Loading…
Loading…
LEGAL / PRIVACY
Effective 28 September 2026. This policy explains what personal data TruxPylot collects, why we use it, who we share it with, how long we keep it, and your rights under the Nigeria Data Protection Act 2023.
TruxPylot is operated by Novini Tech Concepts, a business name registered with the Corporate Affairs Commission (CAC), under the Companies and Allied Matters Act 2020 (Business Name Registration No. 9200644), of 118 Giframari House, Eneka Road, Rumunuduru, Port Harcourt, Rivers State, Nigeria. We are the data controller for the personal data described in this policy.
For anything about your data, contact us at info@truxpylot.com.
| Type of data | Examples | Where it comes from |
|---|---|---|
| Account and contact | Name, email, phone number, date of birth, account type, password (stored only as a secure hash), sign-in method, your confirmation that you are 18 or older | You; Google if you sign in with Google |
| Provider profile | Business or trading name, services, prices, experience, portfolio, photos, the location you choose to show | You |
| Provider verification | Identity and trade documents, business registration details | You |
| Payout account | Bank name, account number, account holder name as confirmed by Paystack | You; Paystack |
| Requests and jobs | Description of the work, location, preferred date, quotes, job status, messages, files uploaded as job deliverables, reviews, problem reports and responses | You; the other party; TruxPylot staff |
| Payments | Paystack reference, amount, status, date, fees, and masked card or bank details returned by Paystack | Paystack |
| Security | Sign-in attempts, one-time-code events, 2-step verification status, device identifiers, IP address, security answers (stored only as a secure hash), suspension and appeal records | You; your device; our systems |
| Communications | Emails, support requests and notification preferences | You |
| Referrals | Referral codes and qualifying activity | You; our systems |
We do not set out to collect sensitive personal data such as health, religion or biometrics, except where it appears on an identity document you submit for verification.
| Purpose | Lawful basis |
|---|---|
| Create and run your account; connect Customers and Providers; open and manage Jobs | Performance of a contract |
| Review Provider documents for verification | Performance of a contract; legitimate interests (a safe marketplace) |
| Take payments, pay Providers, record refunds | Performance of a contract; legal obligation (financial records) |
| Verify payout accounts | Performance of a contract; legitimate interests (stopping misdirected payments) |
| Security, fraud and abuse prevention, rate limiting, account protection | Legitimate interests; legal obligation |
| Handle problem reports, support and complaints | Performance of a contract; legitimate interests |
| Service messages such as job updates, security alerts and receipts | Performance of a contract |
| Platform announcements | Legitimate interests. You can switch announcements off in your notification settings. |
| Confirm you are 18 or older, and send you a birthday message | Performance of a contract (minimum age); legitimate interests (the birthday message). Your date of birth is not shown on your profile. Switching announcements off also stops the birthday email. |
| Count page visits to improve TruxPylot (without cookies; see section 11) | Legitimate interests |
| Answer questions through the AI assistant | Legitimate interests; you choose what to type |
| Keep records, comply with the law and respond to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details.
We do not make decisions with legal or similarly significant effects about you solely by automated means. Payouts, refunds, completing a Job after the confirmation period and document approvals are all decided by TruxPylot staff. Automatic rate limits and sign-in lockouts are temporary security measures, and you can ask us to review them.
Other users. Customers see a Provider’s public profile. When TruxPylot opens a Job, the Provider sees the Customer’s name and the details needed to quote and do the work. Public reviews show the Customer’s first name and last initial. Providers’ phone numbers and verification documents are not shown on public profiles.
Jobs managed by TruxPylot. When TruxPylot runs a job for you, the Professional sees your first name and last initial, and the job details our team gives them. All in-app messages are between you and TruxPylot Support: customers and professionals do not message each other on TruxPylot. TruxPylot staff can read all messages on a managed job.
Examples of our work. TruxPylot may use short excerpts of a managed job’s conversation, as an image with phone numbers, e-mail addresses and links removed, as proof of a completed job or in our marketing. We show names only with the permission of the people named; otherwise names are replaced with “Client” and “Professional”.
