DRAFT for legal review. This document has not been reviewed by a lawyer and is not final. Highlighted [bracketed] text is still to be filled in. It describes how the Service works today; update it whenever that changes (for example if analytics or email are added).
[Company legal name and place of registration], [Company postal address] ("we") is the data controller for the personal data described here. Privacy contact (and Data Protection Officer, where we are required to have one): [privacy contact email].
This policy is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the regulations of the Nigeria Data Protection Commission (NDPC), and also the EU and UK General Data Protection Regulation (GDPR), and other privacy laws that apply to the people who use the Service, including California's CCPA/CPRA. [Lawyer to confirm: NDPC registration as a data controller of major importance, and whether an EU/UK representative is needed.]
| What | Details | Why we need it |
|---|---|---|
| Account data | Your email address; a hash of your password (we cannot read your password); a name and handle generated from your email (you may change them later); when you created the account; which version of our Terms you accepted and when. | To create and secure your account and prove your agreement to the Terms. |
| Your content | The stories and poems you publish, their titles, the look you chose, images you upload or photographs you pick, and listing details such as category and reading time. Drafts are kept in your own browser (local storage) until you publish and are not sent to us. | To run the Service: store, show and share your work. |
| Technical data | When you use the Service our servers and hosting provider receive your IP address, device and browser type, the pages and files requested, and the time. These ordinary server logs are kept for a short period. | To deliver the Service, keep it secure, and diagnose problems. |
| Reading counts | When you read a published story, our server counts one read, and one more if you reach the end. To count each person once a day, it keeps a short scrambled code made from your IP address and browser type and the story (a one-way hash, so it cannot be turned back into either). The codes are deleted after the week they were made in. We do not see who you are from them. The counts, never the codes, are used for the weekly Top writers board. | To show writers how their stories are read, to keep the Top writers board fair, and to stop repeat reloads from inflating it. |
| Comments and reviews | What you write, when you wrote it, and which story and paragraph it is on. If you are signed in, your name and handle are shown with it; if not, it is shown as "Anonymous reader". With each comment or review we keep a one-way scrambled code made from your IP address, browser type and the story (it cannot be turned back into either), and for anonymous comments a separate random code from your own browser so that you can remove your comment later. | To run comments and reviews, to limit spam and abuse, to let you and the story's writer remove a comment, and to review reports. |
| Preferences | Settings you choose, such as sound on or off and how text appears, kept in your browser's local storage. | To remember your choices. |
| Messages and reports | What you send us (for example a copyright complaint or a support email) and our replies. | To respond and to keep a record of how we handled it. |
We do not ask for your date of birth, phone number, home address, payment details, or any special category data (such as health or religion). Your writing may of course contain such things if you choose to write about them; please think before you publish. We do not currently collect precise location.
bk_session keeps you signed in for up to 30 days. It is HttpOnly (not readable by scripts), signed, and sent only to us. We do not need your consent for it because the Service cannot work without it.| Purpose | Basis (GDPR / NDPA) |
|---|---|
| Create your account, sign you in, publish and show your work | Performing our contract with you |
| Keep the Service secure, prevent abuse, handle reports and copyright complaints, keep records | Our legitimate interests (and those of authors and readers), and legal obligations |
| Respond to your requests and legal process; keep accounting and legal records | Legal obligation and legitimate interests |
| Anything else that needs your choice (for example optional emails or analytics, if we add them) | Your consent, which you can withdraw at any time |
We do not make decisions about you by solely automated means that have legal or similarly significant effects. We use simple automated tools to format pages, estimate a story's category, and screen for abuse; a person can review any decision on request.
We do not sell personal data, and we do not share it for third-party advertising. We share data only with:
Providers act under written terms and only on our instructions, or as independent controllers where that is how they operate.
We and our providers are in different countries, so your data may be processed outside the country where you live, including outside Nigeria, the European Economic Area and the United Kingdom, for example in the United States. Where required, we rely on a recognised safeguard: an adequacy decision, standard contractual clauses, binding corporate rules, or another transfer mechanism permitted by the NDPA or the GDPR. Ask us for details at the privacy address above.
Depending on where you live, you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to some uses; receive it in a portable format; withdraw consent where we rely on it; and not be subject to certain automated decisions. Contact [privacy contact email]. We may need to confirm who you are first, and we will answer within the time the law gives us (generally within one month).
You may also complain to a data-protection authority: in Nigeria, the Nigeria Data Protection Commission (ndpc.gov.ng); in the EU, your national authority; in the UK, the Information Commissioner's Office. We would appreciate the chance to put things right first.
California residents: you have the rights to know, delete, correct and opt out of sale or sharing of personal information. We do not sell or share personal information as those terms are defined, and we do not discriminate against you for using your rights.
We protect data with measures that include encrypted connections (HTTPS), passwords stored only as salted one-way hashes, signed HttpOnly cookies, limited staff access, and hosting with established providers. No system is perfectly secure. If there is a breach that is likely to put you at risk, we will tell you and the relevant authority within the time the law requires (under the NDPA, within 72 hours of becoming aware for notification to the NDPC where required).
The Service is for adults aged 18 and over. We do not knowingly collect data from children. If you think a child has given us personal data, write to us and we will delete it.
Stories may contain links to other sites. We do not control them and are not responsible for their privacy practices.
We will update this policy as the Service or the law changes, and tell you about important changes (for example by email or on the Service). The version number above shows which version applies.
[privacy contact email] · [Company legal name and place of registration], [Company postal address].
This document is a draft prepared to be reviewed by a qualified lawyer. It is not legal advice.