StrictlyByIV

Legal

Privacy Policy

This policy explains what personal data StrictlyByIV collects, why we use it, who we share it with, where it is stored, how long we keep it, and the rights you have over it, wherever you use the app.

1. Who we are

StrictlyByIV is operated by DERVLABS LTD, a private company limited by shares incorporated in Nigeria under the Companies and Allied Matters Act 2020 (RC 9030571), with its registered office at 9 Salami Somade Estate, Basorun, Ibadan, Oyo State, Nigeria. In this policy, "StrictlyByIV", "we", "us", and "our" mean DERVLABS LTD.

We are the data controller for the personal data described in this policy. This policy applies to the StrictlyByIV mobile apps, the strictlybyiv.com website, and related support and communications. We follow the Nigeria Data Protection Act 2023 (NDPA) and, where they apply to you, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

2. Information we collect

Information you give us

  • Account details: your name, email address, phone number, password (stored only as a one-way hash), profile photo, and the roles you use, such as host, planner, vendor, or venue.
  • Sign-in with Google or Apple: if you choose one of these, we receive your name, email address, and profile photo from that provider. Apple may give us a private relay email address instead of your real one.
  • Events and guests: event titles, dates, descriptions, addresses and map locations you enter, checklists, budgets, collaborators, and guest lists. Guest lists can include the names, phone numbers, email addresses, and notes of people who are not StrictlyByIV users, added one by one, from a spreadsheet you upload, or from your contacts. Guests who reply to an invitation can add a message and dietary notes, which the host sees. If you add guests from your phone's contacts, only the contacts you pick are uploaded; we do not read or store the rest of your address book.
  • Marketplace profiles: business name, bio, service categories, service area, state, local government area, business address and map location, photos, videos, packages, prices, policies, and FAQs.
  • Bookings: booking requests, dates, amounts, counter-offers, notes, cancellation and decline reasons, and dispute details.
  • Messages and reviews: messages, photos, videos, and files you send in conversations; reactions; ratings and written reviews; and reports you file about other users or content.
  • Payout details (providers): bank name, bank code, account number, and account holder name.
  • Identity verification (providers): described in section 4.
  • Refer and earn: the invite code you add to your account, and, if you are paid rewards, the bank account they go to (bank name, bank code, account number, and account holder name). If you are not a verified provider, you confirm your identity once with your NIN before you can be paid (see section 4). The Refer and Earn Terms explain how the programme works.
  • Email updates: if you sign up for updates on our website, we keep your email address and, if you choose to tell us, whether you plan events or provide services. We use them only to send occasional news about StrictlyByIV, such as event ideas, new vendors and venues, and app updates. We add you only after you confirm through the link in our first email, and every email has an unsubscribe link.
  • Support: what you tell us when you contact support, and the reason you give if you delete your account.

Information created when you use StrictlyByIV

  • Payment, refund, payout, and subscription records, including payment references, status, and amounts.
  • Notification history and push notification tokens for your devices.
  • Online status: while the app is open, we note that you are online so people you have exchanged messages with in a one-to-one chat can see it. It ends a few minutes after you close the app at most, and it is never stored as a history, so we do not record or show when you were last online. You can turn it off in Profile, then Chats (see section 12).
  • Records of actions our staff take on your account, bookings, or content.
  • Refer and earn records: who invited whom, how far each referral has got, and the rewards and payouts made.

Technical information

  • App analytics: screens viewed, in-app events (for example, whether a sign-in succeeded or an event was saved), an app-instance identifier, device model, operating system, app version, and approximate location derived from your IP address. Analytics is not linked to your account, name, or email address, and you can turn it off at any time (see section 12).
  • Website analytics: when you visit strictlybyiv.com, including shared provider, event, and browse pages, Cloudflare Web Analytics records the page you viewed (without anything after the "?" in its address), the site that referred you, your browser, operating system, and device type, your country, and how quickly the page loaded. It uses no cookies or similar storage on your device, does not fingerprint you, and is not linked to your account. It is not used on guest invitation or planning-team invite pages, because their addresses contain private links.
  • Crash and error reports (always on): stack traces, device and operating-system details, your account identifier, and diagnostic log lines at the time of the error. While analytics is on, they also list the screens you opened and actions you took just before the error. Crash reports do not include your messages, guest lists, or the content of your requests.
  • App platform and version: when you use the app while signed in, we record which platform you used (Android, iOS, or desktop), the app version, and when you first and last used it on that platform, linked to your account. We use this to keep older versions working, decide when to stop supporting them, and count how many people use each platform. We don't record your device model, IP address, or location with it. This is separate from app analytics and is not affected by the analytics setting.
  • Refer and earn fraud checks: a random identifier for each installation of the app, stored only as a one-way keyed hash and linked to your account, so we can tell when an inviter and the person they invited use the same phone; and a one-way keyed hash of a payout account number, so one bank account can't be registered by two people. On Android, if you install the app from an invite link, Google Play tells the app which invite brought you; the app keeps only the invite code from it. If you tap Paste where the app asks for an invite code, it reads your clipboard at that moment only, and never otherwise.
  • App integrity checks: tokens from Google Play Integrity or Apple App Attest confirming that requests come from a genuine copy of the app.
  • IP address: used for a short time to rate-limit sign-in and other sensitive requests and to protect the service from abuse.

