Privacy Policy

IweApps is booking software for service businesses. Businesses use it to create a workspace, publish a service menu, organise staff, and take bookings from their own customers online. It is offered at iweapps.com.

This policy applies to the IweApps website, the business dashboard, and the public booking pages we host on behalf of businesses using the Service. It covers two different groups of people, and the difference matters a great deal — see the next section.

IweApps handles two categories of information, and our responsibilities are not the same for each.

• Information about businesses that use IweApps. When you register an account, create a workspace, and set up your services, we decide how that information is used. We are the data controller for it, and this policy describes what we do.
• Information about a business’s own customers. When someone books an appointment, a table, a room, or a ride through a business’s booking page, that booking belongs to the business. The business decides why it is collected and what happens to it. We only store and process it on that business’s instructions, as their data processor.

Account information. To create an account we ask for an email address and a password, and nothing else. We do not ask for your name at sign-up. Your password is never stored in a readable form — only a cryptographic hash of it is kept, which cannot be reversed back into your password. We also record your account status and the times your account was created and last updated.

Workspace information. When you set up a business you provide a business name, a URL for your booking page, and optionally a description, a contact email address, a contact phone number, and a timezone. You also tell us your type of business — currently nail technician, restaurant, hotel, or transport — which determines which features your dashboard shows.

Service catalogue. The services you offer, along with their descriptions, durations, prices, and currency, and whether a service is active or archived.

Team information. The people you invite to your workspace, the roles you assign them, and the permissions those roles carry.

Booking information. Details your customers submit when booking with you, held on your behalf as described above.

Technical information. Our servers record standard request data — IP address, browser and device type, pages requested, and timestamps — which we use to keep the Service running, to enforce rate limits, and to investigate abuse and security incidents.

Being specific about this is more useful than a long list of what we might collect.

• No card or bank details. IweApps does not process payments and has no payment provider connected. Money between a business and its customers is handled entirely outside the Service.
• No advertising or analytics trackers. We run no third-party analytics, no advertising pixels, and no cross-site tracking.
• No sale of personal information. We do not sell, rent, or trade personal information, and we do not share it with data brokers or advertisers.
• No special-category data by design. We do not ask for health, biometric, religious, or similar sensitive information. Please do not enter it into free-text fields such as service descriptions or booking notes.

IweApps uses one cookie, and it exists purely to keep you signed in. There are no analytics, advertising, or tracking cookies, which is why you are not asked to accept a cookie banner.

• Session refresh cookie. Set when you sign in and marked HttpOnly, so JavaScript on the page cannot read it. Its path is restricted to our authentication endpoints, so the browser only sends it where it is needed. It lets you stay signed in across page reloads, and it is replaced with a fresh value each time it is used.
• Access token. Held only in your browser’s memory for the duration of the tab. It is never written to a cookie or to local storage, and it disappears when you close or reload the tab.

Signing out clears both. Blocking the session cookie will prevent you from staying signed in.

Under the Nigeria Data Protection Act 2023 (NDPA) we must have a lawful basis for each use. Ours are:

• To provide the Service — creating your account, running your workspace, publishing your booking page, and storing your bookings. Basis: performance of our contract with you.
• To keep the Service secure — authenticating sign-ins, enforcing rate limits, isolating each workspace’s data, and investigating abuse. Basis: our legitimate interest in a secure platform.
• To support you — responding when you contact us and sending essential notices about your account or material changes to the Service. Basis: performance of our contract and our legitimate interests.
• To improve the Service — understanding which features are used and where errors occur, using aggregated and operational data. Basis: our legitimate interests.
• To meet legal obligations — where the law requires us to retain or disclose information. Basis: legal obligation.

We will not send you marketing email without your consent, and any marketing we do send will include a way to unsubscribe.

Your booking page is public by design — that is the point of it. Your business name, your chosen URL, your description, your service names, durations, and prices, and any contact details you add to your public profile can be viewed by anyone with the link and may be indexed by search engines. Treat those fields as published information and do not put anything private in them.

We share information only in these situations:

• Service providers. Companies that host our infrastructure, store our database, and deliver our transactional email. They act on our instructions, may only use the information to provide their service to us, and are bound by confidentiality obligations.
• Within your workspace. Information in a workspace is visible to the members of that workspace according to the roles and permissions its owner has assigned.
• Legal requirements. Where we are required to disclose information by law, by a court, or by a competent regulator, or where disclosure is necessary to protect our rights, safety, or property, or those of our users or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.

Security measures built into the Service include:

• Passwords stored only as irreversible cryptographic hashes.
• Encryption in transit using HTTPS across the site, the dashboard, and the API.
• Workspace isolation, so each business’s data is separated at the data layer and requests are checked against the workspace they claim to belong to.
• Role-based access control, so members only reach the features their assigned permissions allow.
• Short-lived access tokens kept in memory, paired with a session credential that is replaced every time it is used, limiting the value of any single intercepted token.

No online service can promise perfect security. If we become aware of a breach affecting your personal information, we will notify you and the Nigeria Data Protection Commission (NDPC) as required by law.

• Account and workspace data — for as long as your account is open.
• After you close your account — deleted or irreversibly anonymised within 90 days, except where we must keep it longer to comply with a legal obligation or to resolve a dispute.
• Booking data — retained for as long as the business that collected it maintains its workspace, and deleted on that business’s instruction.
• Security and request logs — typically kept for up to 12 months.
• Backups — deleted data may persist in encrypted backups for a short period before those backups expire on their normal cycle.

Under the Nigeria Data Protection Act 2023 (NDPA), and under comparable laws elsewhere, you have the right to:

• Ask what personal information we hold about you and get a copy of it.
• Have inaccurate or incomplete information corrected.
• Ask us to delete your information where there is no overriding reason to keep it.
• Ask us to restrict how we use your information while a concern is resolved.
• Receive information you gave us in a portable, machine-readable format, or ask us to transfer it.
• Object to processing based on our legitimate interests, including any direct marketing.
• Withdraw consent at any time, where we relied on your consent.

Write to privacy@iweapps.com to exercise any of these. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not disclose your information to someone else. There is no charge for a reasonable request.

If you are unhappy with our response, you may complain to the Nigeria Data Protection Commission (NDPC) or to the data protection authority where you live.

Our infrastructure and service providers may store and process information in countries other than Nigeria. Where information is transferred outside Nigeria, we take the steps required by the Nigeria Data Protection Act 2023 (NDPA) to make sure it remains protected to an equivalent standard, including using providers that offer appropriate contractual safeguards.

IweApps is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 18 in the course of providing accounts. If you believe a child has given us personal information, contact privacy@iweapps.com and we will delete it. Where a business uses the Service to take bookings that may involve minors, that business is responsible for obtaining any consent its own laws require.

We may update this policy as the Service develops. The date at the top always shows the current version. If a change materially affects your rights or how we use your information, we will give you notice by email or in the dashboard before it takes effect. Continuing to use IweApps after a change takes effect means you accept the updated policy.

Questions about this policy, or about how your information is handled, can go to privacy@iweapps.com. For anything else, including support, write to support@iweapps.com.

IweApps · iweapps.com