Privacy Policy

Effective Date: 1 March 2026

1. Data Controller

Baci Technologies Limited ("we", "us", "Ekaette") is the data controller responsible for your personal data processed through this service. Contact: privacy@bacitechnologies.com

2. AI Disclosure

Ekaette is an AI-powered customer service assistant. When you interact with Ekaette via voice or text, you are communicating with an artificial intelligence system, not a human. You may request to speak with a human representative at any time.

3. What Data We Collect

Voice data: Audio streamed during calls for real-time processing. Audio is not stored after the session ends unless you opt in to call recording.
Conversation transcripts: Text transcriptions of voice interactions, retained for up to 90 days.
SMS content: Inbound and outbound SMS messages, retained for up to 30 days.
Contact information: Phone number, email address (when provided for bookings or orders).
Booking and order data: Appointment details, product selections, delivery addresses.
Device and session data: Browser type, session identifiers, connection timestamps.
Images: Photos uploaded for product identification or trade-in valuation.

4. Purpose and Lawful Basis

We process your data for the following purposes:

Service delivery: To provide AI-powered customer support, bookings, and product inquiries (legitimate interest / contract performance).
Communication: To send SMS replies and appointment confirmations (consent / contract performance).
Improvement: To improve AI response quality and service reliability (legitimate interest).
Security: To detect fraud and protect against unauthorized access (legitimate interest).

5. Data Retention

Voice call metadata: 90 days
SMS messages: 30 days
Booking records: duration of service relationship + 12 months
Session data: automatically purged on session end or within 24 hours

6. Your Rights

Under the Nigeria Data Protection Act 2023 (NDPA), you have the right to:

Access: Request a copy of your personal data.
Rectification: Correct inaccurate or incomplete data.
Erasure: Request deletion of your personal data.
Portability: Receive your data in a structured, machine-readable format.
Object: Object to processing based on legitimate interest.
Withdraw consent: Where processing is based on consent, withdraw at any time.

To exercise any of these rights, contact privacy@bacitechnologies.com.

7. Third-Party Services

We use the following third-party services to deliver Ekaette:

Google Cloud Platform: Infrastructure, AI model hosting (Gemini), Firestore database.
Africa's Talking: SMS and voice call delivery.
Paystack: Payment processing (card data handled entirely by Paystack; we do not store card numbers).

8. Cross-Border Data Transfers

Your data may be processed on servers located outside Nigeria (Google Cloud, US region). We ensure adequate safeguards through service provider data processing agreements and industry-standard security measures.

9. Security

We implement technical and organizational measures including:

Tenant-isolated data architecture (scoped Firestore queries)
Encryption in transit (TLS 1.3)
CORS allowlisting and webhook verification
PII redaction in application logs
Role-based access control for admin operations

10. SMS Opt-Out

To stop receiving SMS messages from Ekaette, reply STOP to any message. You can re-subscribe at any time by contacting us.

11. Complaints

If you believe your data rights have been violated, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via in-app notice. Continued use of the service constitutes acceptance of the updated policy.