Privacy notice

Shareroom is run by Bridgetech Academy Ltd (RC 8896403), Plot 5, Olayinka Balogun Crescent, Magodo, Lagos State, Nigeria. We are the data controller for the personal data described here.

For anything about your data, including the rights below, email our data protection officer at hello@shareroom.ng.

Phone number

To create your account, sign you in and send sign-in and reset codes. Lawful basis: Contract

Name and email

To set up your account, show your first name to other members and send the emails you choose. Lawful basis: Contract

Password

Stored only as a one-way hash. We can't read it. Lawful basis: Contract

ID check details

Your selfie and ID are checked by our ID provider. We keep the result, the ID type, the name on the record and only the last four digits of the ID number. Lawful basis: Your explicit consent, asked for before the check

Profile and preferences

Age band, occupation, areas, budget, lifestyle and similar details you add, to match you with rooms and housemates. Lawful basis: Contract

Adverts and photos

What you post, so people can find your room. The street address is shared only once a viewing is agreed. Lawful basis: Contract

Messages, viewings and reports

To run conversations and viewings, and to investigate scams and abuse. Lawful basis: Contract and our legitimate interest in keeping members safe

Payments

What you bought, when and the payment reference. Card details go to Paystack and never reach us. Lawful basis: Contract and legal obligation (tax records)

Devices and security

Your browser and the first part of your IP address for each sign-in, so you can see your devices and we can stop abuse. Lawful basis: Legitimate interest in keeping accounts secure

A selfie used for an ID check is biometric data, which the Act treats as sensitive. We only check it with your consent, and you can choose not to be checked; you'll still be able to search and message, but not post adverts or book viewings.

Other members see your first name, the checks you've passed and what you choose to put in adverts, room-wanted posts and messages.

Your phone number, email, ID details and a property's street address are never shown publicly. Our staff see them only when they need to, for example to review an ID check or a report. Staff access is limited by role and recorded.

We don't sell your data, and we don't share it for advertising. We share it with the police or a regulator only when the law requires it or to protect someone from serious harm.

Each one works under a contract that limits it to our instructions. Some store data outside Nigeria, including our main servers in Ireland. Where that happens we rely on the safeguards the Act requires for transfers abroad, such as the receiving country's data protection law or contract terms.

Your account and profile

Until you delete your account. Deleting it erases your name, email, phone number, password, photo and profile straight away.

Adverts

Taken down when you delete your account, and the street address is erased. A record stays for our team so reports can still be checked.

Messages

The other person keeps the conversation after you leave, without your name. Messages are kept for 2 years after the last one in a conversation.

ID check results

2 years after your account closes, to stop people who were removed for fraud from coming back.

Reports and moderation decisions

2 years after the case is closed.

Payment records

6 years, as Nigerian tax law requires.

Sign-in codes and reset links

Codes expire after 10 minutes and reset links after 30 minutes. We store only a hash of each.

Backups

Nightly copies of the database are kept for 30 days, then deleted.

Everything travels over encrypted connections. Passwords, codes and sign-in tokens are stored only as hashes, staff sign in with a second factor, and we never keep a full ID number. If a breach puts your data at risk, we'll tell the NDPC within 72 hours and tell you without delay.

We use cookies only to keep you signed in and to finish creating your account. We don't use advertising or tracking cookies, so there's nothing to opt out of.

Shareroom is for people aged 18 and over. We don't knowingly collect data about children, and an ID check that shows someone is under 18 fails and can't be tried again.

Under the Act you can ask us to:

• See the personal data we hold about you
• Correct anything that's wrong
• Have your data deleted
• Get a copy of your data in a format you can reuse
• Object to or limit how we use it, and withdraw consent you gave
• Ask for a person to look again at a decision made automatically, such as a failed ID check

You can download your data and delete your account yourself in Your data, and switch emails on or off in Email settings. For anything else, email hello@shareroom.ng; we reply within 30 days.

If you're not happy with how we've handled your data, you can complain to the NDPC at ndpc.gov.ng.

If we change how we use your data, we'll update this page and its date, and tell you by email or in the app before a significant change takes effect.