Legal
Privacy Policy
The short version
We hold where you are, where you travel, and who you would call for help. That is unusually sensitive, and we treat that information accordingly.
Your location is shared with the people you choose, and with nobody else. We never sell personal data. Nothing we publish, license, or sell to any organisation identifies you or any other person, at any price, on any plan.
What we build a business on is the pattern, never the person.
1.Who we are
FlagRisk Technologies Limited, RC 9690636, of 325 Enugu Road, FCDA Quarters, Bwari, Abuja, Nigeria, is the data controller for the personal data described in this policy.
Data protection enquiries are received at hello@flagrisk.org.
This policy explains what we collect, why, who we share that data with, how long we keep that data, and what rights you have under the Nigeria Data Protection Act 2023, referred to in this policy as the Act.
This policy forms part of our Terms of Service.
2.What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, mobile number, electronic mail address, password, verification status | You, at registration |
| Location | Precise location while the application is in use, and in the background during an alert or a declared journey; location history for the period your plan retains | Your device, with your permission |
| Followed places | The places you choose to follow, being the name you give each place, its location, and the distance around that place within which we tell you of a report; and a record of each alert we send you about a followed place, being the place and its name, the incident, the distance between them, the time, and whether the alert was sent in the application or on WhatsApp | You, when you follow a place, and our record of the alerts we send you |
| Trusted circle | Names and mobile numbers of the people you add, and their relationship to you if you record that relationship | You |
| Alerts and journeys | Panic events, check-ins, missed check-ins, declared origin and destination, timing | Your use of the Service |
| Reports | Incident category, description, location, time, and any photograph or video you attach | You and other users |
| Your WhatsApp number, the identifier WhatsApp assigns to you for FlagRisk, and your WhatsApp profile name; a record of each message exchanged, being its type, purpose, time, and delivery status, without the text of the message; a current location you send in the chat; your choice to receive or to stop alerts there; and the private words you choose to raise and to end a panic alert, held in a form that cannot be read back | You and WhatsApp, when you write to the FlagRisk account on WhatsApp | |
| Payment | Plan, billing history, and a payment reference. We do not receive or store your card details | Our payment provider |
| Device and technical | Device model, operating system, application version, notification token, network type, crash logs, internet protocol address | Your device, automatically |
| Usage | Screens opened, features used, and timing, in a form linked to your account | Your use of the Service |
Location data is not classified as sensitive personal data under the Act. We treat location data with the same care as if it were, because location can reveal where you live, work, worship, and travel.
We also hold incident information drawn from published news reports. That information concerns events, is attributed to its source, and is not collected from you.
On WhatsApp we store a location as your position only when you send your current location. A place you choose on the map is used to answer you and is not stored as your position. A location sent before your number is confirmed is used to answer you and is not stored. The location of a place you follow is stored as that place. It is not stored as your position, even where you sent your current location to mark that place.
A person who uses FlagRisk on WhatsApp holds one FlagRisk account, identified by their mobile number. The same account serves the application.
3.Why we process personal data, and on what basis
| Purpose | Lawful basis under the Act |
|---|---|
| Creating and running your account | Performance of our contract with you |
| Sending a panic alert with your location to your trusted circle | Performance of our contract with you, and the protection of your vital interests |
| Running Trip Watch and raising an alert on your silence | Performance of our contract with you, and the protection of your vital interests |
| Providing the Service through WhatsApp, including answering a request about an area, taking a report, and raising a panic alert or a timed watch | Performance of our contract with you, and the protection of your vital interests |
| Delivering alerts and notices on WhatsApp to a member of a trusted circle | The consent of that member, which the member may withdraw at any time, and the protection of the vital interests of the person the alert concerns |
| Asking a person near a reported incident, on WhatsApp, whether that incident is still happening | Our legitimate interest in keeping the Service accurate and safe for others |
| Reminding a member of a trusted circle, on WhatsApp, to send a current location | Our legitimate interest in keeping the members of a trusted circle within reach of an alert |
| Showing you the map of safety concerns and your risk score | Performance of our contract with you |
| Keeping the places you follow, and telling you when a safety concern is reported near one of them | Performance of our contract with you. Where the alert is sent on WhatsApp, also your consent to alerts there, which you may withdraw at any time |
| Verifying your mobile number | Performance of our contract with you, and our legitimate interest in preventing abuse |
| Moderating reports, checking attached media, and investigating misuse | Our legitimate interest in keeping the Service accurate and safe for others |
| Taking payment for a paid plan | Performance of our contract with you |
| Improving the Service and fixing faults | Our legitimate interest in operating a reliable service |
| Producing aggregate information on safety concerns | Our legitimate interest in operating the Service and in developing safety information products |
| Sending you marketing messages | Your consent, which you may withdraw at any time |
| Meeting a legal obligation or responding to a lawful request | Compliance with a legal obligation |
Where we rely on our legitimate interests, we have assessed those interests against your rights and freedoms and have recorded that assessment. You may ask us for a summary of that assessment.
