What we collect, why, and how to ask for it back.
We believe privacy notices should be readable. Here's our plain-language version. If anything below is unclear, email privacy@waitlist.ng and we'll explain in plain English.
The short version
We collect the minimum we need to run the queues and waitlists you signed up for. We don't sell your data. We don't share it with advertisers. You can export or delete your data at any time from your account, or by emailing us.
What we collect
- Account data — your name, business name, email, phone number, and login method (magic link, Google, or phone OTP).
- Customer data (Flow OS) — names and phone numbers of people joining your queues, their position history, and their replies to your messages. This is your data — we store it on your behalf.
- Subscriber data (Prelaunch) — names, emails, phone numbers of people joining your launch waitlist, their referral source, and their rank position.
- Usage data — pages viewed, clicks, the rough region and device type used to access the dashboard. No third-party analytics; we use PostHog self-hosted and Plausible.
- Payment data — handled directly by Paystack, Flutterwave or Stripe. We never see your card number. We store only the reference, amount, and a subscription token.
How we use it
- To run the queue or waitlist you signed up for, including WhatsApp and SMS notifications.
- To bill you for paid plans, and to issue refunds.
- To detect fraud (fake referrals, repeated abuse) and protect the integrity of the leaderboard.
- To send critical service updates (security incidents, mandatory migrations). These are always opt-out.
- To improve the product. Aggregated, never per-customer.
Who we share with
- WhatsApp / SMS providers (Termii, Gupshup, Meta) — only to deliver the messages you ask us to send.
- Payment processors (Paystack, Flutterwave, Stripe) — to bill you. They each have their own privacy notice.
- Infrastructure providers (Vercel for hosting, Neon or Supabase for the database, Upstash for cache) — strictly to run the service.
- Law enforcement — only when we receive a valid Nigerian court order. We'll notify the affected customer unless legally prohibited.
We do not sell, rent, lease, or trade customer data. There are no advertising integrations.
Where the data lives
Primary storage is in regional cloud infrastructure (Africa-hosted where available, with EU fall-back). Backups are encrypted at rest, retained for 30 days, and then rotated. WhatsApp templates you create are stored in the same region.
How long we keep it
- Account data — for as long as your account is open, plus 30 days after deletion.
- Queue / waitlist data — as long as the workspace exists. You can export or delete it any time.
- Aggregated analytics — indefinitely, but stripped of identifiers.
- Payment records — 7 years (legal requirement under Nigerian tax law).
Your rights under NDPA
- Right to access — request a copy of your data.
- Right to correct — fix anything that's wrong.
- Right to delete — we'll delete it within 30 days unless we're legally required to keep it.
- Right to object — to any processing you didn't agree to.
- Right to portability — get your data as JSON or CSV.
To exercise any of these rights, email privacy@waitlist.ng. We respond within 5 working days.
Security
We use HTTPS everywhere, encrypt secrets at rest, scope API tokens to the minimum permissions needed, and run a published security disclosure program. If you find a vulnerability, please report it to security@waitlist.ng. We do not pursue legal action against good-faith security research.
Children
Waitlist is a business tool. We do not knowingly collect data from anyone under 18. If you're a school or parent and believe a minor's data has been collected, email privacy@waitlist.ng and we'll delete it.
Changes to this notice
If we make material changes, we'll email every active customer at least 14 days before the change takes effect. The exact diff will be on our GitHub.
Complaints
If we haven't handled your concern well, you can escalate to the Nigeria Data Protection Commission at ndpc.gov.ng.