Data Governance

Privacy Policy & Data Handling

Draft Policy Notice • Baseline: October 2026 • Governing Nigeria Data Protection Act (NDPA) Standards

Notice of Legal Review:This document outlines the operational data architecture and handling practices implemented by Digital WebACE. We continuously update these standards in alignment with the Nigeria Data Protection Act (NDPA) 2023. This policy does not constitute formal legal counsel.

1. Information Collected via Build Plan Intake

When you request an autonomous build plan via /start, we collect only information explicitly provided by you:

Business Identification: Business name, industry/business type, and current website status.
Operational Requirements: System features and needs selected for your plan.
Contact Information: Contact person name, Nigerian WhatsApp phone number, and optional email address.
Timestamped Consent: Exact date, time, and version identifier of your affirmative consent checkbox.

2. Purpose of Processing & Lawful Basis

Under the NDPA, we process your information on the lawful basis of your explicit consent and to take preparatory steps prior to entering into a written service contract:

To deterministically generate your private tokenized build plan at /plan/[token].
To dispatch an automated confirmation email containing your private access link (only if an email was supplied).
To initiate communication regarding your scope review and project milestone schedule via WhatsApp.
We do not sell, rent, or trade your contact information to any third-party marketing broker.

3. Infrastructure & Third-Party Processors

Digital WebACE utilizes cloud providers meeting industry security certifications:

Database & Storage:Neon Serverless PostgreSQL (managed relational database storage).

Rate Limiting & Abuse Prevention:Upstash Redis (in-memory rate limiting and temporary token caches).

Bot Defense:Cloudflare Turnstile (privacy-preserving human verification).

Email Delivery:Resend (transactional plan notifications).

4. Cookies & Browser Storage

Digital WebACE does not employ cross-site tracking cookies, third-party analytics pixels, or ad networks. We use client-side browser storage strictly for functional application state (e.g. your local sandbox menu editor experiments, which are discarded upon page reload).

5. Data Retention Policy

We retain information only as long as necessary to fulfill the purpose for which it was collected:

Active Scoping & Contracted Clients: Records and private plans are maintained throughout the active discovery, build, and warranty period.
Unpursued Inquiries: Build plan records and contact information that do not proceed to an active engagement are scheduled for routine purge after 90 calendar days.
Immediate Removal: You may request immediate deletion at any time via our privacy desk below.

6. Your Rights & Data Deletion Requests

Under Nigerian data privacy regulations, you retain full rights to inspect, update, or permanently delete your lead record and generated build plan. To request immediate deletion of your submitted data:

Direct Privacy Desk: privacy@digitalwebace.comTurnaround: Requests are acknowledged within 24 hours and records permanently expunged from the active database.