Service providers who process data on our instructions:
| Provider | What they do for us |
|---|---|
| Paystack | Payments, bank account checks and payouts |
| Supabase | Sign-in, database and file storage |
| Vercel | Website hosting |
| Resend | Transactional email |
| OpenAI | The AI chat assistant |
| Optional “Sign in with Google” |
Others: our professional advisers, such as lawyers and auditors; law enforcement, regulators or courts where the law requires it or to protect people’s rights and safety; and a buyer or successor if TruxPylot’s business is transferred, subject to this policy.
TruxPylot does not save your chat conversations. What you type is sent to OpenAI to generate a reply, with storage for model training switched off; OpenAI handles it under its own terms. Do not type sensitive personal information into the chat.
Some of our service providers store or process data outside Nigeria. Where they do, we rely on a transfer basis permitted by the Nigeria Data Protection Act, such as appropriate contractual safeguards, and require appropriate security.
| Data | How long |
|---|---|
| Account and profile | While your account is open. When it is deleted, your sign-in is removed, your email, phone and Google sign-in are released, your saved bank details are removed, and your profile, photos, services and portfolio are erased. Your name is kept only where past jobs and payments refer to it. |
| Verification documents | While your account exists, and 1 year after it is deleted, then deleted automatically. Kept longer only while there is an open report against the Provider. |
| Jobs, payments, refunds, payouts and commission records | At least 6 years from the transaction, as financial and tax records |
| Files uploaded to a job managed by TruxPylot (designs, documents, videos and other work) | 30 days after upload, then deleted automatically |
| Records of jobs managed by TruxPylot: client, professional, service, status, assignments, approvals, completion and job messages | Kept as the permanent record of the job, for accountability, disputes and proof of completed work |
| Problem reports and complaints | At least 6 years from resolution |
| Sign-in and security logs | 12 months, then deleted automatically |
| Rate-limit counters | Up to 1 day after the limit period, stored only as one-way hashes |
When a retention period ends, we delete or anonymise the data.
Under the Nigeria Data Protection Act 2023 you can:
To make a request, email info@truxpylot.com from the email address on your account. We may need to confirm your identity. We will respond within 30 days, and tell you if we need more time and why.
Some data must be kept for legal, financial or security reasons even after a deletion request. For example, the payment record of a Job cannot be deleted. We will tell you what we keep and why.
We use technical and organisational measures including encrypted connections, hashed passwords and security answers, mandatory 2-step verification for administrators, ending sessions on sign-out and password change, private storage for verification documents, masked payout details, audit logs of financial actions, and rate limiting. No system is perfectly secure.
If a personal data breach is likely to put your rights at risk, we will notify the NDPC within the time the law requires and tell you without undue delay.
We use only cookies that are strictly necessary: to sign you in, keep your session secure and recognise trusted devices. We do not use advertising or analytics cookies. If that changes, we will ask for your consent first.
To understand how TruxPylot is used, we count page visits ourselves, without cookies and without any outside analytics service. For each visit we record the page, where the visit came from (for example a search engine or a link), your approximate country, state and city, and the type of device and browser. Your IP address is used only to make an anonymous code that changes every day, and it is not stored. In the TruxPylot app, a yes/no flag on your device lets us count the app’s first launch.
If you turn on push notifications, we store a technical address for your device from your browser or from Google’s Firebase service, so we can send you the same notifications you see in your dashboard. You can turn them off at any time in Settings → Notifications or in your phone’s settings.
TruxPylot is for people aged 18 and over, and everyone creating an account must confirm they are 18 or older. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
We will post changes here and update the effective date. If a change is material, we will also tell you by email or on the Platform before it takes effect.
Novini Tech Concepts (Business Name Registration No. 9200644)
118 Giframari House, Eneka Road, Rumunuduru, Port Harcourt, Rivers State, Nigeria
Email: info@truxpylot.com · Phone / WhatsApp: +234 805 430 6905
See also our Terms of Service.
How it works · Pricing · Advertise · Payments & disputes · Trust & safety · FAQ · Support · Terms