Privacy Policy
1. INTRODUCTION & SCOPE
1.1. Greywood Technologies ("Greywood," "we," "us," or "our") is dedicated to protecting personal data in full compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) 2019.
1.2. This Privacy Policy details how personal information is collected, processed, and safeguarded when merchants and prospective customers interact with Tushe OS across web cockpits and Meta WhatsApp Cloud API webhooks.
2. CONTROLLER VS. PROCESSOR ROLES
• Merchant as Data Controller: You determine the purpose and commercial means of communicating with your retail customers.
• Greywood / Tushe OS as Data Processor: We process customer WhatsApp messages, phone numbers, and payment links solely on your documented instructions.
3. PLATFORM-LEVEL MEMORY DECOUPLED FROM LLMs
3.1. Memory Decoupling Architecture: Tushe OS maintains a strict architectural separation between memory storage and artificial intelligence processing:
- Database Memory Layer: All merchant catalog vectors, customer negotiation histories, behavioral preferences, and audit logs are stored in Supabase PostgreSQL with the pgvector extension. Multi-tenancy is enforced at the database kernel level via Row-Level Security (RLS) on
org_id. - Stateless LLM Inference: External Large Language Models (Groq Llama 3.1, DeepSeek V3, Google Gemini) operate strictly as stateless compute engines. They hold zero memory of your transactions and do not train on or retain your business data.
4. CATEGORIES OF DATA PROCESSED
| Data Subject | Data Categories | Processing Purpose |
|---|---|---|
| Merchant | Legal name, email, WhatsApp phone, CAC business number, NUBAN settlement details. | Authentication, tenant provisioning, subscription billing, bank transfer payouts. |
| End Customer | WhatsApp phone number, message text, delivery address, selected inventory SKU. | Autonomous sales negotiation, price quote issuance, order generation. |
| Financial Audit | Paystack transaction reference, paid amount (kobo), HMAC-SHA512 webhook signature. | Cryptographic payment verification, order status reconciliation, anti-fraud defense. |
5. DATA WE NEVER COLLECT OR STORE
- We do NOT store or handle debit/credit card numbers, CVVs, or PINs (tokenized directly by Paystack PCI-DSS Level 1 infrastructure).
- We do NOT collect customer BVN (Bank Verification Number) or NIN (National Identification Number).
- We do NOT collect biometric data.
6. DATA SUBJECT RIGHTS UNDER NDPA 2023
Merchants and their customers possess enforceable rights under the Nigeria Data Protection Act 2023, including:
- Right of Access & Portability: Request a complete machine-readable copy of stored conversation records and inventory items.
- Right to Rectification: Update inaccurate business, phone, or bank details directly in the cockpit.
- Right to Erasure ("Right to be Forgotten"): Request irreversible purging of all merchant and customer conversation records within 30 days of termination.
7. SUB-PROCESSORS REGISTRY
To deliver sub-400ms autonomous sales and bank settlements, Greywood engages vetted technical sub-processors:
- Supabase, Inc.: PostgreSQL cloud database, authentication, and pgvector embeddings.
- Paystack Payments Limited: CBN-licensed payment gateway and NUBAN bank virtual accounts.
- Meta Platforms, Inc.: WhatsApp Business Cloud Graph API messaging gateway.
- Groq, Inc. & DeepSeek: High-throughput, stateless LLM negotiation inference.
- Google LLC: Secondary fallback LLM inference (Gemini Flash).
- Render, Inc.: Hardened FastAPI cloud application hosting.
8. 72-HOUR BREACH NOTIFICATION MANDATE
In the event of a verified security incident affecting personal data, Greywood will formally notify the Nigeria Data Protection Commission (NDPC) within 72 hours and promptly alert impacted merchants via registered email and WhatsApp.