Privacy Policy
Last updated: June 2026
1. Who We Are
AEON Digital is a Nigerian marketing software platform that enables businesses to send email, SMS, and WhatsApp campaigns. We are the Data Controller for personal data collected through this platform. Our registered address is Nigeria. You can reach our Data Protection Officer at privacy@aeondigital.ng.
2. Data We Collect
We collect the following categories of personal data:
Account Data
- Full name, email address, phone number
- Business name
- Password (stored as a secure hash — never in plain text)
Campaign Data
- Message content you create
- Recipient phone numbers and email addresses you upload
- Campaign performance metrics (delivery rates, open rates)
Payment Data
- Transaction references and amounts (processed by Flutterwave — we do not store card numbers)
- Credit balance and transaction history
Technical Data
- IP address and browser type (for security and fraud prevention)
- Log data and error reports
- Usage patterns within the platform
3. How We Use Your Data
We process your data only for legitimate purposes with a lawful basis under NDPR:
Service delivery
Sending your campaigns, processing payments, maintaining your account
Security & fraud prevention
Rate limiting, bounce protection, abuse detection
Legal compliance
Responding to lawful requests from Nigerian authorities
Platform improvement
Aggregated, anonymised analytics to improve features
Marketing (our own)
Only if you opt in — you can unsubscribe at any time
4. Your Recipients' Data
When you upload contact lists (phone numbers, email addresses) to send campaigns, you are the Data Controller for that data. AEON Digital acts as your Data Processor. You are responsible for ensuring you have lawful basis (typically consent) to message those contacts, and that your campaigns comply with NDPR opt-in requirements. We process recipient data only to deliver your campaigns and to honour opt-out requests (STOP replies, unsubscribe links). We do not sell, share, or use your recipients' data for any other purpose.
5. Data Sharing
We share your data only with the following service providers, under data processing agreements:
Supabase
Database and authentication
Resend
Email delivery infrastructure
BulkSMS Nigeria
SMS delivery
Twilio
WhatsApp messaging
Flutterwave
Payment processing
Vercel
Application hosting
Cloudflare
Security (CAPTCHA)
We do not sell your data to third parties. We do not share data with advertisers.
6. Data Retention
Account and profile data
Until you delete your account
Campaign data and analytics
24 months after campaign creation, then anonymised
Payment records
7 years (required by Nigerian tax law)
Security logs (IP, rate limit data)
90 days
Email/SMS suppression lists
Indefinitely (required to honour opt-outs)
SMTP passwords
Until you delete the config — stored AES-256-GCM encrypted
7. Your Rights Under NDPR
Under the Nigeria Data Protection Regulation, you have the following rights:
Right to Access
Request a copy of all data we hold about you
Right to Rectification
Correct inaccurate data in your profile settings
Right to Erasure
Delete your account and all associated data from Settings → Delete Account
Right to Data Portability
Export your campaign data as CSV from Settings → Export My Data
Right to Object
Object to processing based on legitimate interest
Right to Withdraw Consent
Unsubscribe from our marketing at any time
To exercise any right, email privacy@aeondigital.ng. We will respond within 30 days as required by NDPR. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.
8. Security
We implement appropriate technical and organisational measures to protect your data, including: TLS encryption in transit, AES-256-GCM encryption for sensitive credentials at rest, row-level security on all database tables, rate limiting on authentication endpoints, CAPTCHA protection on sign-up and sign-in forms, and automatic suspension of accounts with abnormal sending behaviour. No security measure is 100% foolproof. In the event of a data breach that affects your rights, we will notify you within 72 hours as required by NDPR.
9. Cookies
We use only essential cookies required for authentication (session tokens set by Supabase). We do not use advertising cookies, tracking pixels, or third-party analytics cookies. You cannot opt out of essential cookies without losing the ability to sign in.
10. Children's Data
AEON Digital is a business platform not intended for use by persons under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us at privacy@aeondigital.ng and we will delete it.
11. Changes to This Policy
We may update this policy to reflect changes in our practices or Nigerian law. We will notify you of material changes by email and by displaying a notice in the platform at least 14 days before the change takes effect. Continued use of the platform after that date constitutes acceptance.