1. Who we are
Biojet Nigeria Limited is the data controller for personal data processed through Biojet Node. We are a company incorporated in Nigeria. Contact us at privacy@biojetnode.com or hello@biojetnode.com.
2. What we collect and why
- Account data. Email, name, and authentication metadata via Clerk. Used to give you access to your subscription and to keep your account secure.
- Payment data. Billing details captured by Stripe. We do not see or store full card numbers. We retain invoice and transaction records.
- Usage data. Aggregated page views and request metadata via Vercel Analytics, when you have consented. Used to understand which pages are read.
- Assistant content. Prompts you submit to the research assistant are processed by OpenAI and (optionally) Anthropic for inference. We do not use prompt content to train third-party models.
- Newsletter data. Email and display name if you subscribe to the weekly brief. Used to deliver the brief and to measure deliverability.
3. Legal bases (for users in the EU, UK, and Nigeria)
- Contract. To provide the service you signed up for (account, subscription, brief delivery).
- Legitimate interest. Securing the service, preventing abuse, and understanding aggregate usage.
- Consent. Optional analytics cookies and newsletter subscription.
- Legal obligation. Retaining payment and tax records under Nigerian law and any applicable foreign law.
4. Processors and where data is held
We use the following processors. Each is bound by a data processing agreement and, where applicable, standard contractual clauses for transfers out of the EU / UK.
| Processor | Purpose | Location | Data categories |
|---|---|---|---|
| Vercel Inc. | Application hosting, edge delivery, analytics | United States | IP address, request metadata, page views |
| Supabase Inc. | Database, authentication storage, vector embeddings | United States | Account records, application content |
| Clerk Inc. | User authentication and session management | United States | Email, name, login metadata |
| Stripe, Inc. | Subscription billing and payment processing | United States | Billing details, payment method (tokenized) |
| OpenAI, L.L.C. | Language model inference, text embeddings | United States | Prompt content submitted to the assistant |
| Anthropic, PBC | Language model inference (fallback / specialised tasks) | United States | Prompt content submitted to the assistant |
| Resend / Yahoo SMTP | Transactional email and newsletter delivery | United States | Email address, display name, send/open events |
5. Cookies
We use a small number of cookies. Essential cookies are required for authentication and payment. Analytics cookies are optional and managed via the cookie banner shown on your first visit. See the Cookie Policy for the full list and how to change your choice later.
6. Your rights
Under the Nigeria Data Protection Act 2023 (NDPA), and under the GDPR / UK GDPR where applicable, you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate or incomplete data.
- Request deletion of your account and associated data.
- Receive a portable export of your data.
- Object to or restrict certain processing.
- Withdraw consent at any time without affecting prior processing.
- Lodge a complaint with the Nigeria Data Protection Commission or your local supervisory authority.
To exercise any of these rights, email privacy@biojetnode.com. We respond within 30 days.
7. Retention
- Account data. Held until you delete the account. On deletion, identifiers are removed within 30 days; backups cycle out within 90 days.
- Payment records. Retained for 7 years to comply with Nigerian tax and accounting law.
- Newsletter records. Held until you unsubscribe. Unsubscribe links appear in every brief.
- Assistant prompts. Held for the duration needed to deliver the response and for short-term quality monitoring, then aggregated or deleted.
8. International transfers
Our processors are mostly located in the United States. For users in the EU and UK, we rely on the European Commission’s standard contractual clauses (SCCs) and equivalent UK addendum. For users in Nigeria, transfers occur subject to the safeguards required by the Nigeria Data Protection Act 2023 (NDPA).
9. Security
We use TLS for all traffic, principle-of-least-privilege access to production systems, and review access logs for unusual activity. No system is impenetrable; if a breach affects your data, we will notify you and the relevant authority within the timeframes required by law.
10. Children
Biojet Node is not directed at children under 16 and we do not knowingly collect personal data from anyone in that age group. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. Material changes will be announced by email to subscribers or via a banner on the site at least 30 days before they take effect. The “last updated” date at the top of this page reflects the most recent revision.
12. Contact
Biojet Nigeria Limited · privacy@biojetnode.com (privacy enquiries) · hello@biojetnode.com (general)