4.Who can see your location
The people in your trusted circle see your location when you raise a panic alert, and during a declared journey where that feature is active. You choose those people and you can remove them at any time.
Other users of FlagRisk never see your location, your identity, or your movements. A report you submit appears on the map without your name.
Our staff may access your data only where access is necessary for a specific task, such as investigating a fault or moderating a report. Access is logged. Our staff are contractually prohibited from looking up any person for personal reasons or on behalf of a third party, and breach is a dismissal matter.
We do not permit any organisation to locate, track, or identify an individual user through our products.
An alert delivered on WhatsApp carries one position, with its source and its age. We show no moving trail of a person on WhatsApp.
If you choose to tell your trusted circle about a report you have made, the members you tell see your name, the kind of report, and where you made it. A person who is asked whether a reported incident is still happening is never told who reported it.
A person you invite to your trusted circle sees your name. A person who receives a note you send through Tell a friend sees your name, because you send that note from your own WhatsApp.
You are shown which members of your trusted circle have marked a panic alert as seen.
The places you follow, and the names you give them, are shown to you alone. No member of your trusted circle and no other user sees them. Following a place does not share your position with anyone.
5.Aggregate information and our business model
We combine reports and incident data to produce aggregate information on safety concerns, such as the level of reported safety concerns in an area by street, hour, and season. That is the basis of the products we sell to organisations.
Aggregate information is stripped of names, mobile numbers, account identifiers, and device identifiers, and is generalised so that an individual cannot reasonably be singled out.
We do not sell personal data. We do not license, publish, or otherwise make available to any customer any data that identifies a user, and no plan or price tier changes that.
A photograph attached to a report is checked by an automated service for relevance to the report before the photograph is shown to other people. We do not use your data to make an automated decision that produces a legal effect for you or that significantly affects you.
6.Who we share data with
| Recipient | Why |
|---|---|
| Your trusted circle | To alert them and show them your location, as you have chosen |
| Hosting and database provider | To store and serve the data behind the Service |
| Messaging provider | To send verification codes and alert messages to mobile numbers |
| Meta Platforms, as the operator of WhatsApp | To carry messages between FlagRisk and a person who uses FlagRisk on WhatsApp |
| Push notification services | To deliver alerts and notices to devices |
| Payment provider | To take payment for a paid plan |
| Mapping and places provider | To display maps and to resolve places and addresses |
| Automated content checking provider | To check that a photograph attached to a report is relevant to that report |
| Analytics and error reporting | To measure use and diagnose faults |
| Professional advisers | Where necessary for legal, accounting, or audit purposes |
| A buyer or investor | On a sale of the business or of a part of the business, or in a corporate reorganisation, subject to equivalent protection |
| Authorities | Where we are compelled by law, as described in clause 7 |
Subject to clause 6.2, each provider acts as our processor under a written contract, may process your data only on our instructions, and may not use that data for its own purposes.
WhatsApp is operated by Meta Platforms. Every message between a person and FlagRisk on WhatsApp passes through the WhatsApp Business Platform. Meta receives the content of each such message, the mobile numbers involved, and the time and delivery status of each message. That includes the content of an alert, being the name of the person the alert concerns, its time, and its position. An alert about a place you follow carries the name you gave that place, the kind of incident reported, its time, its distance from that place, and the position at which it was reported. Meta also provides WhatsApp to you under its own terms and its own privacy policy, and we do not control that handling.
We send a message to a person on WhatsApp only after that person has written to the FlagRisk account on WhatsApp. We send no advertising through WhatsApp.
7.Requests from law enforcement and authorities
We disclose personal data to a law enforcement agency or other authority only where we are compelled to do so by a valid legal instrument, such as a court order, or where disclosure is necessary to protect the vital interests of a person facing an immediate danger of serious harm.
