Privacy Policy

1. Who is responsible for your data

Syxeaz Ltd is the data controller for personal data processed in connection with the Verdge platform. You can contact us at:

• Email: hello@verdge.ai
• Phone: +234 813 779 8112
• Data Protection contact: hello@verdge.ai (subject: "Privacy")
• Registered office: 13b Fagba Crescent, off Lateef Jakande Road, Agidingbi, Ikeja, Lagos, Nigeria. RC 9375557.

2. What we collect

2.1 Information you give us

• Account details: name, email address, phone number, password (hashed), preferences.
• Channel identifiers: when you reach our agents on a messaging channel, we record the identifier you use (WhatsApp number, Telegram chat ID, email address, SMS number, etc.) so we can recognize you on subsequent messages and link your interactions to your account.
• Content of your messages with our agents. These are processed by AI to generate replies and stored to maintain conversation context.
• Content you upload or generate: in the content studio you may upload media (images, audio, video, documents) and generate new content with AI. We store these files to provide the feature — to host them, create previews and covers, compose or render video, and deliver purchases.
• Face and voice samples (only if you choose to create a custom avatar or voice): if you use the optional custom-avatar or voice-cloning features, you upload a photo or a voice recording, which is processed to build that asset. We ask you to confirm you have the necessary rights and consent first, and we record that confirmation. We do not create an avatar or voice from your samples for any purpose other than the one you requested.
• KYC information (for tenants and where required for withdrawals): business registration documents, tax certificates, government IDs, and proof of address.
• Bank account details for withdrawals: we do not store full account numbers ourselves; we create a recipient record with our payment partner (Paystack) and only store the recipient code and a masked reference (e.g. ****1234).

2.2 Information we collect automatically

• Server log data: IP address, request timestamps, and error traces — kept short-term for security monitoring and operational debugging only. We do not build behavioural or advertising profiles from this.
• Service usage records: agent runs you initiate, transactions, wallet balance changes, referral activity, promo redemptions — needed to operate the platform and produce your account history.

We do not use cookies for analytics or advertising. We use only the minimum session storage required to keep you signed in. We do not collect device fingerprints or device identifiers on the web.

2.3 Information from third parties

• Payment processors (Paystack) confirm card/bank transactions and may share transaction status, the masked card BIN, and bank verification details.
• Service providers (e.g., VTPass, Baxi, Ebills, mobile network operators, distribution companies) confirm whether airtime, electricity tokens, or similar services were delivered to a recipient identifier you specified.
• Channel platforms (Meta WhatsApp Business API, Telegram, etc.) deliver your messages to us and pass back metadata including the message ID, sender identifier, and timestamps. Use of those platforms is subject to their own privacy policies in addition to this one.
• AI model providers (e.g., OpenAI, Anthropic) process the content of your messages on our behalf to generate agent replies, under data processing agreements that restrict their use of that content.
• Content-generation providers process the prompts, uploaded media, and any face/voice samples you submit to the studio in order to generate the image, audio, video, document, avatar, or voice you request, on our behalf and under terms that restrict their use of that content.

3. What we do NOT collect or store

• Full payment card numbers, CVVs, or PINs. Card payments are handled directly by Paystack on a tokenized flow; we never see or store these details.
• Full bank account numbers. Only a Paystack recipient code and a masked reference.
• Device fingerprints or hardware identifiers. We previously experimented with device-level identifiers; that has been deprecated and removed.
• Tracking cookies or third-party analytics scripts.
• Sensitive personal data (such as health or religious data) — please do not share these with our agents. If you do, we will treat them as ordinary message content and process them only to respond, but we discourage you from doing so. The one exception is the optional custom-avatar and voice features: if you deliberately use them, you upload a face or voice sample so we can build the asset you asked for (see Section 2.1). We process those samples only for that purpose, only with your confirmed consent, and never to identify you.

