Privacy Policy

We only collect the minimum data needed to provide our services. Specifically:

Account data: name, email, phone number (for WhatsApp login), and a password hash — used to create your Tobix account via Supabase Auth.

Accommodation data: your preferred hostel location, budget, room type, roommate preferences, and move-in date — stored only so we can match you with landlords and roommates. Optional: department, level, and gender (for same-gender hostel matching).

Landlord data: business name, CAC number (if provided), hostel photos, price, and location — used to list your property.

Payment data: We never store full card numbers or bank PINs. All payments are processed by Paystack, a PCI-DSS Level 1 certified provider. We only store the transaction reference, amount, status, and payer identity.

WhatsApp conversation data: when you chat with our bot, we store the conversation state (which step of the flow you're on) and the messages exchanged, so we can continue the conversation and for dispute resolution in the escrow process.

Technical data: IP address, browser type, device type, and pages visited — collected automatically via standard server logs and anonymous analytics.

Your data is used only to:

• Create and maintain your account
• Match you with suitable hostels, landlords, or roommates near FUOYE
• Process payments and manage the escrow system (hold rent safely until you confirm move-in)
• Send you transactional WhatsApp messages (booking confirmations, agreement codes, payment receipts)
• Deliver courses you have purchased and issue certificates
• Respond to your support messages
• Improve the service, detect fraud, and prevent abuse

We never sell your data to third parties. We do not run ad-retargeting or behavioural advertising on our users.

Our WhatsApp bot is built on the WhatsApp Business Platform provided by Meta Platforms, Inc. When you message our bot:

• Meta receives and routes your message to our server at tobixfuoye.com.ng/api/whatsapp/webhook.
• Meta's handling of your message is governed by WhatsApp's Privacy Policy.
• We store the message contents and your WhatsApp phone number in our Supabase database only for the duration needed to complete your booking or escrow flow.
• We do not share WhatsApp conversation data with advertisers or unrelated third parties.

If you want to stop the bot from messaging you, reply with STOP at any time. You can also block our WhatsApp number from within the WhatsApp app.

Hostel rent payments flow through Paystack, a fully licensed Nigerian payment processor. Funds are held in a Tobix-controlled escrow sub-account until:

• You confirm move-in by sending your unique agreement code to the bot, or
• 72 hours pass after your verified move-in date with no dispute

If a dispute is raised, an escrow staff member reviews chat logs, payment proof, and landlord evidence before releasing or refunding the funds. You can read more about our escrow model on the accommodation page.

We rely on a small set of trusted providers to run Tobix:

• Supabase — database hosting, authentication, and row-level security
• Vercel — website hosting and serverless functions
• Paystack — card and bank payments
• Meta / WhatsApp Business Platform — WhatsApp messaging
• Groq & Vercel AI Gateway — AI assistant responses (Tobix AI)
• Google Search Console & Bing Webmaster Tools — search indexing and analytics

Each of these providers has its own privacy policy and security standards that we review before integrating.

We keep your data only as long as needed. Concretely: active account data is kept while your account is open. Completed bookings and payment records are retained for 7 years to comply with Nigerian tax and financial record laws. Abandoned bot conversations (where you stop replying) are deleted after 90 days. Course progress is kept while you have access to the course you purchased.

You can request earlier deletion at any time — see Data Deletion.

Under Nigeria's NDPR and the EU GDPR (for EU visitors), you have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion of your data (see Data Deletion)
• Export your data in a portable format
• Withdraw consent for WhatsApp messaging (reply STOP)
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC)

To exercise any right, email tobixtech@gmail.com with the subject line Privacy Request.

We use industry-standard protections: HTTPS/TLS for all traffic, bcrypt password hashing, Supabase Row-Level Security (RLS) policies so users can only read their own data, HMAC signature verification on Paystack and WhatsApp webhooks, and restricted access to production databases.

If a data breach affecting your personal data occurs, we will notify you and the NDPC within 72 hours as required by law.

Tobix services are intended for users 16 years and older. We do not knowingly collect data from children under 16. If you believe a child has submitted data to us, contact us at tobixtech@gmail.com and we will delete it promptly.

We may update this policy from time to time. The “Last updated” date at the top of this page reflects the latest revision. Significant changes will be announced on our website and, where appropriate, via email.

Tobix Technology is operated by Ikeh Dominion, a Software Engineering student at Federal University Oye-Ekiti (FUOYE), Ekiti State, Nigeria.

For any privacy-related question, write to: tobixtech@gmail.com

For general contact, visit our contact page.