Privacy Policy

1. Introduction

This Privacy Policy applies to all products and services offered by Leadsage Africa ("Leadsage", "we", "us", "our"), including our website, web application, mobile applications (when launched), Leadsage Wallet, SageNest Savings, and related services.

By registering for or using Leadsage, you acknowledge that you have read and understood this Privacy Policy and you consent to the collection and use of your personal data as described herein.

This Policy is compliant with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.

2. Scope

This Policy applies to:

• Our website and web application
• Mobile applications (when launched)
• All services including the property marketplace, artisan services, and SageNest Savings

3. Information We Collect

We collect information you provide directly, information generated through your use of our platform, and information from third parties where permitted by law.

3.1 Personal information you provide:

• Identity data — full name, username, email address, phone number, date of birth, gender, profile photo
• Address data — country, state, city, and street address
• Rental preferences — property types, budget range, preferred areas, move-in timeline (for renters)
• Property data — listing details, photos, pricing, and availability (for landlords)
• Communications — messages sent to our support team and feedback you provide

3.2 Identity verification data (KYC):

• Bank Verification Number (BVN)
• National Identification Number (NIN)
• Government-issued ID
• Selfie / biometric verification

3.3 Financial information:

• Bank account details (for withdrawals), wallet transaction history
• Transaction history, SageNest savings data, and payment records

3.4 Technical data collected automatically:

• Device and browser information (IP address, browser type, operating system)
• Usage data (pages viewed, features used, search queries, click-through data)
• Authentication tokens and session cookies
• Geolocation data (city/region level, if you permit it)

Information from third parties:

• Google account data when you sign in with Google (name, email, profile photo)
• BVN/NIN verification results from our identity verification partner (Prembly)
• Payment confirmation data from Paystack and Anchor BaaS

4. How We Use Your Information

We use your personal data for the following purposes:

• Account management — creating and maintaining your account, verifying your email address, and authenticating your identity
• Service delivery — enabling property searches, applications, bookings, rent payments, and wallet transactions
• KYC & fraud prevention — verifying your identity to comply with financial regulations and to detect and prevent fraud, money laundering, and unauthorised access
• Savings & financial features — enabling SageNest Savings and other financial services
• Communications — sending transactional emails (booking confirmations, payment receipts, OTP codes), service updates, and, where you have opted in, marketing messages
• Platform improvement — analysing usage patterns to improve our features, fix bugs, and personalise your experience
• Legal compliance — meeting our obligations under Nigerian law, including tax reporting and responding to lawful requests from authorities

We process your data on the following lawful bases (NDPA/NDPR compliance):

• Consent — where you have expressly agreed (e.g. marketing emails, geolocation)
• Contractual necessity — to fulfil our obligations to you as a user of our platform
• Legal obligation — KYC/AML compliance, tax reporting, and lawful orders
• Legitimate interests — fraud prevention, platform security, and business analytics (where these do not override your rights)

5. Information Sharing & Disclosure

We do not sell your personal data. We share your information only in the following circumstances:

• Between renters and landlords — when you submit a rental application or booking, relevant profile information is shared with the property owner to facilitate the transaction
• Service providers — trusted third parties who process data on our behalf (payment processors, cloud storage, email delivery, identity verification). They are bound by data processing agreements and may not use your data for their own purposes.
• Financial partners — licensed financial institutions holding SageNest Savings funds
• Regulatory authorities — we may disclose your data where required by law, regulation, court order, or to protect the rights and safety of Leadsage, our users, or the public
• Business transfers — in the event of a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. You will be notified of any change in ownership.

6. International Data Transfers

Where your data is transferred outside Nigeria (for example, to cloud infrastructure or third-party service providers), we ensure:

• Adequate data protection safeguards are in place
• Full compliance with NDPR/NDPA requirements for cross-border data transfers
• Data processing agreements with all recipient parties

7. KYC & Identity Verification

To comply with Nigerian financial regulations and to prevent fraud, we are required to verify the identity of users who access financial features (wallet, savings, withdrawals).

Bank Verification Number (BVN): Your BVN is submitted to our KYC partner (Prembly / Anchor) for verification. We do not store your raw BVN in plain text. The BVN is used solely for identity matching and is not shared for any commercial purpose.

National Identification Number (NIN): Landlords are required to provide their NIN during onboarding for identity verification. NIN data is submitted to our verification partner and is handled under strict confidentiality.

