Privacy Policy | Settlla

1. Who we are

Settlla Technologies operates the Platform and is the data controller for the personal data described in this policy. Where an agent or landlord uses the Platform to handle a tenant's information for their own letting business, they are also responsible for how they use that information outside the Platform.

You can reach us about anything in this policy at privacy@settlla.com.

2. Personal data we collect

What we collect depends on how you use the Platform and whether you are a tenant, an agent or homeowner, or a landlord whose details an agent adds.

Account and profile

Name, email address, phone number, password (stored only as a secure hash) and the role you sign up with.
If you sign in with Google, your Google account name, email address and profile identifier.
An optional profile photo.
For agents: company name, logo, banner, description, service areas, specialties, years of experience, office address and website.

Identity and professional verification

Your National Identification Number (NIN) slip or card, and a live selfie taken through your device camera, used to confirm your identity.
For agents: professional verification documents such as CAC or RC registration, NBA licence or NIESV membership details, with the reference numbers you provide.
The outcome of each verification, including any reason a submission was not approved.

Listings and landlords

Property details, address and location, photos, walkthrough videos, inspection schedules and supporting documents such as title documents, utility bills and letters of authority.
The landlord's name, phone number and email address, and the bank account that should receive rent (bank, account number and the account name returned by the bank).
Signed tenancy agreement details, including the names and electronic signatures of the people who sign.

Renting activity

Your search preferences, such as budget, preferred locations, property type and move-in date.
Saved properties, inspection bookings, reschedules, cancellations and the feedback you leave after an inspection.
Rental applications, tenancy records, early move-out requests and notices sent on a tenancy (for example a rent increase or renewal notice).

Payments and payouts

Payment amounts, references, status and dates. Card and bank payment details are entered on our payment processors' pages and are handled by them; we do not store your full card number.
Payout bank account details for agents and landlords, used to send rent and fees.

Technical and usage data

Device and browser information, IP address, pages visited, actions taken and error logs.
Session tokens and similar data stored in cookies, local storage and session storage (see section 12).

Communications

Messages you send to us, and the in-app notifications and emails we send you about your account, inspections, applications, payments and tenancies.

3. How we use personal data and our lawful bases

We only process personal data where the NDPA allows it. For each purpose below we rely on one or more of these lawful bases: performing our contract with you, complying with a legal obligation, our legitimate interests (balanced against your rights), or your consent.

Creating and securing your account, signing you in and keeping you signed in (contract).
Verifying identities, agents and listings, and preventing fraud, fake listings and misuse (legitimate interests, legal obligation).
Publishing listings, matching tenants with suitable properties, and letting agents see tenants who are looking for homes like theirs (contract, legitimate interests).
Scheduling inspections, processing applications, preparing tenancy agreements and managing tenancies, including notices and early move-outs (contract).
Taking payments, calculating fees, paying out rent to landlords and fees to agents, and processing refunds (contract, legal obligation).
Sending service messages about your account and activity (contract). Marketing messages are sent only with your consent, and you can opt out at any time.
Providing support, resolving disputes and enforcing our Terms and Conditions (contract, legitimate interests).
Keeping financial, tax and anti-money-laundering records (legal obligation).
Improving and securing the Platform, including analytics and troubleshooting (legitimate interests).

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing that happened before.

4. Matching and automated processing

We use automated tools to rank and match listings with tenants' search preferences and to help answer natural-language property searches. These tools suggest results; they do not decide whether you get a tenancy.

Identity checks may be carried out with the help of a verification provider. At present every identity submission is reviewed by a member of our team before a decision is made. If you disagree with a verification decision, contact us and a person will review it again.

5. Who we share personal data with

We do not sell personal data. We share it only as described here.

Other users of the Platform

Tenants see listing details and the listing agent's public profile. Agents' phone numbers are not shown on public profiles.
Agents see the details tenants include in applications, inspection bookings and tenancies for their listings. Agents looking for tenants see a limited search profile (for example budget, preferred areas and move-in timing) without the tenant's phone number or email address.
Tenants and landlords see the signed tenancy agreement and notices for their own tenancy.

Service providers acting for us

Payment processors (currently Flutterwave and Paystack) to take payments, verify bank accounts and send payouts and refunds.
Identity verification providers to check identity documents when automated checks are enabled.
Cloud hosting and storage providers (including Cloudflare and Render) that host the Platform and store uploaded files.
Email delivery providers that send account and service emails.
Google, if you choose to sign in with Google.
AI service providers that help power property search and internal review tools, under contracts that limit their use of the data.

These providers may only use personal data to provide their services to us and must protect it.

Others

Regulators, law enforcement, courts or other authorities when the law requires it, or to protect the rights, safety or property of our users, the public or Settlla.
Professional advisers such as lawyers, auditors and insurers, under confidentiality duties.
A buyer or successor if Settlla is involved in a merger, acquisition or sale of assets, subject to this policy.

6. Transfers outside Nigeria

Some of our service providers store or process data outside Nigeria. When personal data leaves Nigeria we rely on the transfer grounds in the NDPA, such as adequacy decisions, contractual safeguards or the transfer being necessary to perform our contract with you, and we take steps to make sure your data stays protected.

7. How long we keep personal data

We keep personal data only for as long as we need it for the purposes in this policy.

Account and profile data: while your account is open, then deleted or anonymised after you close it, except as below.
Identity verification documents and selfies: for as long as needed to verify you and handle any dispute about the verification, and removed when no longer needed or when your account is deleted, unless the law requires us to keep them.
Payment, payout, tenancy and agreement records: for the period required by Nigerian tax, accounting and financial regulations (generally at least six years after the transaction).
Security logs: for a limited period, unless needed to investigate an incident.

8. How we protect personal data

We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, access controls that limit staff access to what their role needs, and time-limited links to private files such as identity documents.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the NDPC and, where required, you, as the NDPA requires. Please keep your password private and tell us straight away if you think your account has been compromised.

9. Your rights

Under the NDPA you have the right to:

be informed about how your personal data is used;
access the personal data we hold about you and get a copy;
correct personal data that is inaccurate or incomplete;
ask us to delete your personal data;
restrict or object to certain processing, including processing based on our legitimate interests and direct marketing;
receive your personal data in a commonly used format and have it sent to another controller (data portability);
withdraw consent where we rely on it; and
not be subject to a decision based solely on automated processing that significantly affects you.

You can update most profile details in your account settings. For other requests, email privacy@settlla.com. We may need to confirm your identity first, and we will respond within the time the law allows. Some rights have limits, for example where we must keep records by law.

If you are unhappy with how we handle your personal data, please contact us first so we can try to fix it. You also have the right to complain to the Nigeria Data Protection Commission.

10. Deleting your account

You can delete your account from your account settings. When you do, we close your account and delete or anonymise your personal data, except records we must keep for legal, tax, anti-fraud or dispute reasons, or that relate to an active tenancy or an unsettled payment. Deleting your account does not undo tenancy agreements you have already signed.

11. Children

The Platform is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

12. Cookies and similar technologies

We use cookies, local storage and session storage that are needed for the Platform to work, for example to keep you signed in, remember which dashboard to show, keep your sign-up progress for the current browser session and save listing drafts on your device.

If we add analytics or advertising cookies that are not strictly necessary, we will ask for your consent first. You can clear or block cookies in your browser settings, but parts of the Platform may stop working.

13. Changes to this policy

We may update this policy from time to time. We will post the new version on this page with a new effective date and, for significant changes, let you know by email or in the app before they take effect.

14. Contact us

For privacy questions or to exercise your rights, email privacy@settlla.com. For general support, email support@settlla.com.