Privacy Policy

1. Introduction

This Privacy Policy explains what personal data OmiChain collects, why we collect it, and the choices you have. It applies to everyone who uses OmiChain, whether as a community member, sponsor/donor, driller, or administrator.

We process personal data in line with the Nigeria Data Protection Act 2023 (NDPA) and its implementing regulations.

2. Information we collect

Account information: your name, email address, phone number, password, role, and — for drillers and sponsors — organisation details you choose to provide.

Location data: the GPS coordinates of water points you report, your approximate location to show nearby projects on the map, and the GPS coordinates captured when you submit or verify completion photos. We only access precise device location when you take an action that needs it, such as reporting a water point or capturing completion proof.

Content you submit: photographs of water points and completed work, written descriptions, comments, and — for driller verification — licence, CAC registration, and past-work documents.

Payment-related information: donation and withdrawal amounts, transaction references, and bank account details you choose to save for payouts. Your card and full bank details are collected and stored by Paystack, not by OmiChain — we only ever receive a verified account name, a masked account number, and transaction status.

Usage information: pages you visit, actions you take in the app, device and browser type, and similar technical data collected automatically to keep the platform secure and working correctly.

3. How we use your information

To create and manage your account, and to route you to the right experience for your role.

To operate the core service: publishing and moderating water point reports, processing donations, running the driller verification and bidding process, verifying completion proof against reported locations, and paying out released funds.

To send you account, transaction, and moderation notifications — for example, that your report was approved, your bid was accepted, or a withdrawal was processed.

To keep the platform safe: detecting fraud, duplicate or false reports, and abuse of the verification or escrow systems.

To improve OmiChain, understand how the platform is used, and meet our legal and regulatory obligations.

4. Our legal basis for processing

We process your data because it is necessary to provide the service you have signed up for (performing our contract with you), because you have given consent (for example, to access your device's location), because we have a legitimate interest in keeping the platform safe and functioning, or because we are required to by law — for instance, for payment record-keeping.

5. How we share your information

With Paystack, to process donations, bid credit purchases, and driller payouts, and to verify bank account details.

With Cloudinary, our image and document hosting provider, to store photos and verification documents you upload.

With Resend, our transactional email provider, to deliver account, verification, and password-reset emails.

With other users, where the platform is designed to show it — for example, a project's location, photos, and funding progress are visible to donors and drillers by design, and your name is visible on comments and bids you make.

With OmiChain administrators, who review reports, driller verification, bids, and completion proof as part of running the platform.

We do not sell your personal data. We may disclose information where required by law or to protect the rights, safety, or property of OmiChain or our users.

6. How long we keep your information

We retain account and transaction data for as long as your account is active and for a reasonable period afterward to meet legal, accounting, and fraud-prevention obligations — donation and payout records in particular are kept for the period required by applicable financial regulations. Content such as report photos remains associated with a project's public history even if a report is later rejected, so the moderation record stays accurate.

7. Your rights

Subject to the NDPA, you have the right to access the personal data we hold about you, request correction of inaccurate data, request deletion of your data (where we are not required to keep it for legal or regulatory reasons), object to certain processing, and withdraw consent for optional processing such as location access at any time through your device settings.

To exercise any of these rights, contact us at hello@omichain.org. We will respond within the timeframe required by applicable law.

8. Security

We use industry-standard measures — including encrypted connections, hashed passwords, and an authentication session that never exposes your login token to client-side scripts — to protect your data. No system is perfectly secure, and we encourage you to use a strong, unique password and to report any suspected security issue to us immediately.

9. Cookies and similar technologies

We use a small number of essential cookies to keep you signed in securely and to remember your role. We do not use third-party advertising trackers.

10. Children's privacy

OmiChain is not directed at, and should not be used by, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

11. International data transfers

Some of our service providers, including Paystack, Cloudinary, and Resend, may process data on servers located outside Nigeria. Where this happens, we rely on those providers' own security and data-protection commitments to ensure your data continues to receive an appropriate level of protection.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy with a new "last updated" date, and will let you know in-app about material changes.

13. Contact us

Questions about this Privacy Policy, or requests relating to your personal data, can be sent to hello@omichain.org.