Legal
Privacy Policy
1. Who we are
[CYBERBRACE SYSTEM & TECHNOLOGY LTD], RC [NUMBER], Lagos, operates Brace Builder and is the data controller for the personal data described here. Data Protection Officer: [NAME], privacy@bracebuilder.com.
2. What we collect
- Account: name, email, password (stored hashed, never readable by us), and phone if you add one.
- Your sites: the content, photos and settings you add.
- Billing: plan, amounts, payment references and status. Card numbers are handled by Monnify and never reach us. If you opt in to automatic renewal we keep only Monnify's card token and the card type and last 4 digits.
- Payouts (Brace Builder payments): bank, account number and the account name returned by the bank.
- Your own Monnify keys, if you connect them, stored encrypted.
- Technical data: IP address, browser and device, and security logs (sign-ins, failed attempts, security changes), kept up to 90 days to protect your account. We show you your own history on the Security page.
- If you sign in with Google: your name, email address and profile picture from Google. We don't get your Google password or access to your Gmail, Drive or contacts.
- Two-step verification: an encrypted authenticator secret and hashed backup codes.
3. Why we use it, and on what basis
- To provide your account, host your sites and process payments: performance of our contract with you.
- To send account, security, receipt and renewal messages by email: contract.
- To send renewal reminders on WhatsApp and to save your card for automatic renewal: your consent, which you can withdraw in Billing at any time.
- To prevent fraud, secure the Service and keep financial records: legal obligation and legitimate interests.
- To improve the product using aggregated usage: legitimate interests. We do not sell personal data and do not use it for advertising profiles.
4. Your customers' data
When people order from or fill a form on your site, we collect what they enter (such as name, phone, email, address and message) on your behalf. For that data you are the controller and we act as your processor: we use it only to run your site, process the payment and send receipts, and we show it to you in your dashboard. You are responsible for telling your customers how you use their data. When you use Brace Builder payments, we also process payment data as a controller to meet our own legal and fraud prevention obligations.
5. Who we share it with
Only service providers who help us run Brace Builder, under contracts that protect your data:
- Monnify (Moniepoint): payments, payouts and card tokens.
- Cloudflare: hosting, content delivery, security and photo storage.
- [DATABASE HOST]: our database.
- Brevo (Sendinblue): sending emails such as receipts, reminders and replies.
- Meta (WhatsApp): only if you opt in to WhatsApp reminders.
- Google: only if you choose "Continue with Google".
- Cloudflare Turnstile: a bot check on sign-up and sign-in that looks at browser signals, not personal profiles.
- Have I Been Pwned: when you choose a password we send only the first 5 characters of its hash to check it hasn't appeared in a data breach; your password never leaves our servers.
- Google Fonts: fonts on hosted sites, which means visitors' browsers request them from Google.
We may also disclose data when the law requires it, to protect people from harm or fraud, or as part of a merger or sale of the business with the same protections.
6. Transfers outside Nigeria
Some providers above process data outside Nigeria. Where that happens we rely on the safeguards permitted by the NDPA, such as contractual clauses and providers' security commitments.
7. How long we keep it
- Account and site data: while your account is open, then deleted within 30 days of closing it.
- Payment and invoice records: as long as tax and financial law requires, usually 6 years.
- Security logs: up to 90 days.
- Saved card token: until you turn off automatic renewal or your plan ends.
8. Your rights
Under the NDPA you can ask to access, correct, delete or receive a copy of your data, object to or restrict some uses, and withdraw consent at any time. Email privacy@bracebuilder.com and we will reply within 30 days. You can also complain to the Nigeria Data Protection Commission (NDPC).
9. Security
Data is encrypted in transit. Passwords are hashed, merchant payment secrets are encrypted at rest, customer sites run with a strict content security policy, and access to production data is limited to staff who need it. If a breach affects you, we will tell you and the NDPC as the law requires.
10. Cookies
The dashboard uses one essential cookie to keep you signed in. bracebuilder.com and hosted sites do not use advertising or tracking cookies. Hosted sites may store your cart in your browser so it survives a refresh.
11. Children
Brace Builder is for businesses and adults. We do not knowingly collect data from children under 18.
12. Changes and contact
We will post updates here and tell you about material changes by email or in your dashboard. Questions: privacy@bracebuilder.com.