We do not collect your device's precise location, and we do not use advertising identifiers. StrictlyByIV does not show ads and does not sell personal data.

3. How we use information and our legal bases

Data protection law requires a legal basis for each way we use personal data. We rely on the following:

  • To provide the service you asked for (contract): creating and securing your account; running events, guest management, collaboration, messaging, the marketplace, Refer and earn, bookings, payments, refunds, disputes, subscriptions, and payouts; and sending account, booking, payment, and security notifications.
  • To keep StrictlyByIV safe and working (legitimate interests): preventing fraud, abuse, and unauthorized access, including referrals that reward someone for inviting themselves; enforcing our terms and community guidelines; handling reports and disputes; diagnosing crashes and errors so the app stays stable and secure; and understanding in aggregate how the app and website are used so we can improve them. We weigh these interests against your rights, and you can object to them (see section 11).
  • With your consent: app analytics, if you are in the European Economic Area or Switzerland, where we ask before collecting any; accessing your phone's contacts, camera, or photos when you choose to use those features; sending push notifications; and sending email updates you signed up for on our website. You can withdraw consent at any time in the app's Privacy settings or your device settings, or, for email updates, with the unsubscribe link in any update. Withdrawing consent does not affect processing that already happened.
  • To meet legal obligations: keeping financial and tax records, verifying provider identities where required to prevent fraud and money laundering, and responding to lawful requests from authorities.

We do not use your data for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects without offering a human review.

4. Identity verification for providers

We may ask a vendor, venue, or planner to verify their identity before they can receive payouts, to protect customers from fraud and to meet anti-money-laundering expectations. We use Dojah (Dojah Inc., Nigeria) to check the details you submit against official records:

  • Individuals: your National Identification Number (NIN) is checked against the National Identity Management Commission (NIMC) database.
  • Businesses: your company registration (RC or BN) number and company type are checked against the Corporate Affairs Commission (CAC) register, which returns the registered name and whether the registration is active. You also give your own NIN as the business’s representative.

Dojah returns the legal name on the record. We compare it with your profile name and your payout bank account name. We ask for your consent before submitting a check.

Business verifications are always reviewed by a member of our team before a business is marked verified. As part of that review we may ask Dojah for the list of people the CAC register names for the business (its directors, proprietors, or trustees) and compare your name with it. That list is official register data about those people; we use it only for this comparison and keep only the outcome.

What we keep: the verification result and status, the last four digits of the ID number, a one-way keyed hash of the full ID number (so we can detect the same ID being used on another account), and the matched legal name, which is encrypted. For a business we also keep, encrypted, the company registration number (so our team can check it again later without asking you) and the representative’s name as it appears on their NIN record. We do not store your full ID number, date of birth, photo, gender, or phone number from the identity record, even when the official record contains them. We do not collect selfies or photos of ID documents.

If a personal check fails or the names do not match, a member of our team can review it. Contact us if you believe a result is wrong.

Refer and earn: rewards are paid only into a bank account in your own verified name. If you are not already a verified provider, you confirm your identity once with your NIN when you add that account, and the same check, records and limits described above apply. We also compare the verified identity of the person you invited with yours and with earlier referrals, so the same person can't be counted twice.

5. How information is shared

With other users, as part of the service: your marketplace profile, public events, and reviews are visible to others. If you join with someone's invite code, they see your first name and last initial and how far your referral has got, and you see theirs the same way before you confirm the code. Booking details and messages are shared with the other party to the booking. Event details are shared with the collaborators you invite, and guest-facing event information is shared with guests.

With our staff, only when needed: StrictlyByIV staff do not read booking conversations as a matter of course. The messages and attachments in a booking become readable by staff only when that booking needs adjudication: when you or the other party opens a dispute, or when someone reports the booking, the conversation, or a message in it. Access is limited to staff who hold the relevant permission, and the decisions they take are recorded in an internal audit trail.

