Privacy Policy

We aim to process personal data lawfully, fairly and transparently; only for specified purposes; limited to what is necessary; accurately; for no longer than needed; securely; and accountably.

• Account information — name, email address, phone number, role, and sign-in identifiers.
• Pro profile information — photo, profession, services, About text, service areas, travel preference, availability, portfolio and credentials.
• Customer and job information — service requests, project details, bookings and assessments, quotes, Change Orders and job records.
• Communications — messages, attachments, structured commercial events in chats, records that a call was started, and support communications. Calls are not recorded.
• Verification information — phone verification codes (stored only in scrambled form), and identity and bank verification results. For BVN checks we keep only a masked version and the provider's result and reference, not your full BVN. Full identity data is processed and held by the verification provider.
• Financial and payment information — dedicated payment account details, payment requests, transaction references, wallet ledger records, withdrawal bank details (we keep the bank, account name and last four digits) and reconciliation status.
• Reviews — ratings, written feedback, review source and invitation records.
• Technical information — browser and device information, session identifiers, and security and system logs.
• Analytics — first-party usage events, such as pages viewed and actions taken, stored by Craft Capital.

When you describe a job in Find a Pro, we process your text to identify the service or profession, recognise the location and timing, keep track of your current request, and suggest Pros. The current request is kept in your browser session.

In the current pilot, Craft AI does not use an external generative AI language model. It uses structured rules, our list of professions and services, known alternative wordings, context from your request and matching logic. If this changes, we will update this Policy before or when the new processing begins.

Separately, optional writing help offered to signed-in users in some forms (for example when drafting a quote) sends the text you ask to improve to an AI service provider to generate a suggestion.

To improve search, we count terms and place names that Craft AI could not recognise. We store the normalised term and how often it appeared, not your whole conversation, and we remove phone numbers and email addresses first. Our team reviews these before any new place or wording is added.

• Creating and managing accounts, public Pro profiles, matching, messaging, quotes, bookings, projects, jobs and payments — to perform our contract with you.
• Identity, BVN and bank verification, fraud prevention and keeping financial records — legal obligations and our legitimate interest in a safe platform. Where specific consent is required (for example for BVN checks), we ask for it at that point.
• Calculating the Craft Score and showing reputation — performing our contract and our legitimate interests.
• Financing eligibility and partner integrations — performing a contract you request, with specific consent where required.
• Reviews, customer support, analytics and product improvement — legitimate interests.
• Meeting legal and regulatory requirements — legal obligation.

Anything a Pro publishes on their public profile can be seen by anyone on the internet, including search engines. We never publish BVN, NIN, identity documents, private bank details, or a private phone number or email address.

We share only what is needed for each purpose, with:

• Hosting, database, authentication and storage providers (our backend runs on Supabase infrastructure).
• Payment, banking and identity verification providers — currently Monnify, for BVN checks, dedicated payment accounts, payment processing and transfers.
• Communication providers — Termii for phone verification codes and account or security SMS; our email provider for account and job emails; Daily for audio and video calls.
• Google, when you choose to sign in with Google.
• An AI service provider, only for the optional writing help described above.
• Professional advisers, and regulators or law enforcement where the law requires it.

Phone verification does not mean you have agreed to marketing SMS. Craft Capital does not sell personal information to advertisers.

If you sign in with Google, we receive only the basic account details you allow, such as your name, email address and profile picture. We do not receive the rest of your Google account contents.

For Past Client Reviews, a Pro may give us a past customer's name and email address so we can send the requested review invitation and a limited reminder. We use these details only for that invitation. We do not build a marketing profile of the invited person or add them to marketing communications.

Verified Reviews are linked to the underlying Customer, Pro and job to show that the review comes from a real Craft Capital job. Job and payment details are not shown publicly.

We process qualifying platform activity to calculate the Craft Score. It is not a credit bureau score. If a Craft Score or financing decision has a significant effect on you, you may ask for human review, express your view and contest the decision.

If you apply for or use financing, we may share the necessary information with the relevant financial institution or service provider for eligibility, verification, assessment, servicing, repayment and regulatory purposes. We will tell you who the provider is, and their own privacy terms will apply to the data they hold.

Some of our providers, such as our infrastructure, Google, email, calling and AI service providers, may store or process data outside Nigeria. Where this happens, we rely on the transfer safeguards recognised under the NDPA.

We keep data only as long as needed for its purpose: account and profile information while your account is active and for a necessary period afterwards; transaction and ledger records for as long as financial and legal obligations require; security logs for a limited security period; and review records under platform and legal requirements. Deleted content may remain in backups or under legal holds for a limited time. Specific retention periods are being finalised.

You can ask us to delete your account. Some information may be kept where needed for legal obligations, financial records, fraud and security, dispute resolution, or legal claims.

Under Nigerian law you have the right to be informed; to access, correct or restrict your data; to object to processing; to withdraw consent where processing relies on it; to data portability and erasure where applicable; and rights relating to automated decision-making. Contact us using the privacy contact above to exercise these rights.

You may also complain to the Nigeria Data Protection Commission, although we encourage you to contact us first so we can try to help.

We protect data with access controls, authentication, restricted data access, technical and organisational safeguards and monitoring. No system is completely secure, so we cannot guarantee absolute security.

We use essential browser storage to keep you signed in and secure, preference storage (for example, whether the menu is collapsed), and first-party analytics stored by Craft Capital. We do not currently use advertising or third-party marketing trackers.

Craft Capital is not intended for anyone under 18, and we do not knowingly create accounts for them.

We may update this Policy as the service or the law changes. We will give reasonable notice of material changes. The date and version at the top show the current revision.