held, ask us at the address below.

How long we keep it

Account data is kept while your account is open. Working data stays until your organisation's owner resets or deletes it; deleting an organisation removes its data from the live service. Backups and logs are removed on the provider's normal schedule. Agent approvals and the activity log are kept as audit evidence until the organisation is deleted or reset.

How we protect it

• Each organisation can read only its own data, enforced in the database itself.
• Roles limit who can approve; owners can require an authenticator app for everyone.
• Connection secrets are encrypted and cannot be read by any signed-in user.
• Our assurance report describes what we tested and what we did not. It is a developer-run exercise and not an independent audit.

If we become aware of a breach that puts people at risk, we will tell the affected organisation without undue delay so it can meet its own notification duties.

Your rights

Under the NDPA you can ask to see the personal data we hold about you, correct it, have it deleted, restrict or object to its use, receive a copy in a usable form, and withdraw consent where we rely on it. If your data was entered by an organisation using ComplyNG, contact that organisation first; we will help it respond.

To use a right, email admin@vaedilimited.com. If you are not satisfied with our response you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Changes

We will update this page when what we do changes, and change the date at the top.