We do not give any agency standing or bulk access to our systems, and we do not respond to informal requests.
We record every request we receive and the response we give.
We tell you if we have disclosed your data, unless we are legally prohibited from doing so or telling you would put a person in danger.
8.Where your data is held
Our infrastructure providers hold data on servers located outside Nigeria.
We transfer personal data outside Nigeria only where the Act permits the transfer, which for us means under a written contract imposing protection equivalent to that required by the Act, or to a country recognised as providing an adequate level of protection.
You may ask us for the current list of the countries in which your data is held.
9.How long we keep personal data
| Data | Retention |
|---|---|
| Account and profile | While your account is open, and for ninety days after you close your account |
| Location history visible to you | The period your plan provides, being 7, 30, 90, or 180 days |
| A position from a current location sent on WhatsApp | Used to decide who is within reach of an alert for seventy-two hours. Kept as location history for the period your plan provides |
| A place you follow, with the name you give it | Until you stop following that place, and otherwise for as long as we keep your account |
| The record of alerts sent to you about a place you follow, which holds the name of that place | For as long as we keep your account, including after you stop following that place |
| Alert and journey records | Twelve months, then deleted or de-identified |
| The record of messages exchanged on WhatsApp, which holds no message text | Twelve months, then deleted |
| An invitation to a trusted circle that is not accepted | Fourteen days, after which the invitation expires |
| The private words that raise and end a panic alert on WhatsApp | Until you replace them or your account is closed |
| Reports you submit | Retained as part of the incident record, de-identified from you after ninety days |
| Photographs and video | Ninety days, unless retained for a moderation or legal matter |
| Billing records | Six years, to meet tax and accounting obligations |
| Aggregate information on safety concerns | Indefinitely. Aggregate information on safety concerns contains no personal data |
Where we are required to keep data for a legal or regulatory reason, we keep that data for the required period and no longer.
10.Security
We protect data in transit and at rest using encryption, restrict access to our systems by role, require multi-factor authentication for administrative access, and log access to user data.
No system is perfectly secure. If a breach occurs which is likely to result in a risk to your rights and freedoms, we notify the Nigeria Data Protection Commission within seventy-two hours where the Act requires notification, and we tell you without undue delay where the risk to you is high.
Keep your device locked and your account credentials private. Tell us immediately if you think someone else has access to your account.
11.Your rights
Under the Act you have the right to:
- be informed about how we use your data, which is the purpose of this policy;
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data, where we have no overriding reason to keep that data;
- ask us to restrict how we use your data while a concern is resolved;
- object to processing we carry out on the basis of our legitimate interests;
- receive your data in a portable form, or have your data sent to another provider;
- withdraw consent at any time, where we rely on consent; and
- complain to the Nigeria Data Protection Commission.
To exercise a right, write to the data protection address in clause 14. We respond within one month, and we tell you if we need longer because the request is complex.
We do not charge for this, unless a request is manifestly unfounded or excessive.
You can delete your account in the Service at any time, which starts the deletion described in clause 9. A person who uses FlagRisk only on WhatsApp asks us to delete their account by writing to the data protection address in clause 14.
You withdraw your consent to alerts on WhatsApp by sending STOP ALERTS to the FlagRisk account on WhatsApp. Sending START ALERTS turns those alerts on again. We record each choice with its time. Choosing to follow a place on WhatsApp turns alerts on there, unless you have stopped them. STOP ALERTS also stops the alerts on WhatsApp about the places you follow.
You stop following a place at any time from My places in the FlagRisk chat on WhatsApp. That place is then deleted.
12.Children
The Service is for people aged 18 and over. We do not knowingly collect data from anyone under 18.
If we learn that we hold data of a person under 18, we delete that data and close the account.
13.Changes to this policy
We may update this policy. We publish the revised version with a new effective date and, where a change materially affects you, we tell you before the change takes effect.
14.Contact and complaints
| Data protection | hello@flagrisk.org |
| General enquiries | hello@flagrisk.org |
| Postal address | FlagRisk Technologies Limited, 325 Enugu Road, FCDA Quarters, Bwari, Abuja, Nigeria |
| Regulator | Nigeria Data Protection Commission |
If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission. We would rather hear from you first, and we will try to put the matter right.
This policy is read together with the Terms of Service.