Privacy Policy

This Privacy Policy applies to all users of xairod.com and business.xairod.com. It explains what data we collect, why, how we use it, and your rights.

1. Who We Are

The Xairod platform is operated by USAFA Ltd, registered in England and Wales. For data protection purposes, USAFA Ltd is the data controller. Our Nigerian operating entity is Xairod LLC, registered with the CAC of Nigeria.

Contact: hello@xairod.com

2. What Data We Collect

Data Type	What We Collect	Why
Account Data	Name, email, password (hashed)	To create and manage your account
Profile Data	Nationality, city, role, bio, avatar	To personalise your experience
Contact Data	Phone/WhatsApp (optional)	To facilitate service connections
Request Data	Service requests, descriptions, budget, urgency	To match you with providers
Transaction Data	Quotes, bookings, payment amounts, confirmation codes	To process and record transactions
Business Data	Business name, category, bank details (partners only)	To list and pay partners
KYC Documents	Passport, business registration, medical licence	To verify business partners
Device Data	IP address, browser type	For security and analytics

3. How We Use Your Data

To create and manage your account on the Xairod platform
To match customer requests with appropriate service providers
To process transactions, hold funds in escrow, and issue payouts
To send transaction confirmations, notifications and service updates
To send WhatsApp automation messages related to your requests (with your consent)
To monitor platform safety and detect fraud or policy violations
To comply with legal obligations including anti-money laundering requirements
To improve platform features using anonymised analytics

4. Who We Share Data With

Recipient	What Is Shared	Why
Service Providers (Businesses)	Customer first name, request details, WhatsApp	To deliver the requested service
Paystack	Payment card details, transaction amounts	To process customer payments
Supabase	All platform data	Our database provider
n8n / WATI	WhatsApp messages, lead references	To automate WhatsApp routing
Legal authorities	As required by law	Compliance with court orders

We do not sell your personal data. Xairod products are ad-free.

5. KYC Document Storage

Business partner KYC documents (passports, licences) are stored in a private encrypted Supabase Storage bucket with no public URLs. Only authorised Xairod administrators can access them via time-limited signed URLs (60 minutes). Documents are never displayed publicly.

6. Data Retention

Data Type	Retention Period
Account data	Until deletion + 30 days
Transaction records	7 years (legal compliance)
Chat messages	12 months
KYC documents	Duration of partnership + 1 year
Device/IP logs	30 days

7. Your Rights

Under UK GDPR and Nigeria NDPR you have the right to: access your data, correct inaccurate data, request deletion, receive a portable copy, and object to processing. Email hello@xairod.com to exercise any of these rights. We will respond within 30 days.

8. Security

HTTPS encryption on all connections
Passwords hashed — never stored in plain text
Row-Level Security on Supabase database
Payment data handled exclusively by PCI-compliant Paystack
API keys stored as server-side environment variables only

9. Cookies

We use essential cookies only — required for authentication sessions and platform functionality. We do not use tracking, advertising, or third-party analytics cookies that follow you across other websites.

10. Children's Privacy

Xairod is not intended for persons under 18 years of age. If we become aware that a user is under 18, we will delete their account immediately.

11. Changes

Material changes will be communicated via email and in-app notification at least 14 days before they take effect.

12. Contact

Email: hello@xairod.com
Legal entity: USAFA Ltd, England & Wales
Nigerian entity: Xairod LLC (CAC, Nigeria)
UK regulator: ico.org.uk