Izini RegTech LTD

Last updated: 27 October 2026

Last Updated: 20 October 2026

1. Introduction & Statutory Reference

This Privacy Policy explains how Izini RegTech Ltd ("Izini", "we", "us" or "our") collects, uses and protects personal data when you visit www.izini.ng, ask us for a website check, sign up for our emails, or use app.izini.ng. It follows the Nigeria Data Protection Act (NDPA) 2023 and the General Application and Implementation Directive (GAID) 2025 of the Nigeria Data Protection Commission (NDPC), which oversees data protection in Nigeria.

This policy is our privacy notice for every form on our websites, including the website check form at www.izini.ng/pilot.

2. Data Controller Identity

The data controller responsible for the processing described in this Privacy Policy is Izini RegTech Ltd, RC/CAC number RC-9700347, Lagos, Nigeria. Website: https://www.izini.ng.

3. Privacy Contact

For any question or request about your privacy or this policy, write to privacy@izini.ng. We have not appointed a Data Protection Officer.

4. Categories of Personal Data & Sources

4.1. Personal data you give us

Full name or first name, email address and phone number
Job title, team role or role, and organisation, company or business name
Password (stored only as a hash) and two-factor authentication factor
Card details (last four digits, card type, bank and expiry only; full card numbers are entered only on Paystack checkout) and transaction records
Chat and email messages
For a demo: team size and what you want the demo to cover
For DPCO partners: DPCO licence number and dates, and partner role
For a website check: the website address you ask us to check, your type of business and sector, your role, any notes you add, and whether you asked to join the pilot
Your choice about marketing emails, with the date, time and version of the form
For founding members and pilot users: setup notes, check-in notes and feedback

4.2. Personal data collected automatically or technically

IP address, browser and device details, browser user-agent string, and language, country and region
In-app activity logs, user and organisation IDs, error reports and session replays (screen text masked), API request logs, system logs and server logs
Cookie and ad IDs, a random device ID, your cookie choices and their times, and pages visited, clicks and session recordings on www.izini.ng (typing is hidden)
The document, version and time when you accept our Terms of Use or Data Processing Agreement
How you reached us, when you ask for a website check: the source, medium, campaign and content tags (UTM tags) of the web address you clicked
For marketing emails: the record of when you gave or withdrew consent, and whether you opened or clicked our emails (only if tracking is switched on)

5. Purposes of Processing & Lawful Basis (Section 25)

We process personal data for the following purposes, on the lawful bases in Section 25(1) of the NDPA 2023:

