Privacy policy

Kuava Estate Access is an estate access and visitor management service operated by Kuava X for residential estates in Nigeria. Residents use the mobile app to invite visitors, gate staff use it to check passes, and estate management uses the web dashboard. This policy explains what personal data the service handles and why, in line with the Nigeria Data Protection Act 2023 (NDPA).

Who is responsible

Your estate decides to use Kuava Estate Access to run its gates, and Kuava X runs the service for the estate. Questions about your registration or a decision by your estate go to your estate management office. Questions about this policy or your data rights can also go to Kuava X at autakuturanki@gmail.com.

What we collect

• Your account: name, email address, password (stored only as a secure hash by our authentication provider) and, for residents, phone number.
• Your registration: your estate, house, whether you are the owner, a tenant or an authorised occupant, and any note you add to help the estate verify you.
• Visitors you invite: the visitor's name and, if you give them, their phone number, vehicle plate and the purpose of the visit, plus the pass dates.
• Gate records: when a pass was checked, at which gate, by which officer, and whether entry or exit was recorded or refused. Gate staff may take an optional photo of a visitor at the gate.
• Security records: incidents logged by security, and the estate's blacklist (a name with a phone number or vehicle plate, and a reason).
• Notifications: a device token so the app can send you alerts, and the alerts themselves. If your estate turns on SMS and you choose “Text message alerts”, urgent alerts are also sent to your phone number by text.

The app uses the camera only to scan visitor passes and, for gate staff, to take a visitor's photo. It does not collect your location, contacts or files, and it shows no advertising.

Why we use it

Only to run the estate's gate security: to check that residents are who they say they are, let invited visitors in, tell residents when their visitors arrive, keep a record of who entered and left, and handle security incidents. We do not sell personal data or use it for marketing. Our legal basis is the estate's legitimate interest in keeping residents safe and, for SMS alerts, your consent.

Who can see it

• Your estate's administrators and security staff, for the estate you belong to only.
• Residents see the visitors they or their household invited. Visitors see only their own pass. Residents never see the blacklist, incident details or visitor photos.
• Service providers that host or deliver the service for us, under contract: Supabase (database and sign-in, hosted in London, UK), Vercel (website), Expo (app notifications) and, only if SMS is turned on, Termii (text messages in Nigeria).

How long we keep it

• Visitor details (name, phone number, plate, photo) are removed automatically after the period your estate sets — between 90 and 730 days, 365 days by default. Gate records keep the dates and times but no longer say who.
• Notifications are deleted after 90 days.
• Your account details are kept while you use the service. You can close your account at any time.
• Records of approvals and other administrative actions are kept as an audit trail the estate relies on.

Your rights

Under the NDPA you can ask to see, correct or delete your personal data, or object to how it is used.

• Get a copy: in the app, open Your data and alerts and tap Get my data.
• Delete your account: see how to delete your account.
• Visitors can ask the estate office to erase their details. The estate removes their name, phone number, plate and photo straight away.

You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Security

Data is encrypted in transit. Access is checked by the database itself for every request, so each person sees only what their role allows. Visitor passes are single-use codes checked online at the gate; only a scrambled form of each code is stored. Administrative actions are recorded in a log that cannot be edited.

Changes

If this policy changes, we will update the date at the top of this page.