Staff may also send you a message about a booking. It reaches you from StrictlyByIV in your notifications, and by push notification, email, or both, rather than being added to the conversation between you and the other party.

Deleting a message: when you delete a message, its text and attachments are erased and cannot be recovered. If someone reported the message before you deleted it, the copy attached to that report is kept so the report can be handled (see section 9).

With service providers who process data for us under contract (see section 7).

For legal reasons: with regulators, law enforcement, courts, or professional advisers when the law requires it, or when it is necessary to establish or defend legal claims, prevent fraud, or protect someone's safety.

Business transfers: if DERVLABS LTD is involved in a merger, acquisition, or sale of assets, personal data may transfer to the new owner. It would remain protected under this policy, and we would tell you before it becomes subject to a different policy.

6. Payment and financial data

Card and bank payments are handled by Paystack. You enter your card or bank details directly on Paystack's secure checkout; StrictlyByIV never receives or stores your full card number or card security code. We receive payment status, references, amounts, and your email address.

To pay providers, and to pay Refer and earn rewards, we send Paystack the bank code, account number, and account holder name. We use Paystack to confirm the name on a bank account before payouts are set up.

Subscriptions bought outside the app stores are billed through Paystack in the same way. If you buy a subscription through Google Play or the Apple App Store, that store processes the payment under its own privacy policy. We receive a purchase token or transaction identifier and a random account reference that lets us unlock your plan, but not your payment details.

7. Our service providers

We use the following providers to run StrictlyByIV. Each one processes personal data only on our instructions or, where noted, under its own privacy policy.

  • Railway (Railway Corporation, United States): application hosting, database, cache, and message queue. Our production servers are located in the Netherlands (EU).
  • Cloudflare (Cloudflare, Inc., United States): delivery and security of our website, Web Analytics for aggregate website visits (no cookies), and R2 storage and delivery of photos, videos, and files you upload.
  • Google Firebase (Google LLC, United States): Cloud Messaging for push notifications, Analytics for aggregate usage, Crashlytics for crash reports, and App Check for app integrity. The app also uses Google ML Kit to scan QR codes on your device; the camera image stays on your device, but Google may receive anonymous usage statistics about the scanner. Push notification previews (for example, the sender and the start of a message) pass through Google's and Apple's notification services to reach your device.
  • Sentry (Functional Software, Inc., servers in Germany, EU): server error monitoring.
  • Brevo (Sendinblue SAS, France, EU): transactional email, such as verification codes, receipts, and booking updates, and the email updates you can sign up for on our website.
  • Termii (Termii Inc., Nigeria): SMS verification codes.
  • Paystack (Paystack Payments Limited, Nigeria): payments, refunds, payouts, and bank account name checks.
  • Dojah (Dojah Inc., Nigeria): provider identity verification.
  • Google Sign-In and Sign in with Apple (Google LLC and Apple Inc., United States): optional sign-in, under Google's and Apple's own privacy policies.
  • Google Play and the Apple App Store: app distribution and in-app subscription billing, and on Android telling the app which invite link an install came from, under their own privacy policies.

8. International data transfers

StrictlyByIV is based in Nigeria and used worldwide, so your data is processed outside the country where you live. Depending on the provider, it may be stored or processed in Nigeria, the European Union, the United States, or other countries where our providers operate.

When we transfer personal data out of Nigeria, the EU, or the UK, we do so only where the NDPA, GDPR, or UK GDPR allows it. This means the destination is recognised as providing adequate protection, or we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or equivalent contractual commitments approved under the NDPA. You can ask us for more information about the safeguards for a particular transfer.

9. How long we keep information

We keep personal data only as long as we need it for the purposes in this policy. In particular:

