Privacy Policy

Afialytics (“we,” “us,” or “our”) provides a governed analytics platform. This Privacy Policy applies to personal data we process as a data controller—for example account, billing contact, marketing, and website visitor data.

When your organization connects warehouse data or uses the Service to analyze business information that includes personal data, your organization is typically the data controller of that Customer Data, and we process it as a data processor (or similar role) on your organization’s instructions. That processing is described further in our Data Use Policy and in customer agreements.

This Policy does not replace employment or workplace privacy notices issued by your employer if they provision your access.

“Personal data” means any information relating to an identified or identifiable natural person, consistent with the NDPA.

“Processing” means any operation on personal data, including collection, storage, use, disclosure, or deletion.

“Customer Data” means data submitted to or processed through the Service from systems your organization controls (warehouses, uploads, models, reports, dashboards, prompts tied to your workspace).

A. Data you provide

B. Data from use of the Service

C. Data we do not seek as controller

Depending on the activity, we rely on one or more lawful bases under the NDPA, including:

• Contract — to create and administer accounts, provide the Service, and perform customer agreements;
• Consent — where we ask for it (for example certain marketing preferences or optional cookies beyond those strictly necessary);
• Legitimate interest — to secure the Service, prevent fraud and abuse, improve reliability, and understand aggregate product usage, balanced against your rights;
• Legal obligation — to meet Nigerian or other applicable legal, tax, or regulatory duties;
• Vital interests or public interest — only where applicable and necessary.

Where we process Customer Data as a processor, the lawful basis is determined by your organization as controller; we process according to documented instructions and applicable agreements.

We use personal data to:

• Provide, operate, secure, and support the Service;
• Authenticate users, manage organizations and workspaces, and enforce access controls;
• Respond to requests (waitlist, access, demo, sales, support);
• Send service-related notices (security, billing status, material product changes);
• Send product updates or marketing where permitted—you may opt out of promotional mail;
• Detect, investigate, and prevent fraud, abuse, and security incidents;
• Comply with law and enforce our Terms;
• Create aggregated or de-identified insights about Service performance that do not identify you.

Customer Data remains under your organization’s control. We process it to run queries, refresh catalogs, power models and agents, render dashboards, and apply sharing rules you configure.

We do not sell Customer Data. We do not use Customer Data to build advertising profiles. AI features process Inputs and workspace context to return Outputs for your organization, as described in the Data Use Policy.

Administrators in your organization may access member activity and content according to roles you assign.

We may share personal data with:

• Service providers (hosting, email, analytics for our sites, customer support tools, payment or invoicing partners) under contracts requiring appropriate protection;
• Professional advisers (legal, accounting) under confidentiality;
• Authorities when required by law or to protect rights, safety, and security;
• Parties to a corporate transaction (merger, acquisition, financing) under appropriate safeguards;
• Your organization and its admins when you use a work account;
• Others with your direction or consent (for example embed destinations you configure).

We require processors who handle personal data for us to implement security measures consistent with the sensitivity of the data and applicable Nigerian requirements.

We may process personal data on infrastructure in Nigeria and in other countries where our providers operate. Where personal data is transferred outside Nigeria, we take steps required under the NDPA and related rules—such as ensuring an adequate level of protection, using appropriate contractual clauses, or relying on another recognized transfer mechanism—and we remain accountable for the personal data we control.

We keep personal data only as long as needed for the purposes described, including providing the Service, resolving disputes, enforcing agreements, and meeting legal retention duties. Retention periods vary by data type and context. When no longer needed, we delete, anonymize, or securely archive personal data according to our practices.

Customer Data retention in active tenants follows your organization’s configuration and our deletion timelines after account closure, subject to backups and legal holds described in the Data Use Policy.

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration, including tenancy-aware access controls, encryption in transit, and monitoring. No method of transmission or storage is perfectly secure. Details are summarized on our Security page.

You must protect credentials and configure organization roles responsibly. Promptly report suspected incidents to [email protected].

Subject to the NDPA and applicable exceptions, you may have the right to:

• Be informed about processing of your personal data;
• Access personal data we hold about you;
• Request correction of inaccurate personal data;
• Request deletion of personal data in certain cases;
• Restrict or object to certain processing;
• Data portability where applicable;
• Withdraw consent where processing is based on consent (without affecting prior lawful processing);
• Lodge a complaint with the Nigeria Data Protection Commission.

To exercise rights regarding data we control, contact [email protected]. We may need to verify your identity. If your request relates to Customer Data processed for your employer or customer organization, we may redirect you to that organization’s administrator, who is typically the right point of contact.

We will not discriminate against you for exercising privacy rights available under applicable law.

We use necessary cookies to keep you signed in and secure the Service. We may use limited analytics cookies on marketing pages to understand traffic. Where required, we will request consent for non-essential cookies. You can control cookies through your browser settings; disabling some cookies may affect functionality.

The Service is not directed to individuals under 18. If we learn that we have collected personal data from a child in violation of this Policy, we will take steps to delete it.

We may update this Privacy Policy by posting a revised version with a new effective date. Material changes will be indicated on this page and, where appropriate, communicated to account contacts.

Privacy inquiries and data subject requests: [email protected]. Legal: [email protected].

You may also lodge a complaint with the Nigeria Data Protection Commission if you believe your personal data rights under Nigerian law have been infringed.