How CraftCred handles platform data.

Who we are

CraftCred is operated by Billaza Technologies Ltd, a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020 (RC 9533555), with its registered office at 26 Oroki Estate, Phase 2, Agunbelewo Road, Osogbo, Osun State, Nigeria ("Billaza", "CraftCred", "we", "us", or "our").

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), Billaza Technologies Ltd is the data controller for the personal information described in this policy. You can reach us about anything in this policy at support@craftcred.africa or through the Contact page on this website.

Scope of this policy

This policy covers the CraftCred website, web application, and API -- however you access them, and whichever role you use them in (artisan, master, employer, association officer, or administrator). It also covers information about people who are not CraftCred account holders but whose information reaches us through the platform -- for example, a reference named in a master-access application, or an employer named in a work-confirmation record.

This policy does not cover third-party websites or services you may reach through a link from CraftCred (for example, a payment page hosted by our payment processor). Read their own privacy notices separately.

Information we collect

What we collect depends on your role and what you choose to do on the platform. Broadly, it falls into these categories:

Information about other people

Some CraftCred workflows ask you to provide information about someone else -- for example, a community reference on a master-access application, an employer's contact details on a work-log entry, or a person you name in a dispute. If you submit another person's personal information to CraftCred, you confirm that you have their permission to share it with us for that specific purpose, and that you have told them we may contact them about it. We use that information only for the workflow it was submitted for.

Identity verification (NIN)

This section describes how NIN verification works in the current build, so it's accurate even while the feature is not yet publicly available.

• Your NIN is sent to our server over an encrypted connection for the single purpose of that verification request. It is never written to our database or to any log file -- not for 24 hours, not temporarily. Once the request completes, the full number is gone.
• What we keep afterward is a masked reference showing only the last 4 digits, plus the verification outcome (matched or not matched) and a confidence score. That's enough to show your "identity confirmed" badge without CraftCred ever holding your full NIN.
• The identity-check step (confirming you're a real person, not a photo) does not currently capture, transmit, or store any camera image, video, or biometric template. When a licensed verification partner is connected, this policy will be updated before that partner starts receiving any identity data, and we will name that partner here.
• NIN verification is optional and requires a one-time fee. Declining it does not affect your ability to use the rest of CraftCred -- it simply means you won't have the identity-confirmed badge.

Sharing credit-related information with lending partners

Artisans can choose to let CraftCred share a trust-based credit signal with partner microfinance banks, to help them qualify for credit based on verified work history rather than paperwork they may not have.

• This is entirely opt-in. Nothing is shared with a lending partner unless you've given consent, and you choose what that consent covers and for how long it lasts (between 7 and 365 days). You can revoke it at any time.
• When a partner institution queries your record with valid consent, we share your name, phone number, and a credit-proxy score and band calculated from your trust score and years of experience -- not your trust-score breakdown, not your work history in detail, and never your NIN.
• Every query -- whether it results in data being shared or is declined -- is logged, including which partner made it and when, so there's a full audit trail you or we can review.
• We keep detailed query logs for 180 days, after which they are automatically deleted. A separate, pseudonymized record (not tied to your name) is kept for longer-term platform governance and fraud analysis.

Cookies and similar technologies

CraftCred uses a small number of cookies, all required to keep your account secure -- we don't use advertising or cross-site tracking cookies. The full list of cookies, what each one does, and how long it lasts is in our Cookie Policy. In short: two cookies keep you signed in, one protects your account against cross-site request forgery, and one is a non-sensitive hint used only to decide whether to attempt a silent sign-in refresh.

How we use information

We use the information above to:

• Provide platform access and operate your account, under the contract formed by our Terms of Service.
• Issue, display, and verify credentials, and run association, master, and employer workflows.
• Calculate trust scores, achievements, and other credibility signals.
• Process payments and payouts, and prevent fraud, under our legitimate interest in running a trustworthy payment system and our contractual obligations to you.
• Respond to support requests, disputes, and legal or regulatory obligations.
• Send you service messages you need to use the platform (for example, verification links and dispute notices) -- this is necessary to provide the service, not something you can opt out of while keeping your account.
• Send you marketing or newsletter content, but only where you've given consent, as described below.
• Improve platform reliability and performance, including through error monitoring tooling.

Third-party service providers

We work with a small number of named service providers, each used strictly for the function below. None of them are permitted to use your information for their own marketing purposes.

• Paystack -- payment processing, payouts to masters and associations, and bank account verification for payout setup.
• Resend -- delivery of transactional emails (verification links, receipts, notifications).
• Termii -- delivery of SMS and WhatsApp messages, including one-time verification codes.
• Sentry -- error monitoring, to help us detect and fix technical issues. This is only active where we've enabled it; it does not collect browsing history or run on every visitor by default.
• Google Fonts -- our pages load typefaces from Google's font service, which means your device makes a direct request to a Google domain on every page load. Google's standard font-serving infrastructure does not set tracking cookies for this.
• Neon -- our managed PostgreSQL database provider, which stores the information described in this policy on our behalf under a data-processing agreement.

