Privacy Policy
Last updated: May 2026. How AKILI handles your data under the Nigerian Data Protection Act (NDPA) 2023 and global privacy standards.
1. Introduction
AKILI ("we", "our", "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, and protect your information in accordance with the Nigerian Data Protection Act (NDPA) 2023, the Nigeria Data Protection Regulation (NDPR) 2019, and international standards including GDPR where applicable.
By using AKILI's services, you agree to the collection and use of information in accordance with this policy.
2. Data Controller Information
Data Controller: AKILI
Contact: codewpaule@gmail.com
Jurisdiction: Federal Republic of Nigeria
Regulatory Framework: Nigerian Data Protection Act (NDPA) 2023, NDPR 2019
What data do we collect?
Account Information:
- Email address (used as primary identifier)
- Name (optional)
- Password (stored as bcrypt hash, never in plain text)
- Optional Google OAuth ID for authentication
Scan Data:
- Scan targets (domains, IPs, emails) stored by scan ID
- Scan findings, scores, and reports
- Timestamps of scan activities
API Usage:
- API key usage counters (requests per day/month)
- API key metadata (name, tier, creation date)
- Rate limit tracking for fair usage
Technical Data:
- IP address for rate limiting and security
- Browser type and version
- Device information
- Referring website
What do we not store?
- Raw API keys (only SHA-256 hashes are stored)
- Passwords in plain text (bcrypt hashed only)
- Full request logs of every URL scanned in production
- Credit card or payment information (processed by third-party payment processors)
- Personal content from scanned websites beyond security findings
5. Legal Basis for Processing (NDPA 2023 Compliance)
We process your personal data based on the following lawful bases under the Nigerian Data Protection Act 2023:
- Consent: You provide explicit consent when creating an account and using our services
- Contract: Processing is necessary for the performance of our service agreement with you
- Legitimate Interest: For security, fraud prevention, and service improvement
- Legal Obligation: To comply with applicable Nigerian laws and regulations
6. Data Retention
In accordance with NDPR requirements, we retain your data as follows:
- Account Data: Retained while your account is active. Deleted upon account closure or 30 days after inactivity.
- Scan Reports: Retained for 90 days for free tier, 1 year for pro tier, 2 years for enterprise tier.
- API Usage Logs: Retained for 30 days for rate limiting and security purposes.
- Technical Logs: Retained for 60 days for security monitoring.
7. Third-Party Services
AKILI may use third-party services to enhance our scanning capabilities:
- AI/LLM Services: Groq for AI-powered analysis (data processed under their privacy policy)
- Threat Intelligence: External threat feeds for vulnerability detection
- SSL Certificate Services: For SSL validation and certificate information
- Payment Processors: For subscription payments (we do not store payment details)
All third-party services are carefully vetted for compliance with data protection standards. Their respective privacy policies apply to data they process.
8. Your Rights Under NDPA 2023
As a data subject under the Nigerian Data Protection Act 2023, you have the following rights:
- Right to Access: Request a copy of your personal data we hold
- Right to Correction: Request correction of inaccurate or incomplete data
- Right to Deletion: Request deletion of your personal data ("right to be forgotten")
- Right to Portability: Request transfer of your data to another service
- Right to Object: Object to processing of your personal data in certain circumstances
- Right to Restrict Processing: Request limitation of how we process your data
To exercise these rights, contact us at codewpaule@gmail.com. We will respond within 30 days as required by NDPR.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data:
- HTTPS/TLS encryption for all data in transit
- Bcrypt hashing for passwords (never stored in plain text)
- SHA-256 hashing for API keys
- JWT-based session authentication with secure token storage
- Rate limiting to prevent abuse
- Regular security audits and penetration testing
- Access controls and principle of least privilege
- Secure database encryption at rest
Despite our security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.
10. Data Transfer Outside Nigeria
AKILI primarily stores and processes data within Nigeria. However, we may transfer data to trusted third-party service providers located outside Nigeria for the purposes described in this policy. Such transfers are conducted in accordance with NDPR requirements and only to jurisdictions with adequate data protection laws or with appropriate safeguards in place.
11. Children's Privacy
Our services are not intended for children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of our services after such changes constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email:codewpaule@gmail.com
Address:Nigeria
For NDPR-related complaints, you may also contact the Nigeria Data Protection Commission (NDPC).