Privacy policy
Version 2026-10-14
Roundstack Innovations Limited ("we", "us") runs a service that turns a location or address into a Nigerian national digital postcode, and checks whether a postcode is valid. People use it through WhatsApp and Telegram bots, and businesses use it through an API and their own bots. This policy explains what personal data we handle and what we do to protect it. It is written to follow the Nigeria Data Protection Act 2023.
A location can show where someone lives, so we treat it as sensitive and collect as little of it as we can.
Who is responsible for your data
- Our own WhatsApp number: we are the controller of your data.
- A business's own bot (a bot run by a shop, courier or other business that uses our platform): that business is the controller. We act as its processor and only handle the data on its instructions. For requests about that bot, you can also contact the business.
- Business account holders: we are the controller of the account data.
What we collect
| Who | What we keep |
|---|---|
| People using our WhatsApp number or Telegram bot | Your WhatsApp number or Telegram ID; your credit balance; payment records; and for each lookup, the postcode returned, whether you sent a pin or typed an address, and the time. |
| Customers of a business's bot | Your chat identifier (your Telegram chat ID or WhatsApp number) and, for each lookup, the postcode returned, pin or address, and the time. |
| Business account holders | Business name, email, a hash of your password, a hash of your API key, your bot credentials (stored encrypted), credit and payment records, the terms version you accepted and when. |
What we do not store: your exact coordinates, the address text you type, your WhatsApp or Telegram profile name, or the content of your messages beyond what is needed to reply. Your location or address is used once to find your postcode, then discarded.
We also keep short-lived technical records: a count of postcode checks per person per day (deleted within 2 days) and message IDs used to avoid processing the same message twice (deleted within 7 days). Our hosting provider keeps standard server logs, such as IP addresses.
Why we use it
- To provide the service you ask for: finding or checking a postcode, keeping your credits, processing payments (performance of a contract).
- To keep the service secure and prevent abuse, such as limiting daily use and stopping free-credit abuse (our legitimate interests).
- To meet legal duties, such as accounting records.
- When you send a location pin, you choose to share it with us. You can stop at any time.
We do not sell your data, use it for advertising, or build profiles of you.
Who we share it with
We share only what each provider needs:
- NIPOST (national postcode system): your coordinates, to find the nearest registered building, or a postcode you ask us to check.
- OpenStreetMap (Nominatim): an address you type, to find its coordinates; and coordinates, to show a readable address. This is a public service operated by a third party.
- Meta (WhatsApp) and Telegram: they carry your messages, under their own privacy policies.
- Paystack: payment details are entered on Paystack's page, not ours. Paystack requires an email address, so we give it one built from your number, which means Paystack sees your number.
- Our hosting provider: it stores our database.
- Authorities: where the law requires it.
Some of these providers process data outside Nigeria. We send data abroad only as needed to run the service, and we rely on the safeguards the Nigeria Data Protection Act allows for such transfers.
How long we keep it
- Lookup history: 90 days, then it is deleted automatically.
- Payment records: as long as the law requires us to keep accounting records. They are not linked to your number or account after you delete your data.
- Account data: until you delete your account.
Your rights and how to use them
You can ask to see your data, correct it, delete it, object to how it is used, or complain. In the bots:
- Send PRIVACY for a short summary.
- Send MY DATA to see what we hold about you.
- Send DELETE MY DATA, then CONFIRM DELETE, to erase your account and history. If you delete and rejoin, you will not get the free starter credit again; we keep a one-way hash of your number only for this purpose.
Business account holders can delete their account from the dashboard. For anything else, email the contact address on our website. You also have the right to complain to the Nigeria Data Protection Commission.
Security
Bot credentials are encrypted in our database. Passwords and API keys are stored only as hashes. Messages from WhatsApp, Telegram and Paystack are checked for authenticity before we act on them. Our pages are served over HTTPS, and access to our systems is limited. No system is perfectly secure. If a breach puts your data at risk, we will notify the Nigeria Data Protection Commission and affected people as the law requires.
Children
This service is not meant for people under 18.
Contact
Roundstack Innovations Limited. Privacy contact: the contact address on our website.
Changes
If we change this policy in a way that matters, we will update the version above and, for business accounts, ask you to accept the new version.