Legal

Privacy Policy

Last updated: October 2026

1. Who we are

SmartRR is run by Big Family 360 Foundation ("BF360", "we"), the data controller. Contact: info@smartrrapp.org, Barracks Road, Jimeta, Yola, Adamawa, Nigeria. This policy follows the Nigeria Data Protection Act 2023 (NDPA).

2. What we collect

  • Report details: language, incident category, state (and local government area and a description on WhatsApp and the app), and the time of the report.
  • Phone number: the number you report from. We store a salted one-way hash for abuse and duplicate detection. The raw number is kept only on the server so we can send confirmations, and is never shown publicly or to institutions.
  • App users: account details you provide, and approximate location if you allow it, used only to find nearby services.
  • Review records: moderator decisions, reasons and automated flags (see Responsible AI).

We do not ask for your name on USSD or WhatsApp.

3. Why we use it (lawful basis)

  • Consent, given when you submit a report, to review and escalate it.
  • Legitimate interest in detecting abuse, duplicates and coordinated false reports.
  • Legal obligation, where a court or authority lawfully requires disclosure.

4. What is made public

Only reports approved by a moderator count on the public map, as totals by state, category and date. The map never shows phone numbers, descriptions or report IDs.

5. Who receives your data

Verified reports are sent to the institution responsible for your category: INEC, FIDA, Sexual Assault Referral Centres (SARCs), the Nigeria Police Force, or civil society organisations. We also use these processors:

  • Africa's Talking (USSD and SMS delivery)
  • Meta Platforms (WhatsApp Business messaging)
  • Google Cloud / Firebase (hosting and database)

Some processors may handle data outside Nigeria. We rely on contractual safeguards for those transfers.

6. How long we keep it

Reports and audit records are kept for [retention period, to be confirmed] to support follow-up and accountability, then deleted or fully anonymised. Withheld reports are kept only as long as needed to record the decision.

7. Your rights

You may ask to access, correct, delete or restrict your data, object to its use, or withdraw consent, by emailing us. Because we store phone numbers as hashes, we may ask you to report from the same number so we can find your records. App users can also delete their account in Account > Settings > Delete My Account.

8. Security

We limit access to moderators and institution users, keep secrets out of source code, log moderator decisions, and use encrypted connections. No system is perfectly secure.

9. Complaints

Contact us first. You may also complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

10. Changes

We will post changes on this page and update the date above.