Privacy Policy

This Privacy Policy explains how NextHome collects, uses, shares, and protects your personal data, in line with Nigeria’s Data Protection Act 2023 (NDPA). By using the Platform you consent to this Policy.

We collect:

• Account data: name, email, phone number, password (stored hashed, never in plain text), and a security recovery answer (mother’s maiden name).
• Verification data: identity documents, proof of ownership, and other documents you upload for role verification. These are stored privately and are not publicly accessible.
• Listing and content data: property details, photos, ad content, and service descriptions you submit.
• Usage data: basic server logs (IP address, timestamps, device/browser information) collected automatically to keep the Platform working and secure.
• Communications: messages sent through the Platform between users, and support requests you send us.

We do not knowingly collect data from anyone under 18.

Why we process your data. To create and secure your account, verify your identity or role, show your listings to the right people, let users contact each other, send OTP codes and account notifications, prevent fraud and abuse, and improve the Platform.

Who we share it with. We share data with:

• Other users, limited to what a listing, profile, or message naturally shows them (we do not share your verification documents with other users — only NextHome admins review those).
• Service providers who process data on our behalf: website hosting (Vercel), cloud hosting (Railway), file storage (Amazon Web Services, for photos and documents), SMS/OTP delivery (Twilio and/or Termii), and email delivery (Brevo, for account and verification emails) — each bound to use your data only to provide that service.
• Law enforcement or regulators, only where required by Nigerian law.

We do not sell your personal data.

Cookies. We use essential cookies to keep you logged in securely (an httpOnly refresh-token cookie), and store a login hint and your selected account role in your browser’s local storage for convenience — neither is used for tracking or advertising. [CLIENT TO CONFIRM: if any analytics or marketing cookies are added later, this section and a cookie-consent banner will need updating — NDPA requires explicit consent for non-essential cookies].

Security. We use encryption in transit (HTTPS), hashed passwords, httpOnly cookies for session tokens, and access controls restricting document access to the account owner and authorised admins. No system is perfectly secure, and we encourage you to use a strong, unique password.

Retention. We keep your data for as long as your account is active, plus a reasonable period afterward for legal, dispute, and fraud-prevention purposes. [CLIENT TO CONFIRM: a specific retention period, e.g. account data deleted/anonymised 12 months after closure, verification documents retained for N years].

Your rights under the NDPA. You have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data, subject to legal retention needs.
• Object to certain processing.
• Receive your data in a portable format.

The Platform currently lets you self-edit your name and phone number directly in your account. For all other rights above — including access, correction of other fields, deletion, objection, or portability — contact us using the details in Section 4 below and we will handle the request manually.

Data breaches. If a breach affecting your personal data occurs, we will notify the Nigeria Data Protection Commission within 72 hours as required by the NDPA, and notify affected users where there is a real risk to their rights.

If you have questions about this Privacy Policy, or want to exercise any of your rights above, contact us at:

[CLIENT TO CONFIRM: support email, e.g. privacy@nexthomeservices.com, and/or a physical address]

If NextHome is classified as an organisation of major importance under the NDPA, a Data Protection Officer will be appointed, and their contact details added here.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. Continued use of the Platform after a change constitutes acceptance of the revised Policy.

Effective date: [CLIENT TO CONFIRM]