Privacy Policy

When you create an account: your name, username, email address, phone number and location. Optionally a headline, bio, profile photo, banner, skills and languages.

When you verify: your National Identification Number (individuals) or CAC registration number and your role at the company (businesses). Certificates you choose to upload. Verification numbers are checked with an identity provider and we store the result and a reference, not a copy of your ID document.

When money moves: your wallet balances, every transaction, and — if you withdraw — your bank name, account number and account name. Your transaction PIN is stored only as a one-way hash; we cannot read it.

What you publish: listings, posts, projects, portfolio items, reviews, comments and any media you upload.

Technical data: log and error information, and a rate-limiting key derived from your connection to stop abuse of our endpoints.

If you join the waitlist: your email address and, if you tell us, what brought you here.

Direct messages and group chats are end-to-end encrypted. They are encrypted in your browser with a key only you and the other participants hold. We store ciphertext. This is not a promise not to look — we cannot look, and neither can anyone who compels us or breaches our database.

One consequence worth knowing: if you reset a forgotten password, the key protecting your old messages cannot be recovered, and that message history becomes permanently unreadable. Changing your password while signed in does not have this effect.

Contract Room chat is different and is not encrypted. Messages inside a contract are stored in readable form so they can be used to resolve a dispute, including by our AI mediation. The Contract Room says so on screen. Keep anything you would not want read in a dispute out of it.

To run your account and show your profile; to verify identity so that people transacting here know who they are dealing with; to move money, hold escrow and meet our financial record-keeping duties; to match work to people; to moderate content and investigate reports; to send you service messages; and to keep the platform secure.

Our lawful bases under the NDPA are: performance of our contract with you (running the service), legal obligation (financial and identity records), legitimate interest (security, fraud prevention, moderation) and consent where we ask for it.

We do not sell your personal data, and we do not run advertising trackers.

We use AI to review listings, moderate content, propose settlements in disputes, and power the DAPDOL AI assistant. Before any text reaches an AI provider it passes through automatic redaction that masks email addresses, phone numbers, NIN and BVN, bank account numbers, card numbers and other long digit sequences.

Your direct messages are never sent to an AI provider. Contract Room chat may be, but only when a dispute has been opened on that contract and mediation is requested.

The assistant is given a summary of your own account — your badge tier, counts of your activity and your balance rounded down — never your email, phone, NIN, bank details or message content.

We use these providers to run DAPDOL. Each processes data only to deliver its service to us:

• Supabase — database and authentication
• Cloudflare R2 — file storage for images, documents and media
• Vercel — application hosting
• Paystack — payments, payouts and bank account verification
• Resend — transactional email
• Anthropic — the AI features described above
• Identity and SMS providers — NIN and business registration checks, and one-time codes

Some of these store data outside Nigeria, including in the United States and the European Union. Where that happens we rely on the NDPA's provisions for cross-border transfers and on our agreements with each provider.

Account and profile data: while your account exists. Financial records, including transactions and escrow history: retained after account closure where law requires us to keep them. Encrypted message content: until you or another participant deletes it, noting that we cannot read it either way. Moderation records: retained so that a decision can be reviewed or reversed.

Under the NDPA you may ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or transfer it elsewhere. You may also complain to the Nigeria Data Protection Commission.

Being straight with you: we handle these requests by hand today. The self-service export and delete-my-account tools are still being built. Email admin@dapdol.com from your registered address and we will respond within 30 days. Some data survives a deletion request where we are legally required to keep it — financial records in particular — and we will tell you exactly what was kept and why.

We use cookies that are necessary to keep you signed in. We do not use advertising or cross-site tracking cookies.

Your browser also stores some things locally: preferences such as your chosen feed tab, and — while you are signed in — the key that decrypts your messages. That key is held in session storage, is cleared when you close the tab, and is never sent to us.

Access to data is enforced in our database rather than only in the application. Files are served from private storage through short-lived signed links unless they are meant to be public. Transaction PINs are hashed. Payment card details never touch our servers — they go directly to our payment provider.

No system is perfect. If a breach affects your data we will notify you and the Commission as the NDPA requires.

DAPDOL is for people aged 18 and over. If we learn that an account belongs to someone younger we will close it and delete the data.

We will update this page when what we do changes, and change the date at the top. If a change materially affects your rights we will tell you directly rather than relying on you to notice.