Privacy Policy

1. Introduction

Welcome to Direct Crib (“Direct Crib”, “we”, “our”, or “us”).

Direct Crib is a property technology platform that connects property providers- such as landlords, property owners, apartment managers, or space owners, with individuals searching for rental spaces.

Your privacy is important to us. This Privacy Policy explains:

• what personal information we collect,
• why we collect it,
• how we use and protect it, and
• the choices and rights you have regarding your data.

By creating an account or using the Direct Crib platform (mobile app, website, or related services), you agree to the practices described in this Privacy Policy.

This policy complies with applicable Nigerian data protection laws, including:

• Nigeria Data Protection Act (NDPA) 2023
• Nigeria Data Protection Regulation (NDPR) 2019

For privacy questions, contact us at: hello@directcrib.com

2. About Direct Crib

Direct Crib is not a real estate agent and is not a party to any tenancy or service agreement between users.

Our role is to:

• connect property owners with prospective renters,
• allow users to list spaces,
• enable search and communication between users and providers,
• connect clients with artisans and service providers (Artisans Corner),
• support payments between users through our licensed payment processor, Paystack (see Section 5).

3. Information We Collect

3.1 Information You Provide

When you register or use Direct Crib, we may collect:

Basic Account Information

• Full name
• Email address
• Phone number
• Profile photograph (optional)
• Login credentials

Identity Verification (KYC)

To build trust and prevent fraud, we ask for identity checks at the point they matter — for example before a listing goes live, before an artisan profile is approved, before rent is paid, or before a payout. Depending on what you are doing, we may request:

• your National Identification Number (NIN);
• a selfie / short live face capture, compared with the photo on your NIN record (see Section 3.4);
• your Bank Verification Number (BVN), before you receive payouts;
• proof of address (for example a utility bill);
• proof of ownership or authority to rent a property, and other property or tenancy documents;
• company registration (CAC) details for agencies.

Payment and Payout Information

• bank account details for receiving payouts or refunds (bank, account number and account name);
• payment records — amounts, dates, status and references. Card details are entered on Paystack’s page and are never seen or stored by Direct Crib.

Artisans Corner

• artisan profiles — skills, service areas, rates, portfolio photos;
• job posts, bids, milestones, messages and reviews.

Renter Information

Renters may provide:

• Profile details
• Preferred locations
• Budget information
• Communication messages
• Rental enquiries

3.2 Usage Information

We automatically collect certain technical information, including:

• Device type
• IP address
• Browser or app information
• Pages viewed
• Searches made
• Listings interacted with
• Time spent on the platform

This helps us improve user experience and platform performance.

3.3 Communication Data

We collect information when you:

• message another user,
• contact customer support,
• submit complaints or feedback,
• respond to surveys or updates.

Messages may be stored to maintain platform safety and resolve disputes.

3.4 Identity Checks and Biometric Data

Identity checks are carried out for us by Dojah, a Nigerian identity verification provider, which checks your NIN against the National Identity Management Commission (NIMC) database and your BVN against the Nigeria Inter-Bank Settlement System (NIBSS) database.

The selfie / face check is biometric data, which the NDPA treats as sensitive personal data. We only run it with your explicit consent, which we ask for on the screen before the check starts. It is used only to confirm that the person verifying is the owner of the NIN — never for marketing, profiling or any other purpose.

What we keep

• We do not store your full NIN or BVN. We keep a one-way, keyed hash of the number (so the same ID cannot be used on two accounts) and its last 4 digits.
• We keep the result of the check, and its date and reference.
• Once you are verified, we keep a copy of the details on your NIN or BVN record: your registered name, date of birth, gender, phone number, email address and the photo on the record. These are kept in private storage, can be viewed only by authorised Direct Crib staff who handle verification, and every view is logged. We use them to resolve disputes, check that the contact details on your account are genuinely yours, and prevent fraud. They are deleted if the ID is unlinked from your account.
• We keep a one-way, keyed fingerprint of that name and date of birth, and compare your NIN and BVN records with each other, so one person cannot hold several accounts or verify with someone else's BVN.
• We do not keep your selfie. We keep only the result of the face match and its match score.
• Proof-of-address documents, and the ownership or owner-authorisation documents landlords and agents attach to a listing, are kept in private storage that only you and authorised Direct Crib staff can open.

Dojah processes this data on our behalf and may retain records of checks as its own legal obligations require; see Dojah’s privacy policy for details.

4. How We Use Your Information

We use your information for:

Platform Operation

• Create and manage accounts
• Display property listings
• Match renters with available spaces
• Enable communication between users
• Verify property ownership and user identity
• Process rent, artisan and milestone payments, payouts and refunds

Trust & Safety

• Prevent fraud or fake listings
• Perform KYC verification
• Investigate suspicious activity
• Protect users and platform integrity

Platform Improvement

• Understand user behaviour
• Improve search results
• Personalize recommendations
• Develop new features

Communication

• Send service updates
• Provide customer support
• Notify users about bookings or inquiries
• Send optional marketing messages (you can opt out anytime)

5. Payments

Payments on Direct Crib are processed by Paystack, a payment processor licensed by the Central Bank of Nigeria. You enter your card or bank details on Paystack’s own page; Direct Crib never sees or stores your card number.

