Privacy Policy

The Service is an internal tool used by TeeybAds staff and authorised customer-care personnel. It is not open to public registration. Two categories of person have data in the system:

• Staff — anyone employed, contracted, or invited by TeeybAds to use the dashboard.
• Customers — only when their information is logged inside a complaint or follow-up call record by a TeeybAds staff member.

From staff we may store: full name, email, password hash, role, sub-brand assignment, start date, employment status, WhatsApp number, bank name + account name + 10-digit account number (for payroll), document compliance records, attendance and punctuality, strike and reward history, leave records, and HR notes (visible only to founders/COO/HR).

From customers we may store, only as logged by a staff member: name, phone number, location (state), product purchased, sub-brand they bought from, complaint details, satisfaction score, resolution notes, and any uploaded evidence (screenshots, voice notes, PDFs).

We do not collect health, biometric, or political-affiliation data. We do not use third-party advertising trackers, analytics SDKs, or social-media pixels in the Service.

Per the NDPA 2023, our lawful basis is:

• Performance of contract — for staff data needed to run payroll, manage attendance, and pay people correctly.
• Legitimate interest — for performance tracking (stars, strikes, leaderboard) and customer-complaint handling that protects our brand and customer relationships.
• Consent — when staff voluntarily provide additional contact details, or when customers verbally agree to a follow-up call being recorded as a feedback log.

The Service uses row-level security at the database layer — not just at the screen layer — to enforce role-based access:

• Founders, COO, HR: see all staff records including bank details and HR notes; manage payroll, salary tiers, and approvals.
• Managers: see their direct reports' profiles and performance; cannot view bank details of staff outside their team.
• CCU / Customer-care staff: see complaints and feedback calls; do not see staff bank details or HR notes.
• CRS and other roles: see only their own profile, payroll, leave, and the leaderboard.

Customer evidence attachments are stored in a private Supabase Storage bucket. Access is granted through short-lived signed URLs (10-minute expiry) generated only when an authorised staff member opens the complaint detail page.

Data is stored in Supabase (Postgres database, hosted in their managed cloud) and the application is served via Vercel. Both are SOC 2-compliant providers.

Some processing is necessarily transferred to servers outside Nigeria (Supabase and Vercel infrastructure). By using the Service, you consent to this cross-border transfer for the operational purposes described in this policy.

• Active staff records: kept for the duration of employment.
• Former staff records: soft-deleted (marked inactive) and retained for up to seven years after departure for tax, audit, and dispute-resolution purposes, then purged.
• Customer complaint records: retained for up to three years from resolution to support pattern analysis and product-quality decisions.
• Customer evidence attachments: retained alongside the complaint record they belong to and deleted when that record is purged.
• Activity log entries: retained for two years for security and accountability auditing.

If we hold data about you, you have the right to:

• Access the data we hold (a copy on request).
• Correct inaccurate or outdated information.
• Request deletion (subject to the retention windows above and any legal obligations).
• Object to processing where the basis is legitimate interest.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Email tohexey@gmail.com to exercise any of these. We respond within 30 days.

Passwords are hashed by Supabase Auth — never stored in plaintext. All traffic to the Service is encrypted with HTTPS / TLS. Database credentials and admin keys are stored as encrypted environment variables on Vercel and never appear in our source code or logs. Data at rest is encrypted by our infrastructure providers.

Despite these measures, no system is 100% breach-proof. If a data incident affects you, we will notify you within 72 hours of becoming aware, as required by the NDPA.

The Service uses one type of cookie: authentication session cookies set by Supabase Auth so you stay signed in across page loads. There are no advertising, tracking, or analytics cookies.

We may update this policy as the Service evolves. Material changes will be communicated to active users via the dashboard. The “Last updated” date at the top reflects the most recent revision.

Questions, concerns, or data-rights requests: tohexey@gmail.com

TeeybAds Media Growth Ltd.
Lagos, Nigeria