Privacy Policy

Who we are

Kushi Digital Innovations Ltd (RC 9081945) (“Kushi”, “we”, “us”) builds and runs the Kushi products. Our registered office is House 1, Three Brothers Street, Ado, Karu, FCT, Nigeria.

For the personal data we decide how to use, Kushi is the data controller under the Nigeria Data Protection Act 2023 (NDPA) and the regulations made under it. Where Kushi Sales processes data on a seller’s behalf, the seller is the controller and Kushi is their processor (see Kushi Sales: your customers’ data).

What this policy covers

Kushi Housing (housing.kushi.ng and the Kushi mobile app): verified rentals, bookings, tenancy agreements and rent payments.
Kushi Sales (sales.kushi.ng): order, delivery, stock and cash-on-delivery tools for businesses.
kushi.ng and the Kushi admin consoles used by our staff.

By using any of these, you agree to the practices described here. Product-specific policies (for example Kushi Housing’s booking cancellation and caution deposit policies) add to this policy for that product.

Information we collect

Everyone

Account data: name, email address, phone number, profile photo and password (stored only as a cryptographic hash).
Sign-in data: one-time codes sent by SMS or email, and the identity details returned when you sign in with Google or Apple (see Signing in with Google).
Device and technical data: IP address, device type, operating system, browser, session identifiers and push-notification tokens, used for security, fraud prevention and notifications.
Usage data: activity logs used for security, audit and support, and aggregated usage used to improve the products.
Support data: messages, feedback and screenshots you send us.

Kushi Housing

Identity verification: government ID numbers (NIN/BVN) and a selfie used for a liveness check that matches your face to your ID.
Signatures: electronic signatures on digital tenancy agreements.
Property data: addresses, titles, descriptions, photos, videos and prices that hosts submit. Photos taken in the app may include GPS location, used to confirm they were taken at the property.
Location: your device’s location, with your permission and only while the app is open, to show nearby listings and help enter addresses. It is not stored except with listing photos as described above.
Transactions: payment history, rent and deposit amounts, the last four digits and type of a card, and hosts’ bank details for payouts and refunds.
Messages and calls: in-app chat between guests and hosts. Voice and video calls are not recorded; call rooms are deleted within two hours.
Reviews, saved listings and preferences.

Kushi Sales

Business data: your store name, address, branding, team members and their roles, products, prices, stock and settings.
Order data you put into Kushi Sales: your customers’ names, phone numbers, delivery addresses, order contents and amounts, whether entered by you, imported, received from your website or WooCommerce store, or sent through your storefront.
Delivery agent data: names, phone and WhatsApp numbers, states, stock held, deliveries and cash remittances.
Billing data: your plan, subscription and payment history. Card details are handled by Flutterwave; we keep only references, amounts and dates.
Connections you set up: Meta Pixel and Conversions API settings, webhook endpoints and API keys.

Signing in with Google

If you choose “Sign in with Google” on any Kushi product, Google shares your name, email address, profile picture and a unique account identifier with us. We do not request access to your Gmail, Google Drive, contacts, calendar or any other Google data.

We use this information only to create your Kushi account, sign you in and show your name and picture in the product. We do not sell it, use it for advertising, or share it except as needed to run the service you signed in to.

Kushi’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Kushi from your Google account at any time in your Google account settings, and ask us to delete your Kushi account as described in Your rights.

How we use information

To run the products: create and secure accounts, show listings and maps, process bookings and payments, generate tenancy agreements, manage orders, deliveries, stock and remittances, and send receipts and alerts.
To verify and protect: confirm identities, check that listing photos are genuine, and detect fraud, fake listings, money laundering and unauthorised access.
To communicate: send confirmations, reminders, security notices and support replies by email, SMS, WhatsApp and push notification. Product announcements to businesses on Kushi Sales appear inside the app.
To support you: our staff may view your account or store to answer a request or fix a problem. On Kushi Sales, staff support sessions are view-only and are recorded in the store’s activity log.
AI features: when you use an AI assistant or suggestion feature, the text you send and the data needed to answer it are sent to our AI provider to produce the response.
To improve the products: using aggregated or de-identified usage data.
To meet legal obligations: including tax, accounting and lawful requests from authorities.

Our legal bases are performing our contract with you, your consent (for example location or biometric checks), our legitimate interests in running a safe service, and compliance with the law.

Kushi Sales: your customers’ data

When a business uses Kushi Sales, the details of its customers and delivery agents belong to that business. The business is the data controller and is responsible for having a lawful basis to collect them and for telling its customers how they are used. Kushi processes that data only on the business’s instructions, to provide Kushi Sales, and not for our own marketing.

Order details sent to a delivery agent over WhatsApp (customer name, phone, address and order) go only to the agent the business chose.
If a business connects its Meta Pixel or Conversions API, purchase events are sent to Meta on its behalf. Customer email addresses and phone numbers are hashed (SHA-256) before they are sent.
If you are a customer of a business that uses Kushi Sales and want to exercise your rights, contact that business first. We will help them respond, and you can also contact us.

Cookies and local storage

Our websites use cookies and browser storage to keep you signed in, remember preferences (such as light or dark mode) and protect against forged requests. The mobile app stores your session and preferences on your device until you sign out or uninstall it.

We do not use cookies or local storage for advertising or cross-site tracking. A Kushi Sales storefront may load its owner’s Meta Pixel if the business has connected one.

How long we keep it

Account data: while your account is open, then deleted or anonymised, except what the law requires us to keep.
Financial records: typically six years, to meet tax and accounting law.
Chat messages: for the life of the account, to help resolve disputes.
Call room data: deleted within two hours of a call ending.
Listing photo location: kept with the photo while the listing exists.
Kushi Sales store data: while the store’s account is open. An owner can erase the store’s data from the app, and we delete it within 30 days of the account closing unless the law requires otherwise.
Security and integration logs: up to 30 days, longer for audit records of staff actions.

Security

Data is encrypted in transit (TLS). Passwords are stored as one-way hashes. Access to personal data is limited to staff who need it, protected by role-based permissions, and staff actions are recorded in an audit log. No system is perfectly secure; if a breach affects your personal data we will notify you and the Nigeria Data Protection Commission as the law requires.

Where data is processed

Some of our providers store or process data outside Nigeria (for example in the United States or Europe). When that happens we rely on the safeguards the NDPA allows, such as contractual protections and providers’ security commitments.

Your rights

Under the NDPA you can:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data, subject to what the law requires us to keep;
withdraw consent you gave us, without affecting what was done before;
object to, or ask us to restrict, certain processing;
ask for your data in a portable format;
complain to the Nigeria Data Protection Commission.

Email us at info@kushicorp.com from the address on your account. We reply within 30 days and may need to confirm your identity first.

Children

Kushi is for people aged 18 and over. We do not knowingly collect data from children; if you believe a child has given us data, contact us and we will delete it.

Changes to this policy

We will update this page when our practices change and change the effective date above. If a change is significant, we will also tell you by email or in the app before it takes effect.

Contact us

Kushi Digital Innovations Ltd (RC 9081945)
House 1, Three Brothers Street, Ado, Karu, FCT, Nigeria
Email: info@kushicorp.com