4. Why we use your data (legal basis)

We process your personal data on the following bases under the NDPA:

5. Sharing your data

We share personal data only with the following categories of recipients, and only as needed:

• Payment processor: Paystack Payments Limited, for card and bank transfers.
• Service providers: VTPass, Baxi, Ebills, and similar bill-payment aggregators, to deliver the airtime/electricity/cable subscription you purchase. They receive only the recipient identifier (e.g., your meter number, phone number to top up) and the amount.
• AI model providers: third parties such as OpenAI and Anthropic process the content of your conversations to generate agent replies on our behalf, under contractual confidentiality and data-handling obligations. Your conversations may be transferred to and processed in the United States or other countries where these providers operate (see Section 8).
• Channel platforms: Meta (WhatsApp), Telegram, Termii (SMS), Resend (email), Slack, Discord, Instagram, X (Twitter), and others through which you choose to interact with Verdge. Routing messages through these platforms is necessary to provide the Service.
• Cloud and infrastructure providers (e.g., AWS) for hosting, storage, and security.
• Tenants on the marketplace: if you interact with an agent operated by an independent tenant, that tenant can see the content of your messages with their agent and information necessary to fulfil your request, but does not see details of unrelated transactions.
• Professional advisers (lawyers, auditors, accountants) under confidentiality.
• Authorities: we may disclose data when legally required to do so by Nigerian law enforcement, regulators, or courts.

We do not sell your personal data, and we do not share it for advertising purposes outside our own service communications.

6. Conversations and AI processing

When you message a Verdge agent, your messages are processed by AI to generate a reply. This processing typically involves sending the message — and the recent context of your conversation — to a third-party AI model provider. We do not allow these providers to use your messages to train their public models, where the provider offers that contractual choice. We summarize and rotate context to limit how much of your history is sent in any single request.

Conversation messages are encrypted at rest and in transit. Access to message content is restricted to authorized personnel and systems, and only where needed to operate and improve the Service — for example, to provide support, investigate fraud, abuse, or safety issues, connect you to a human when you request or a business escalates your chat, comply with law, and debug problems. When a business (tenant) operates an agent you use, authorized staff of that business may also see the conversations with their agent in order to serve you.

Please do not share information you do not want processed in this way, including banking PINs, full card numbers, or any data you would not want to appear in an AI prompt.

7. Account merging across channels

You can merge a chat from one channel into another account using the /link command on a channel or the corresponding web flow. When you do, the merged channel user's data — including conversations, wallet balance, transactions, and subscriptions — becomes part of the parent account. We will retain the original channel user record as a "linked" entity for audit purposes for the retention periods in Section 9.

8. International transfers

Some of our processors (notably AI model providers and certain cloud services) operate outside Nigeria, including in the United States and the European Union. Where we transfer personal data outside Nigeria, we rely on the following safeguards under the NDPA:

• contractual data protection clauses with the recipient that impose obligations equivalent to those under the NDPA;
• recipients located in jurisdictions recognized by the Nigeria Data Protection Commission as providing adequate protection, where applicable;
• your explicit consent, where the transfer is incidental to a service you have requested (e.g., asking an agent a question that requires AI processing).

9. How long we keep your data

10. Your rights under the NDPA

You have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your personal data, subject to overriding obligations such as transaction record retention;
• Restrict or object to certain processing, including direct marketing;
• Withdraw consent at any time, where consent is the basis of processing;
• Receive a copy of your data in a portable format;
• Lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng) if you believe your rights have been violated.

To exercise any of these rights, email us at hello@verdge.ai with the subject "Privacy Request". We will respond within thirty (30) days. Where we cannot comply (for example because we must keep transaction records for tax purposes), we will tell you why.

11. Security

We protect your data using technical and organizational measures appropriate to the risk, including:

• TLS encryption in transit for all API and channel traffic.
• Conversation messages encrypted at rest with a per-agent key, with access to message content restricted to authorized personnel and systems and only where needed to operate the Service.
• Hashed passwords (one-way) — we never store plaintext passwords.
• Role-based access controls on internal systems, plus audit logging on privileged actions.
• No card details, CVVs, PINs, or full bank account numbers ever land on our servers — those flow directly through Paystack.

No system is perfectly secure; if we become aware of a personal data breach that is likely to affect you, we will notify you and the Nigeria Data Protection Commission as required by the NDPA.

12. Children

Verdge is not intended for, and may not be used by, anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the latest revision. For material changes, we will give you notice through the Service or by email. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

14. Contact

For privacy questions, requests, or to lodge a complaint:

• Email: hello@verdge.ai (subject: "Privacy")