To pay you out or refund you, we share your name and bank account details with Paystack. We receive and keep payment records (amount, fee, status, dates and references) to run the payment, show your history and receipts, handle disputes, and meet our legal and tax obligations. How payments are released or refunded is set out in our Terms of Service.

6. Information Sharing

We do not sell your personal data. We may share information only in the following situations:

With Other Users

Certain details may be visible to facilitate rentals, including:

• profile name
• property listing details
• contact information (where necessary)
• verification status

This allows renters and owners to evaluate each other.

With Service Providers

We share data with the following providers, only as far as each needs it to do its job for us:

• Dojah — NIN, BVN and face verification;
• Paystack — payments, payouts and refunds;
• Termii — SMS verification codes (your phone number);
• Resend — account and notification emails (your email address and the email content);
• Google Firebase — “Sign in with Google”, if you choose it;
• Cloudflare — storage of photos, documents and other uploads;
• Railway and Vercel — hosting of our servers, database and website.

These providers act on our instructions and are contractually required to protect your information.

Transfers Outside Nigeria

Some of these providers (Resend, Google Firebase, Cloudflare, Railway and Vercel) store or process data on servers outside Nigeria. Where this happens we rely on the safeguards permitted by Sections 41–43 of the NDPA, such as the provider’s data protection terms, and transfer only what the service needs.

Legal Requirements

We may disclose information if required to:

• comply with Nigerian law,
• respond to court orders or regulators,
• prevent fraud or illegal activity,
• enforce our Terms of Service.

7. Legal Basis for Processing Data

We process personal data based on:

• Consent – when you agree to provide information
• Explicit Consent – for the biometric face check, asked for separately before it starts
• Contract Performance – to deliver Direct Crib services
• Legal Obligations – regulatory compliance, including anti-money-laundering and record-keeping duties for payments
• Legitimate Interests – improving platform safety and performance

8. Data Security

We take reasonable technical and organisational measures to protect your information, including:

• encrypted connections,
• storing ID numbers only as keyed hashes, never in full,
• private storage with time-limited links for identity documents,
• restricted, permission-based staff access,
• secure cloud storage,
• routine system monitoring.

However, no online platform can guarantee absolute security. Users are responsible for keeping login details confidential.

9. Data Retention

We keep personal data only for as long as necessary to:

• operate the platform,
• comply with legal obligations,
• resolve disputes,
• prevent fraud.

Identity-verification and payment records are kept while your account is open and for up to five (5) years after it closes, or longer where the law requires.

When your account is deleted we keep the hash of any verified NIN or BVN (never the number itself), so that a person removed for fraud cannot re-verify a new account with the same ID. The hash cannot be turned back into your number.

Detailed usage-analytics records (including the hashed IP) are automatically deleted after 90 days; only anonymous, aggregated totals are kept beyond that for long-term trends.

You may request deletion of your account at any time.

10. Cookies, Analytics and Tracking Technologies

Direct Crib uses cookies and similar technologies to keep you logged in and remember your preferences. You can control cookies through your device or browser settings. Disabling cookies may affect some features.

Usage analytics. To understand how the platform is used and improve it, we record basic, privacy-preserving page-visit information on our own servers. This is first-party and deliberately minimal:

• We do not use analytics cookies or any third-party analytics service — a short-lived session identifier is kept only in your browser’s session storage and is cleared when you close the tab.
• Your IP address is never stored. It is converted to a one-way hash (used only to count unique visitors) and used momentarily to estimate the Nigerian state a visit comes from.
• We record the page visited, approximate state, referring site, and coarse device/browser type — never the content you view privately or any message text.
• We honour your browser’s Do Not Track and Global Privacy Control signals.

This processing relies on our legitimate interest in operating and improving a safe platform. You can opt out at any time from Profile → Settings → Privacy, which stops analytics collection on that device immediately.

11. Your Privacy Rights

Under Nigerian data protection laws, you have the right to:

• access your personal data,
• correct inaccurate information,
• request deletion,
• restrict processing,
• withdraw consent,
• object to marketing communications,
• request transfer of your data,
• not be subject to a decision based solely on automated processing that significantly affects you.

To exercise any of the above rights, contact us at hello@directcrib.com.

Automated Decisions

Identity checks are partly automated: the name on your NIN or BVN is matched to your profile, and your selfie is matched to your NIN photo. If a check fails and you believe it is wrong, contact us and a member of our team will review it.

Complaints

If you are not satisfied with how we handle your data, you can complain to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

12. Third-Party Links and Services

Direct Crib may link to external services, including payment or verification providers and other third-party platforms. We are not responsible for the privacy practices of external websites. Users should review their policies separately.

13. Children’s Privacy

Direct Crib is intended for users aged 18 years and above. We do not knowingly collect personal information from minors.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When significant changes occur, users will be notified through:

• email,
• in-app notification, or
• platform announcement.

Continued use of Direct Crib after updates means acceptance of the revised policy. If you do not agree with this policy, please do not use the platform.