Privacy Policy

1. Introduction

Lodgely is a unified, multi-tenant platform: a single Lodgely account can carry membership in one or more organizations (a construction company, a facility-management company, a brokerage, an investment vehicle, or an individual property owner), each operating in one or more of our apps. Because an organization can invite you, assign you a role, and grant you access to property, tenancy, financial, and project records, some of the personal data described below may be collected or shared not directly by you, but by an organization you belong to, or by another member of that organization (for example, a Facility administrator entering your details as a tenant, or a Developer project owner raising a requisition that references your name). Section 7 explains this in more detail.

This Policy is written to be read together with our Terms of Service, which governs your use of the Services generally.

2. Scope of This Policy

This Policy applies to personal data processed through:

• Lodgely Developer — web app for construction and real-estate development teams (project, milestone, requisition, procurement, inventory, finance, and team management).
• Lodgely Facility — web app for managing buildings, tenancies, maintenance, service charges, and payments.
• Lodgely Realtor — web app for property listings, leads, and transaction/deal tracking.
• Lodgely Investment — web app and public feed for real-estate investment opportunities, portfolio tracking, and yield reporting.
• Lodgely Resident — mobile app for tenants: rent and service-charge payments, maintenance requests, building notices, and digital access/gate codes.
• Lodgely Owner — mobile app for landlords/property owners: rent-collection and payout tracking, occupancy and lease oversight, and maintenance visibility.
• The shared Lodgely account (sign-in, registration, profile, and session management used across every app above) and our public website at lodgely.ng.

Some apps listed above are rolled out progressively and may not yet be publicly available in every market or on every store — this Policy applies to each app from the moment it is made available to you, and continues to apply to any data already collected.

3. Information We Collect

3.1 Information you provide to us

• Account & profile data: full name, email address, phone number, password (stored as a salted hash, never in plain text), and profile photo if you add one.
• Organization & property data: organization/company name, the buildings, units, projects, or listings you create or are given access to, tenancy and lease details (move-in/move-out dates, rent amounts, unit numbers), and project data (milestones, tasks, bills of quantities, budgets).
• Financial & payment data: rent, service-charge, contribution, and invoice records; transaction references, amounts, and payment status; and, for property owners receiving payouts, the bank account and settlement details needed to pay you. We do not store your full debit or credit card number, CVV, or online-banking credentials — card and bank-transfer payments are handled directly by our licensed payment processor, Paystack, and we only receive a payment reference and status back from them (see Section 6).
• Documents & media you upload: receipts, invoices, inspection reports, lease agreements, identification documents (where a verification flow requires them), listing and property photos, and floor plans.
• Communications: messages, comments, and attachments you post in a project or building channel, support requests you send us, and any other correspondence with Lodgely.
• Content of invitations: if you invite someone to join your organization, we collect their name, email, and the role you assign them.

3.2 Information collected automatically

• Device & log data: IP address, browser type and version, operating system, device identifiers, mobile network information, app version, dates and times of access, pages or screens viewed, and crash/diagnostic logs.
• Usage data: the features you use, buttons you click, and general interaction patterns, used to understand how the Services are used and to improve them.
• Cookies and similar technologies on our website and web apps — see Section 8.
• Approximate location derived from your IP address (for fraud prevention and to localize content); our mobile apps do not collect precise GPS location unless a specific feature (for example, a future site-visit or delivery-confirmation feature) explicitly asks for your permission first.

3.3 Information from other sources

• Single sign-on providers: if you choose to sign in with Google, we receive your name, email address, and profile photo from Google, as permitted by your Google account settings.
• Payment processors: confirmation of payment success/failure, payment method type (for example, card or bank transfer), and a transaction reference from Paystack.
• Other users and organizations: if someone adds you as a tenant, invites you to an organization, or references you in a project, requisition, or listing record, we receive the information they enter about you.