  • Your account: for as long as it is open. If you delete your account, it is disabled immediately and your personal data is deleted or anonymized 30 days later (see Account deletion).
  • Financial and booking records (payments, refunds, payouts, settlements, subscription billing, bookings, and disputes): 6 years after the end of the financial year in which the transaction took place, to meet tax, accounting, and legal obligations. After an account is deleted these records are kept in a form detached from your name and contact details.
  • Identity verification records: the status, last four digits, and hashed ID number are kept for 6 years after your account is closed, for fraud and anti-money-laundering purposes. The matched legal name, the representative’s name, and the company registration number are erased when your account is deleted. Cached lookup results from Dojah, including any list of a business’s registered officers fetched during a review, are discarded after 14 days.
  • Refer and earn records: referrals that end without a reward are deleted 2 years after they end; referrals that led to a payment, and the payouts themselves, follow the 6-year schedule for financial records. Referrals still in progress or still owed are kept until they finish. If you delete your account, your invite code stops working at once; when the account is removed, your name on other people's referral lists is replaced with "Deleted account", and your payout account and installation records for the programme are deleted.
  • Deleted messages: text and attachments are erased at the moment of deletion. When you delete your account, the text and attachments of messages you sent are erased too.
  • Reports and moderation records, including any copy of a reported message: 2 years after the report is resolved, or longer if needed for an ongoing dispute or legal claim.
  • Staff audit and security records: 2 years, except records of decisions about money (refunds, payouts, and dispute outcomes), which follow the 6-year schedule for financial records.
  • Message delivery records (used to confirm a notification reached your device): 30 days.
  • Verification codes and password-reset links: deleted within a day after they expire or are used. Sign-in sessions expire after 7 days.
  • Email updates: until you unsubscribe or ask us to remove you. Sign-ups that are never confirmed are never added to our mailing list.
  • App platform and version records: while your account is open; deleted when you delete your account, or after 400 days without use.
  • Analytics and crash data: app analytics data is kept for 2 months; crash reports are kept for 90 days. Website analytics is kept in full by Cloudflare for 7 days, then only as a reduced sample, and we can view it for up to 6 months.
  • Backups: deleted data may remain in encrypted backups until those backups expire in the normal cycle.

Reviews you wrote stay attached to the provider's rating after your account is deleted, but your name, photo, and review text are removed. A deleted provider's business name stays on past bookings so the other party's records remain accurate.

10. How we protect information

  • All connections between the app, our servers, and our providers are encrypted in transit (HTTPS/TLS).
  • Passwords are stored only as one-way hashes. Identity numbers are stored as keyed hashes, and verified legal names are encrypted with AES-256.
  • Sign-in tokens are short-lived, and repeated failed sign-in attempts temporarily lock the account.
  • Staff access is limited by role and permission, and staff actions are recorded in an audit trail.
  • We never handle full card details; card payments go directly to Paystack.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify you and the relevant regulator as the law requires.

11. Your rights

Depending on where you live, and in all cases under the NDPA, you have the right to:

  • Access the personal data we hold about you and get a copy of it.
  • Correct data that is inaccurate or incomplete. You can edit most of it directly in the app.
  • Delete your data. You can delete your account in the app, subject to the records we must keep (see section 9).
  • Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation where technically feasible.
  • Object to processing based on our legitimate interests.
  • Restrict processing while a complaint or correction is being resolved.
  • Withdraw consent at any time, where we rely on consent.
  • Human review of any decision made solely by automated means that significantly affects you.
  • Complain to a data protection regulator (see section 15).

To exercise these rights, email [email protected] from the email address linked to your account. We may ask you to confirm your identity. We respond within 30 days; if a request is complex, we will tell you if we need longer and why. Making a request is free unless it is clearly unfounded or excessive.

12. Your choices

  • Analytics: you can turn app analytics on or off at any time in Profile, then Privacy, or before you sign in, from Privacy choices on the welcome screen. If you are in the European Economic Area or Switzerland, analytics stays off until you allow it. Turning it off stops collection immediately and clears the analytics data stored on your device. Crash reports are always sent because we need them to keep the app working and secure.
  • Website analytics: it uses no cookies and is not linked to you. A browser setting or content blocker that blocks cloudflareinsights.com stops it.
  • Online status: turn off "Show when I'm online" in Profile, then Chats, and nobody sees when you are online. While it is off, you do not see when others are online either.
  • Permissions: you can turn off contacts, camera, photo, and notification access in your device settings at any time. Related features stop working until you turn them back on.
  • Event visibility: private events stay off search and discovery. Public events can be found by others.
  • Email updates: use the unsubscribe link in any update, or email us, and we stop sending them.
  • Account deletion: you can delete your account in the app under Profile, then Account settings.

13. Age requirement

StrictlyByIV is for adults. You must be at least 18 years old to create an account. The service is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

Guest lists may include people of any age. Hosts are responsible for having a lawful basis to share their guests' details with us.

14. Changes to this policy

We may update this policy when our service, providers, or legal requirements change. We will update the "Last updated" date at the top of this page. If a change materially affects how we use your personal data, we will tell you in the app or by email before it takes effect.

15. Contact and complaints

Questions, requests, and complaints about privacy or data handling can be sent to [email protected] or by post to DERVLABS LTD, 9 Salami Somade Estate, Basorun, Ibadan, Oyo State, Nigeria.

If you are not satisfied with our response, you can complain to a data protection regulator:

  • Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
  • European Union: the data protection authority in the country where you live or work.
  • United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.
  • Elsewhere: your local data protection authority.