Privacy Policy

Zed ("we", "us", or "our") operates the Zed digital operating system for Nigerian youth, encompassing the web application, Progressive Web Application (PWA), and associated sub-systems (collectively, the "Platform").

The Platform provides an integrated ecosystem including: Zed Nav (civil administrative state machines and capture center trackers),Zed Skill (data-light learning tracks and verified badging), Zed Market (escrow-backed micro-gigs),Zed Meet (real-time WebRTC 1-on-1 networking and live audio spaces), Campus Hubs & Academic Vault (university departmental networks and Alumni Office Hours),Zed SOS (geospatial transit safety alerts), and the $ZED Token Engine (gamified proof-of-engagement reward system).

For the purposes of the Nigeria Data Protection Act 2023 ("NDPA") and the Nigeria Data Protection Regulation ("NDPR"), Zed acts as the Data Controller in respect of personal data collected through your interaction with the Platform. We are committed to operating in full accordance with the constitutional right to privacy under Section 37 of the Constitution of the Federal Republic of Nigeria 1999 (as amended).

Zed adheres strictly to the principle of Data Minimization under Section 24 of the NDPA 2023. We collect only the minimum personal data strictly necessary to deliver each modular service:

• Account Authentication Data: Mobile telephone number (utilized for transactional SMS/OTP verification), full name, and optional avatar URL.
• Cryptographically Hashed Identity Data: When verifying your National Identity Number (NIN), it is processed strictly through a salted SHA-256 one-way cryptographic digest. The raw 11-digit numerical NIN is never written to physical disk or persisted in any database.
• Campus & University Profiles: University affiliation (e.g., UNILAG, OAU, UI, FUTA, ABU, Covenant), department name, matriculation/graduation year, and student or alumni verification credentials.
• Marketplace Escrow Telemetry: Payout destination bank account numbers and account holder names (for disbursements to GTB, Kuda, OPay, Moniepoint, Zenith, etc.) and transaction reference tokens. Zed never collects or stores debit/credit card PANs or security PINs.
• Proof-of-Engagement & Mining Logs: Daily mining timestamps, current streak counts, level progression status (Levels 1–5), and Cloudflare Turnstile hardware verification hashes used to detect automated bot manipulation.
• Voluntary Support & Community Feedback: Inquiry logs, center wait-time reports, and PPA salary ratings voluntarily submitted by community members.
• Client-Side Local Storage: Procedural checklists, offline guide caches, and course notes stored locally on your device via IndexedDB and Service Worker caches.

The National Identity Number (NIN) issued by the National Identity Management Commission (NIMC) is a sensitive sovereign identifier. In recognition of the severe risks associated with centralized identity theft, Zed enforces an architectural invariant:

In the event of an unauthorized infrastructure breach, an adversary cannot reconstruct or extract your raw National Identity Number from Zed records.

Under Section 25 of the NDPA 2023, every data processing activity conducted by Zed is founded upon an explicit lawful basis:

• Consent (Section 25(1)(a)): You provide specific, informed consent when registering an account, initiating a speed match in Zed Meet, or enabling optional diagnostics in our Cookie Settings.
• Contractual Necessity (Section 25(1)(b)): Processing necessary to provide requested services, such as milestone escrow releases in Zed Market, offline checklist synchronization, and token balance accounting.
• Legitimate Interests (Section 25(1)(f)): Maintaining platform security, executing anti-bot hardware fingerprinting, and conducting NLP-based moderation to prevent scams and protect student safety.

Zed processes personal data strictly for defined and transparent operational purposes:

1. To authenticate users via secure SMS OTP tokens without insecure permanent passwords.
2. To run deterministic, client-side civil checklists for passport renewal, NYSC mobilization, and CAC registration.
3. To manage escrow milestone disbursements for freelance gigs through licensed payment processors.
4. To calculate proof-of-engagement mining multipliers and verify daily claim caps.
5. To verify university student badges and facilitate 15-minute Alumni Office Hours sessions.
6. To render crowd-sourced transit hazard alerts in Zed SOS without continuous personal tracking.
7. To comply with regulatory audit requirements established by the Nigeria Data Protection Commission (NDPC).