4. How We Use Your Information

We use personal data to:

• Create and maintain your account, authenticate you, and keep your session secure across devices.
• Provide the core functionality of whichever Lodgely app(s) you or your organization use — for example, recording a rent payment, tracking a construction milestone, publishing a listing, or generating a digital gate code.
• Process payments, payouts, and refunds, and maintain accurate financial and transaction records.
• Send you service communications: account verification, password resets, payment receipts and reminders, maintenance-ticket updates, building notices, and security alerts.
• Send product updates, tips, and (where permitted by law and your preferences) marketing communications, which you can opt out of at any time.
• Respond to support requests and resolve disputes.
• Detect, investigate, and prevent fraud, abuse, security incidents, and violations of our Terms of Service.
• Analyze usage trends to maintain, troubleshoot, and improve the Services, and to build new features.
• Comply with legal, tax, and regulatory obligations, and respond to lawful requests from public authorities.

5. Our Legal Basis for Processing

Under the Nigeria Data Protection Act, 2023 (“NDPA”) and its implementing regulations, we rely on one or more of the following legal bases, depending on the processing activity:

• Performance of a contract — to provide the Services you or your organization signed up for (for example, processing a rent payment you initiated).
• Consent — for optional features such as marketing emails, push notifications, and non-essential cookies, which you can withdraw at any time.
• Legitimate interests — for fraud prevention, platform security, service improvement, and direct marketing to existing customers, balanced against your rights and interests.
• Legal obligation — where we must retain or disclose information to comply with applicable law, regulation, or a valid order from a court or regulator.

6. How We Share Your Information

We do not sell your personal data. We share it only in the following circumstances:

• Within your organization: other members of an organization you belong to can see the data your role permits — for example, a Facility administrator can see a tenant's payment history for their own building; a Developer team member can see project and requisition records they have been granted access to. See Section 7.
• Service providers: vendors who process data on our behalf under contract, including our payment processor (Paystack), cloud hosting and storage providers, email and SMS delivery providers, and analytics/crash-reporting providers. These providers may only use your data to perform the services we've asked for.
• Legal & safety reasons: where required to comply with a law, regulation, legal process, or valid governmental request, or to protect the rights, property, or safety of Lodgely, our users, or the public.
• Business transfers: if Lodgely is involved in a merger, acquisition, financing, or sale of assets, personal data may be transferred as part of that transaction, subject to the commitments in this Policy.
• With your direction or consent: for example, if you ask us to share a document with a third party, or connect a third-party integration.

7. Organizations, Roles & Shared Data

Lodgely is built around organizations: a company or individual that signs up, invites members (employees, tenants, contractors, agents, or co-investors), and assigns each member a role (for example, Owner, Admin, Project Manager, Finance, Site Manager, or Viewer). Each role is granted a defined set of permissions, so members only see the data their role is entitled to see.

Because of this model:

• The organization (and its Owner/Admins) — not Lodgely — decides who is invited, what role they're given, and therefore what data within that organization they can access.
• If you are a tenant, contractor, or employee added to an organization by someone else (for example, a landlord entering you as a tenant in Lodgely Facility), that organization is responsible for the accuracy of the information it enters about you and for having a lawful basis to do so; Lodgely acts as the data processor/platform in that relationship.
• Leaving an organization, or having your access revoked, stops your ongoing access to that organization's data, but does not automatically delete historical records (such as past payments or maintenance tickets) that the organization is entitled to keep for its own operational or legal purposes.
• If you believe an organization has entered inaccurate information about you, you may contact us (Section 18) and we will work with the organization to help correct it, consistent with your rights in Section 11.

8. Cookies & Tracking Technologies

Our website and web apps use cookies and similar technologies (such as local storage) to:

• Keep you signed in and remember your session across our apps (essential — cannot be disabled without breaking login).
• Remember preferences, such as your last-used organization or a dismissed banner.
• Understand usage through basic, privacy-conscious analytics, so we can see which pages and features are used.

You can control non-essential cookies through your browser settings; disabling essential cookies will prevent you from staying signed in. Our mobile apps do not use browser cookies but may use comparable on-device storage for the same purposes (session tokens, preferences).