Where your information is stored

Our database infrastructure is provided by Neon, whose servers may be located outside Nigeria, including in the United States. This means some of your information may be processed or stored outside the country. Where that happens, we rely on contractual protections with our providers and encryption in transit to keep it secure, consistent with the cross-border transfer requirements of the Nigeria Data Protection Act 2023. We don't sell, rent, or transfer your information to any third party for their own marketing or analytics use.

Public profile controls

Artisan, master, and employer profiles are private by default. Nothing about your account appears on a public profile page, a discovery page, or search results unless you explicitly switch your profile to public and choose what sections are visible, from a granular set of toggles (headline, trust score, portfolio, credentials, association memberships, work stats, location, and more). Administrators and other internal account types never get a public profile, regardless of this setting.

One exception, by the nature of the feature: if someone scans or enters your credential code to verify it, the verification result (whether that specific credential is valid) is, by design, publicly checkable -- that's what a verifiable credential means. This doesn't expose your full profile, only the verification result for that specific code.

Marketing communications

We send newsletter and product-update emails only to people who have opted in -- by ticking the marketing checkbox during signup, or by subscribing through the blog page. The lawful basis is your consent, and we keep a timestamped record of when and how it was given, including the subscription source.

Every marketing email includes a one-click unsubscribe link, and we act on unsubscribe requests immediately. If you unsubscribe, you stay unsubscribed -- we don't silently re-add you to the list if you interact with CraftCred again later; a fresh opt-in requires a fresh, explicit action from you. Opting out of marketing email never affects transactional messages you need to use the platform.

Data retention

We keep information for as long as it's needed for the purpose it was collected, including to maintain the accuracy and integrity of the credential and verification system -- which, by its nature, depends on records not quietly changing or disappearing over time. Roughly:

• Credential, work-history, and audit records are retained indefinitely while your account is active, because their value as a trust record depends on continuity -- a credential history with gaps is a weaker credential history.
• Raw NIN data is never retained at all, as described above.
• Credit-partner query logs are deleted after 180 days; a pseudonymized version is retained longer for governance and fraud-prevention purposes.
• Marketing consent records are kept until you unsubscribe, plus a reasonable period afterward to prove we honored the unsubscribe request if ever challenged.
• Security logs (sign-in sessions, password-reset tokens, IP/device records tied to account events) are kept for as long as they remain useful for fraud and abuse prevention.

Your rights and choices

Under the Nigeria Data Protection Act 2023, and as a matter of how we want to run CraftCred regardless, you can ask us to:

• Access the personal information we hold about you.
• Correct information that's inaccurate or incomplete.
• Object to, or ask us to restrict, certain processing -- for example, withdrawing marketing consent at any time.
• Delete your account. Here's exactly what that means in practice: deactivating your account hides your public profile and signs you out everywhere immediately. We don't erase your underlying records outright, because credentials, work-history confirmations, and dispute records need to remain intact for the people who relied on them -- an employer who verified your credential six months ago needs that verification to still mean something. What we do instead is deactivate the account and remove or anonymize the personal details that aren't needed to preserve that integrity. If a specific legal or regulatory reason requires full erasure of particular information, we'll do that and tell you.
• Request a copy of your information in a portable format.
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe we've mishandled your information. We'd genuinely rather you raised it with us first, through the Contact page, so we can try to fix it directly.

To make any of these requests, contact us through the Contact page or at support@craftcred.africa. We'll need to verify it's really you asking before acting on it, and we'll respond within a reasonable time.

Children

CraftCred is built for working adults and is not directed at children. We do not knowingly collect personal information from anyone under the legal working age in their jurisdiction. If we learn that we've collected information from a child, we'll delete it.

Security

We use encrypted connections (TLS) for data in transit, password hashing, access controls scoped to what each role actually needs, httpOnly session cookies that can't be read by page scripts, and CSRF protection on state-changing requests. No system is perfectly secure, and we keep improving these measures as the platform grows.

Changes to this policy

We'll update this policy as CraftCred's features change -- for example, when NIN verification goes live with a named provider. When we do, we'll revise the "last updated" date at the top of this page. For a material change to how we use your information, we'll make a reasonable effort to let existing users know, not just quietly update the page.

Questions or complaints

If you have questions about this policy, want to exercise any of the rights above, or have a concern about how your information is handled, contact us through the Contact page or at support@craftcred.africa. If you're not satisfied with our response, you have the right to escalate to the Nigeria Data Protection Commission (NDPC).