Account holders (customer administrators, team members, partner users): create and operate Izini accounts, including registration, sign-in, two-factor authentication, roles, project access and team management.
- Lawful basis: Contract Performance (Section 25(1)(b)(i))
Account holders: keep evidence of who accepted which version of the Terms of Use and the Data Processing Agreement, and when.
- Lawful basis: Legitimate Interests (Section 25(1)(b)(v)): proving the contract and defending claims.
- Right to object: you can object to this processing under Section 36 by writing to privacy@izini.ng.
Paying customers: charge subscriptions, record payments, issue invoices and manage plan, trial and renewal status.
- Lawful bases: Contract Performance (Section 25(1)(b)(i)); Legal Obligation (Section 25(1)(b)(ii)) for tax and accounting records
Account holders and partner users: send service messages (billing and subscription notices, legal-update notices, DPO reminders, breach-clock alerts, partner and security notices, sign-in and password emails) and in-app notifications. These are service messages. Marketing emails are sent only if you agreed to them (see "People who sign up to hear from us" below).
- Lawful basis: Contract Performance (Section 25(1)(b)(i))
Account holders: answer support questions sent by in-app chat and email.
- Lawful basis: Contract Performance (Section 25(1)(b)(i))
Website visitors: answer questions sent by live chat on www.izini.ng, by email or by WhatsApp.
- Lawful basis: Legitimate Interests (Section 25(1)(b)(v)): answering the questions you send us.
- Right to object: you can object to this processing under Section 36 by writing to privacy@izini.ng.
Prospective customers: arrange and hold product demos they ask for.
- Lawful basis: taking steps at your request before entering into a contract (Section 25(1)(b)(i))
People who ask for a free NDPA website check: run the check, send the report, and follow up about it. We scan only the public pages of the website you give us; we do not log in to it. A person at Izini reviews the website's cookie banner and privacy policy. We never publish or share the results. We send the report by email, and at most one follow-up email, only to check you received it and to answer questions about it. If you ask to join the pilot, we contact you about it. We don't send you marketing emails unless you tick the box.
- Lawful basis: taking steps at your request before entering into a contract (Section 25(1)(b)(i))
Seeing which posts and adverts bring requests. When you ask for a website check, we record which link brought you, taken from the web address you clicked (its UTM tags). We don't use tracking cookies for this.
- Lawful basis: Legitimate Interests (Section 25(1)(b)(v)): knowing which of our posts and adverts bring requests.
- Right to object: you can object to this at any time (Section 36) by writing to privacy@izini.ng.
People who sign up to hear from us: send Izini's monthly update (plain-English NDPA news and product updates) and occasional offers. You sign up by ticking the box on the website check form and then confirming your email address. The countries these providers store data in may not protect it in the same way Nigerian law does, and the Nigeria Data Protection Commission has not assessed them (see Section 8).
- Lawful basis: Consent (Section 25(1)(a)); consent is required for direct marketing under GAID 2025 Art. 18(1)(a).
- You can withdraw consent at any time with the unsubscribe link in every email, or by writing to privacy@izini.ng. Withdrawing doesn't make the emails we sent before you withdrew unlawful (Section 26(5)).
Keeping a "do not email" list after you unsubscribe, so we don't email you again by mistake.
- Lawful basis: Legal Obligation (Section 25(1)(b)(ii)). Section 36(4) says that once you object to direct marketing, your personal data "shall no longer be processed for such purposes", and the list is how we keep to that.
Founding members and pilot users: set up the account with you, hold check-ins and collect feedback.
- Lawful basis: Contract Performance (Section 25(1)(b)(i))
Website visitors: measure how www.izini.ng is used and improve it. The countries these providers store data in may not protect it in the same way Nigerian law does, and the Nigeria Data Protection Commission has not assessed them (see Section 8).
- Lawful basis: Consent (Section 25(1)(a)), given in the cookie banner
Website visitors: record each visitor's cookie choices on www.izini.ng, apply them, and be able to prove consent.
- Lawful basis: Legal Obligation (Section 25(1)(b)(ii)): the controller must be able to prove consent (Section 26(1)).
All users and visitors: protect the service through rate limiting, error monitoring, audit trails, API request logs, system logs and server logs.
- Lawful basis: Legitimate Interests (Section 25(1)(b)(v)): keeping the service secure and working.
- Right to object: you can object to this processing under Section 36 by writing to privacy@izini.ng.
Licensed DPCO partners and their users: onboard partners, check licences and run partner accounts.
- Lawful basis: Contract Performance (Section 25(1)(b)(i))
Account holders: count feature use (AI, scans, uploads, API calls) to enforce plan limits.
- Lawful basis: Contract Performance (Section 25(1)(b)(i))

6. Cookies & Tracking Technologies

Cookies are small text files a website places on your device. We use them on www.izini.ng and app.izini.ng to make the sites work, remember your choices and, if you allow it, measure how the marketing site is used. You can change your choices at any time in our cookie banner, or block or delete cookies in your browser settings. Blocking some cookies may stop parts of the sites from working.

Google Analytics loads only once you allow analytics in the cookie banner. Until then, nothing is sent to Google and no Google Analytics cookies are set.

Cookie Name	Category	Provider	Duration	Purpose
_hjSession_6697940	analytics_storage	Hotjar	session	A cookie that holds the current session data. This ensures that subsequent requests within the session window will be attributed to the same Hotjar session.
izini_theme	functionality_storage	Izini	Until cleared	Remembers the light or dark theme on www.izini.ng.
izini_active_project	functionality_storage	Izini	1 year	Remembers the project selected in the dashboard.
sb-pfsbwzxvzqpougyiczpp-auth-token	strictly_necessary	Izini (Supabase Auth)	400 days	Keeps a user signed in to app.izini.ng. May be split into numbered parts (.0, .1).
izini_locale	functionality_storage	Izini	365 days	Remembers the language the visitor chose for the cookie banner.
izini_user_id	strictly_necessary	Izini	365 days	For user identification
izini_consent	strictly_necessary	Izini	365 days	Stores the visitor's cookie choices.
cw_conversation	functionality_storage	izini.ng	12 month(s)	Stores the user's chat conversation history.
_hjSessionUser_6697940	analytics_storage	Hotjar	12 month(s)	Hotjar cookie that is set when a user first lands on a page with the Hotjar script. It is used to persist the Hotjar User ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_ga_6YFLRH40S7	analytics_storage	Google Analytics	1 year(s)	ID used to identify users
_ga	analytics_storage	Google Analytics	1 year(s)	Primary cookie used by Google Analytics to distinguish unique users by assigning a randomly generated number as a client identifier. It is used to calculate visitor, session and campaign data for the sites analytics reports.
_hj	analytics_storage	Hotjar	session	A cookie that holds the current session data. This ensures that subsequent requests within the session window will be attributed to the same Hotjar session.