9. Push Notifications & Device Permissions

Our mobile apps may ask for permission to send you push notifications (for example, a payment reminder, a maintenance-ticket update, or a building notice) and, where a specific feature requires it, permission to access your camera (to upload a photo or scan a document), photo library (to attach an image), or notifications. You can manage or revoke any of these permissions at any time in your device's settings; doing so may limit the related feature but will not affect the rest of the app.

10. How Long We Keep Your Data

We retain personal data for as long as your account is active and as necessary to provide the Services. After an account or organization is closed, we retain data for as long as reasonably necessary to:

• Comply with tax, accounting, and other legal or regulatory record-keeping obligations (financial and transaction records are typically kept for a minimum of six years, consistent with standard Nigerian financial record-keeping practice);
• Resolve disputes, enforce our agreements, and defend legal claims; and
• Maintain the integrity of records that other, still-active members of an organization are entitled to keep (for example, a building's historical payment ledger).

Where none of the above applies, we delete or anonymize personal data within a reasonable period after it is no longer needed for the purpose it was collected for.

11. Your Privacy Rights

Under the NDPA and its implementing regulations, you have the right to:

• Access the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to our retention obligations in Section 10.
• Restriction — ask us to limit how we process your data in certain circumstances.
• Objection — object to processing based on legitimate interests or direct marketing.
• Data portability — request a copy of your data in a structured, commonly-used, machine-readable format.
• Withdraw consent at any time, for any processing that relies on your consent, without affecting processing already carried out.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC), or your local data protection authority, if you believe we have not handled your data lawfully.

To exercise any of these rights, contact us using the details in Section 18. We will respond within the timeframe required by applicable law, and may ask you to verify your identity before actioning a request. Where a request concerns data an organization (not Lodgely) controls — for example, a landlord's tenancy records about you — we will route your request to that organization and assist as the platform provider.

12. How We Protect Your Data

We apply industry-standard technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) across every Lodgely app and API.
• Password hashing and salting — we never store passwords in plain text.
• Role-based access controls, so staff and platform members only see the data their role requires.
• Payment data handled by a PCI-DSS-compliant payment processor (Paystack) rather than stored on our own servers.
• Network-level protections (firewalls, rate limiting) and continuous monitoring for suspicious activity.
• Internal access controls and confidentiality obligations for employees and contractors who may handle personal data.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you believe you've found a security vulnerability in our Services, please report it responsibly to support@lodgely.ng before disclosing it publicly, so we can investigate and address it.

13. International Data Transfers

Our primary infrastructure and service providers may store and process data in Nigeria and in other countries where our hosting and service providers operate. Where personal data is transferred outside Nigeria, we take steps to ensure it receives a level of protection consistent with the NDPA, including using providers that maintain appropriate security and contractual safeguards.

14. Children's Privacy

The Services are intended for use by adults aged 18 and over — our apps involve tenancy agreements, financial transactions, and property/investment records that require legal capacity to enter into. We do not knowingly collect personal data from anyone under 18. If we learn that we have collected data from a child under 18, we will take steps to delete it. If you believe a child has provided us with personal data, please contact us using the details in Section 18.

15. Third-Party Links & Services

The Services may contain links to third-party websites, or integrate third-party services (such as Paystack for payments, or Google for sign-in). We are not responsible for the privacy practices of these third parties, and we encourage you to review their privacy policies before providing them with information.

16. Data Breach Notification

If a security incident results in unauthorized access to, or loss of, personal data in a way that creates a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission as required by law, and will notify affected users without undue delay, together with information about the nature of the incident and the steps we are taking in response.

17. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, our Services, or applicable law. If we make material changes, we will notify you by email and/or an in-app notice before the change takes effect, and we will update the “Last updated” date above. Continued use of the Services after a change takes effect constitutes acceptance of the updated Policy.

18. Contact Us & Complaints

If you have questions, concerns, or a request relating to this Policy or your personal data, contact us at:

Lodgely Inc.
Email: support@lodgely.ng
Plot 246 Cadastral Zone B10, Jabi-Dakibiu, Abuja, Nigeria