Both BVN and NIN data are encrypted at rest and in transit. We retain only the verification status and a masked reference, not the full numbers, after verification is complete.

8. Financial & Payment Data

Card payment processing is handled entirely by Paystack. Leadsage does not store your card number, CVV, or PIN. We only receive a payment reference and transaction status from Paystack.

Wallet and bank transfer services are powered by Anchor BaaS. Your virtual account number and wallet balance are managed by Anchor under their own regulatory framework. Leadsage mirrors your balance for display purposes.

Your 4-digit wallet transaction PIN is stored as a bcrypt hash. We cannot retrieve or view your PIN. If you forget your PIN, you must reset it using a verified OTP sent to your registered email.

Bank account details you provide for withdrawals are used solely to process the requested transfer and are not retained beyond what is necessary for that purpose and applicable record-keeping requirements.

9. Cookies & Tracking

We use the following types of cookies and similar technologies:

• Strictly necessary cookies — required for authentication (access token, refresh token) and session management. These cannot be disabled.
• Functional cookies — remember your preferences (e.g. dark mode, saved filters) and personalise content.
• Analytics cookies — help us understand how you use our platform so we can improve it. These may be disabled without affecting core functionality.

Authentication tokens are stored in httpOnly, secure cookies — they are not accessible to JavaScript, reducing XSS risk. We do not use third-party advertising cookies. You can control cookies via your browser settings.

10. Data Retention

We retain your personal data for as long as your account is active or as necessary to provide you with our services. When you close your account, we will:

• Delete or anonymise personal data that is no longer required within 90 days
• Retain transaction records, KYC data, and financial logs for a minimum of 7 years as required by Nigerian financial regulations (CBN, FIRS)
• Retain data for fraud prevention and dispute resolution purposes for the duration of the relevant matter
• Retain data subject to an active legal or regulatory inquiry for the duration of that matter

Anonymised and aggregated data (e.g. usage statistics) may be retained indefinitely as it can no longer identify you.

11. Your Rights (NDPR/NDPA)

Under the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — update or correct inaccurate data via your account settings or by contacting us
• Right to erasure — request deletion of your personal data, subject to legal retention requirements
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to the processing of your data for direct marketing or where we rely on legitimate interests
• Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time without affecting prior processing

To exercise any of these rights, please contact us at support@leadsageafrica.com. We will respond within 30 days in accordance with the NDPR/NDPA.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

12. Data Security

We implement industry-standard technical and organisational measures to protect your personal data, including:

• Encryption for data at rest and in transit (TLS/HTTPS)
• bcrypt hashing for passwords, OTPs, and transaction PINs
• httpOnly, secure cookies for authentication tokens
• JWT-based access token rotation (15-minute expiry) with refresh token reuse detection
• Cloudflare Turnstile CAPTCHA to prevent automated attacks
• Secure servers, firewalls, and role-based access controls limiting internal data access to authorised personnel only
• Encrypted storage for sensitive identity data (BVN references, NIN status)

Despite these measures, no system is 100% secure, and users share data at their own risk. In the event of a data breach that affects your rights, we will notify you and the NDPC within 72 hours of becoming aware of the incident.

13. Third-Party Services & Links

Leadsage integrates with the following third-party services that may process your data:

• Paystack — card payment processing. Subject to Paystack's Privacy Policy.
• Anchor BaaS — virtual accounts, wallet infrastructure, and NIP transfers. Anchor is a licensed financial technology provider regulated by the CBN.
• Prembly (IdentityPass) — BVN and NIN verification services.
• Mailjet — email delivery for transactional and notification emails.
• Cloudflare (R2 & Turnstile) — media file storage and bot protection.
• Google (OAuth) — optional Google sign-in. Subject to Google's Privacy Policy.

All third-party processors are selected for their compliance with applicable data protection laws and are bound by data processing agreements where required. Our platform may also contain links to third-party websites — we are not responsible for their privacy practices.

14. Children's Privacy

Leadsage is intended for users who are 18 years of age or older. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has provided us with personal data, we will delete it promptly. If you believe a minor has registered on our platform, please contact us immediately.

15. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email and through a prominent notice on our platform before the change becomes effective. The "Last updated" date at the top of this page will always reflect the most recent revision.

We encourage you to review this Policy regularly to stay informed about how we protect your information.

16. Contact & Data Protection Officer

If you have questions, concerns, or wish to exercise your data rights, please contact us:

Also read our Terms of Service for the full rules governing your use of the Leadsage platform.