7. Third-Party Recipients & Sub-Processors

We share personal data with the following recipients, for the purposes in Section 5:

Supabase (database and authentication): holds our database and sign-in, including accounts, billing records, consent records, logs and website check requests.
Hosting provider (Canada): hosts our servers, including our live chat.
Email hosting provider: holds our mailboxes, for questions you send us by email.
Resend (email delivery): sends our service emails, and the website check form's emails (the confirmation to you and our notice of your request), from hello@izini.ng.
HubSpot (customer relationship management): keeps a contact and a request record for each website check request, the link that brought you, your marketing choice and its date, the "do not email" record, and our contact with founding members and pilot users. Our HubSpot account is in HubSpot's EU data centre.
EmailOctopus (email marketing): sends the monthly update and offers, only if you ticked the box and confirmed your email address. It receives your email address only, and keeps the record that you unsubscribed.
Cloudflare (network and content delivery): delivers and protects our websites, and works out the country for cookie consent records.
Sentry (error monitoring): monitors errors to keep the service stable.
Paystack (payments): processes payments and subscriptions.
Google Analytics and Hotjar: measure how our marketing site is used, only if you allow analytics.
Google Fonts: displays fonts on our marketing site.
Typeform: runs our demo request form.
WhatsApp (Meta), a separate controller: carries the questions you send us on WhatsApp. Meta processes that data under its own privacy policy.

8. International Data Transfers (Sections 41-43)

Some of the providers in Section 7 store personal data outside Nigeria:

Supabase: Switzerland.
Hosting provider: Canada.
Email hosting provider: mainly the United States; also Australia, Finland, Germany and the Netherlands.
Resend: the United States.
HubSpot: HubSpot's EU data centre. HubSpot's data processing terms also allow HubSpot, Inc. to process data in the United States, and its affiliates and sub-processors to process it where they operate.
EmailOctopus: Amazon Web Services in the European Union, primarily Ireland.
Paystack: Ireland (Amazon Web Services), with some of its providers in the United States.
Typeform: the United States.
Sentry: Germany (error events) and the United States (account data).
Cloudflare: its global network, with logs in the United States and Europe.
Google Analytics: the United States and other countries where Google operates.
Hotjar: Ireland.
Google Fonts: Not recorded.

The ground we rely on for each transfer (Sections 41(1) and 43(1)):

To provide the service to you, when you hold or open an account or ask us for something (accounts and sign-in, hosting, billing and payments, support, service emails and notifications, demo requests, the website check, the DPCO partner programme, and founding members and pilot users): the transfer is necessary for the performance of a contract to which you are a party, or in order to take steps at your request, prior to entering into a contract (Section 43(1)(b)).
Marketing emails (EmailOctopus and HubSpot) and website analytics (Google Analytics and Hotjar, which run only if you allow analytics in the cookie banner): your consent (Section 43(1)(a)). The countries these providers store data in may not protect it in the same way Nigerian law does, and the Nigeria Data Protection Commission has not assessed them. You can withdraw your consent at any time (Section 35).
Keeping the service secure, records of your cookie choices and the "do not email" list: the protection in each provider's contract (Section 41(1)(a)).