Zed operates under a zero-fintech compliance architecture. All $ZED tokens are engagement loyalty points calculated off-chain. When users withdraw funds earned from marketplace gigs or convert $ZED tokens via monthly platform revenue pools:

• Transactions route directly through Central Bank of Nigeria (CBN) licensed payment processors (Paystack, Flutterwave, and Monnify).
• Payment processors hold PCI-DSS Level 1 certification. Zed never captures, processes, or stores debit card PANs, CVVs, expiry dates, or banking PINs.
• Zed retains only settlement reference tokens and payout account metadata (bank name and account number) strictly necessary to facilitate bank transfers to verified Nigerian accounts.

Zed Meet and Live Audio Rooms utilize WebRTC protocols for direct peer-to-peer audio and signaling communication:

• Standard audio conversations in Zed Meet are transmitted in real time and are never recorded, transcribed, or stored on Zed servers during routine operation.
• Trust & Safety Moderation Buffer: To protect young Nigerians from abuse, harassment, scams, and sexual solicitation, our client application maintains a temporary rolling 30-second audio buffer in volatile device memory. If and only if a user activates the 1-Tap Block / Report trigger, this 30-second buffer is encrypted and transmitted securely to human moderators for incident verification. Unreported buffers are continuously overwritten and never reach our servers.

Zed SOS powers a crowd-sourced geospatial map highlighting transit hazards, police checkpoints, and road conditions:

• Zed does not track, log, or record continuous 24/7 background geolocation data.
• Location access is requested only when a user explicitly submits a safety report or queries nearby alerts. Coordinates are processed via PostGIS spatial indexing with coarse precision to prevent pinpointing individual domestic dwellings.
• Hazard alerts automatically expire from the active map layer within 6 hours to preserve timeliness and prevent historical movement profiling.

We retain personal data only for as long as strictly necessary to fulfill the specific purposes defined in this Policy:

• Session Authentication Tokens: Invalidated after 30 days of inactivity.
• Support Inquiries: Retained for 90 days following ticket resolution, then permanently purged.
• Safety Incident Buffers: Deleted within 14 days following moderator review, unless preservation is required by a valid Nigerian court order.
• Client-Side Local Storage: Procedural checklists and course summaries remain on your physical device until manually cleared or until selecting "Reset Local Data" in profile settings.

Zed does not sell, lease, or trade personal data to advertising networks or data brokers. Data is shared exclusively with vetted sub-processors bound by formal Data Processing Agreements (DPAs) compliant with NDPA 2023 standards:

• Payment & Escrow Gateways: Paystack, Flutterwave, and Monnify for domestic Nigerian bank transfers and milestone settlements.
• SMS & Telecommunication Aggregators: Licensed Nigerian telecommunication partners for transactional OTP delivery.
• Cloud Infrastructure: SOC2 and ISO 27001 certified edge cloud hosting providers for encrypted database storage.
• Law Enforcement & Legal Compliance: Data disclosed only when strictly mandated by a valid subpoena or court order issued by a Nigerian court of competent jurisdiction.

Where cloud edge infrastructure is hosted in distributed data centers (e.g., AWS Cape Town or edge CDN nodes), Zed ensures full compliance with Part VI (Sections 41–43) of the NDPA 2023. Cross-border transfers occur exclusively pursuant to standard contractual clauses ensuring equivalent safeguards to Nigerian legal standards.

Zed deploys rigorous technical safeguards engineered to protect citizen data:

• Enforced TLS 1.3 encryption in transit with HTTP Strict Transport Security (HSTS).
• Encrypted storage at rest using AES-256 for all persistent database volumes.
• Cloudflare Turnstile verification and rate-limiting to neutralize credential stuffing and automated mining bots.
• Principle of Least Privilege (PoLP) governing internal engineering access with hardware multi-factor authentication.

Under Part V of the NDPA 2023, you hold enforceable rights regarding your personal data:

• Right of Access & Portability: Request a complete machine-readable copy of your profile data.
• Right to Rectification: Update inaccurate phone numbers, profile names, or campus affiliations.
• Right to Erasure ("Right to be Forgotten"): Request the permanent deletion of your account and hashed identifiers.
• Right to Object & Withdraw Consent: Revoke consent for non-essential storage or close your account at any time.

Zed is designed for Nigerian youth aged 16 and above (including university undergraduates and NYSC corps members). In compliance with Section 31 of the NDPA 2023, we do not knowingly solicit or process the personal data of children under 13 years of age. If we discover that personal data of a child under 13 has been collected without verifiable parental consent, it will be deleted immediately.