Privacy Policy

Status: draft for the owner to review. This is not in force. Replace every placeholder in square brackets before anyone relies on this page. These words are not legal advice.

Effective date: [EFFECTIVE DATE]

This notice is for the Nigeria Data Protection Act 2023. The service is called Hearth. The data controller is [COMPANY NAME] of [REGISTERED ADDRESS]. For a privacy request, write to [CONTACT EMAIL].

NDPC registration: [NDPC REGISTRATION]

What this service is

Hearth is an introduction service for adults, aged 18 and over, who are marriage-minded Christian professionals. A real person reviews each profile before other members can see it.

The information we collect

• Account: name, email address, password (stored by the login provider, not as plain text), and the time you agreed to the Terms and this policy.
• Age and identity: date of birth, the confirmation that you are 18 or over, gender, and, if you choose to upload one, an identity document.
• Profile: photos, denomination, church, profession, education, intention, country, state, city or area, and a short bio.
• Verification: a selfie of you holding two fingers beside your face, and the reviewer’s decision.
• Use of the service: likes, matches, messages, blocks, and reports.
• Waitlist: name, email, place, and the gender answer if you gave one.
• Membership: if you pay, the plan you chose, the payment status, and the period end. Paystack processes the card. Hearth does not see the card number.
• Technical data: the logs a host keeps in order to run the site, such as an address of a request and the time it was made.

Other members see your first name as given, your age, and the profile you wrote. They do not see your email, your full date of birth, your selfie, or an identity document. People you block, and people who block you, do not see each other.

Sensitive data

Religious belief, shown by denomination and church, is sensitive personal data under the Act. The selfie is used to check that you are the person in the photos. [COMPANY NAME] treats that selfie as biometric data used for verification. An identity document, if you upload one, is also sensitive.

Hearth asks for a separate tick before it collects this sensitive data. The box starts empty. You tick it yourself. The time of that tick is stored with the consent version. You can withdraw that consent by deleting the account. Withdrawal does not undo a use that was already lawful.

Why it is used, and the lawful basis

• To create the account and run the introduction service, including matches and messages: contract.
• To confirm you are 18 or over: legal obligation, and the age confirmation you give.
• To handle religious details, the verification selfie, and any identity document: your consent, as required for sensitive personal data.
• To review reports, prevent scams, and suspend an account that breaks the rules: legitimate interest in a safe service for adults, and, where it applies, a legal obligation. That interest is not used as a reason to read messages for advertising.
• To take a membership payment and keep a record of it: contract, and a legal obligation where tax or financial rules require a record.
• To send a service email, such as a confirmation or a password reset: contract.

Hearth does not sell personal data. It does not use personal data to make a solely automated decision that has a legal effect on you. A person decides whether a profile is approved.

Who else processes it

• Supabase stores the database and the private files (photos, selfie, and any identity document). Host country: [SUPABASE HOST COUNTRY].
• Vercel hosts the website. Host country: [VERCEL HOST COUNTRY].
• Paystack processes membership payments. [PAYSTACK TRANSFER NOTE]
• The reviewer, reached through the admin email addresses configured for Hearth, can see the profile, the selfie, and any identity document in order to approve, refuse, or suspend.

A transfer of personal data out of Nigeria is made only as the Nigeria Data Protection Act 2023 allows. [COMPANY NAME] must record the safeguard used for each transfer, such as a decision of the Nigeria Data Protection Commission or a contract that protects the data to the standard the Act requires. Do not publish this page until those safeguards are named.

How long it is kept

The profile, photos, messages, and verification files are kept while the account is open, because the service cannot run without them.

The selfie and any identity document are kept only for verification and for a later check if a concern is raised. [RETENTION PERIOD]

When you delete the account, Hearth deletes the login, profile, photos, selfie, optional identity document, likes, matches, messages, blocks, and reports tied to you, and a waitlist row with the same email. A payment record may be kept for [RETENTION PERIOD] where the law requires it. A report about a child is acted on first. Do not rely on deletion to destroy a copy a regulator has already required [COMPANY NAME] to keep.

Your rights

Under the Nigeria Data Protection Act 2023 you may ask [COMPANY NAME] to:

• confirm whether it holds data about you, and to give you a copy
• correct data that is wrong
• delete data, or to restrict how it is used
• let you withdraw consent
• object to a use based on legitimate interest
• receive data you provided, in a usable form, where the Act gives a right of portability

Write to [CONTACT EMAIL]. [COMPANY NAME] may need to confirm that the request comes from you. It will answer within the time the Act requires. You may also complain to the Nigeria Data Protection Commission. That complaint does not remove your right to come to the courts.

Breach

If a breach of personal data is likely to risk the rights of people, [COMPANY NAME] will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, or with the reasons for any delay, as the Act requires. If the risk is high, [COMPANY NAME] will also tell the people affected, in plain language, using the email on the account or [CONTACT EMAIL].

Children

Hearth is not for anyone under 18. A profile that appears to belong to a child is hidden. Do not send information about a child.

Changes

[COMPANY NAME] may update this notice. The page will show a new effective date. A change to the sensitive-data consent will use a new consent version, and will not pretend that an old tick covers new words.

Contact

[COMPANY NAME] [REGISTERED ADDRESS] [CONTACT EMAIL]