9. Data Retention

We keep personal data only as long as each purpose needs it. Where a law sets a period, we use it. Where none does, we delete personal data no later than 6 months after the purpose is accomplished (GAID Art. 49(3)). We keep data longer only for the defence of a legal claim or due diligence (GAID Art. 49(4)). The periods are:

Accounts: while the account is open. After access ends: 30 days to export, then deleted within a further 60 days (Terms 18.5). Team members an admin removes are deleted at once.
Records of accepting the Terms of Use and the Data Processing Agreement: 6 years after the account ends, the limitation period for contract claims (Lagos Limitation Law s.8(1)(a); GAID Art. 49(4)).
Billing: invoices and payment records: 6 years after the end of the tax year they relate to (Nigeria Tax Administration Act 2025 s.31(5); CAMA 2020 s.375(2)). Raw Paystack event payloads: 6 months after the payment is reconciled (GAID Art. 49(3)). Paystack keeps its own transaction records under its own legal duties.
Service messages: email delivery log: 45 days (message bodies are not stored). In-app notifications: 30 days. Resend keeps email data for 30 days.
Support questions: 6 months after the conversation is resolved, unless needed for a legal claim (GAID Art. 49(3)-(4)).
Website enquiries (live chat, email, WhatsApp): 6 months after the conversation ends (GAID Art. 49(3)).
Demo requests: 6 months after the last contact if no contract follows (GAID Art. 49(3)).
Free website check requests (no account opened): 6 months after we send the report or last hear from you, whichever is later (GAID Art. 49(3)). Then we delete your details from HubSpot. Our own copy of your request is deleted from our database 30 days after it reaches HubSpot. The record of the link that brought you is kept and deleted with the request.
Marketing emails: until you unsubscribe. After that, we keep only your email address on a "do not email" list, so we don't email you again by mistake. We keep it there until you ask us to remove it; if you do, we can no longer check new sign-ups against it. Separately, we keep the record of when you gave and withdrew consent for 6 months after you unsubscribe (GAID Art. 49(3)), or longer only if we need it for a legal claim (GAID Art. 49(4)).
Founding members and pilot users: as for accounts above. Feedback notes are kept for the length of the pilot plus 6 months (GAID Art. 49(3)).
Website analytics: Google Analytics: 2 months. Hotjar: up to 365 days.
Cookie choices on www.izini.ng: while the choice is in force (the banner cookie lasts up to 12 months), plus 6 months (GAID Art. 49(3)): at most 18 months from the choice.
Security and service logs: rate-limit records: about 1 day. API request log: 30 days. AI usage log: 45 days. Audit and system logs: 12 months. Sentry: 30 or 90 days by plan. Cloudflare Workers logs: 3 to 7 days. Supabase logs: 1 day.
DPCO partners: for the partnership, plus 6 years for contract claims (Lagos Limitation Law s.8(1)(a)).
Plan limits and usage: AI usage log: 45 days. Usage counts are kept with the account and deleted with it.

Once personal data is deleted at the end of its retention period, it can no longer be provided in response to an access request.

10. Security of Personal Data (Section 39)

We use technical and organisational measures to protect personal data from unauthorised access, alteration, disclosure or destruction, as Section 39 of the NDPA 2023 requires. They include:

Audit logging
Encryption at rest
Encryption in transit (TLS)
Role-based access control
Two-factor authentication

11. Automated Decision-Making & AI Transparency (Section 37)

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Section 37).

12. Protection of Children's Personal Data (Section 31)

Our services are not directed at children, and we do not knowingly process children's personal data. If we learn that we have collected a child's personal data without the consent of a parent or legal guardian (Section 31), we will delete it promptly.

13. Data Subject Rights (Sections 34-38)

Under the NDPA 2023 you have the following rights:

Access to information about the processing (Section 34(1)(a)): to know whether and how we process your personal data.
A copy of your personal data (Section 34(1)(b)).
Rectification (Section 34(1)(c)): to have inaccurate, out-of-date, incomplete or misleading personal data corrected.
Erasure (Section 34(1)(d)): to have your personal data erased without undue delay.
Restriction of processing (Section 34(1)(e)): while a request or objection is resolved, or for legal claims.
Withdrawal of consent (Section 35): where we rely on your consent, you can withdraw it at any time. This does not affect processing before you withdrew.
Objection (Section 36): including at any time to direct marketing.
Not being subject to solely automated decisions (Section 37).
Data portability (Section 38): to receive your personal data in a structured, commonly used and machine-readable format, and to transmit it to another data controller.

To stop marketing emails, use the unsubscribe link in any email or write to privacy@izini.ng.

To exercise any of these rights, write to privacy@izini.ng. We answer requests without undue delay.

14. Grievance Redress & Escalation

If you have a complaint about how we process your personal data, please contact us first at privacy@izini.ng. We will look into it and reply.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC): https://ndpc.gov.ng.