Your data, plainly.

“Who I Go Be” (“we”, “us”) is a community-driven mentorship platform built for Nigerians at home and abroad. We are the data controller for the information described in this policy.

You can reach us at privacy@whoigobe.com. Postal address and registered entity details will appear here once the operating entity is incorporated; until then, please use email for all data-protection enquiries.

We collect only what we need to run the service. In practice that means:

• Account data: your email address; a password hash if you sign up with email, or a Google account identifier if you sign in with Google.
• Profile data: first and last name, profile photo, short bio, industry, years of experience, goals, skills, mentee capacity, LinkedIn URL, and your role (mentor, mentee, or admin).
• Activity data: match requests you send or receive, the notes you attach to those requests, and the status of each match.
• Communications: messages you send us via the contact form or email.
• Volunteer details: if you offer to volunteer: your name, email address, phone number (if you give it), city, how and when you can help, and anything you tell us about yourself. If you are 15 to 17, also your age, your parent or guardian's name, email address and phone number, and a record of their permission.
• Technical data: IP address, browser, device type, pages visited, basic performance and error reports. We use this to keep the service running and to fix bugs.

We do not ask for, or store, payment information, government identity numbers, biometric data, or sensitive personal data (as defined by the NDPA 2023) such as health, religion, or political views.

• To run the service: to create your account, show your profile to other community members, match mentees with mentors, and let matched pairs contact each other.
• To communicate with you: transactional emails like match notifications and password resets, sent through Resend.
• Volunteering: to contact you about volunteering and, if you are under 18, to ask your parent or guardian for permission first.
• Newsletter (only if you opt in): if you subscribe, we use your email address (and your name, if you subscribed when creating an account) to send our newsletter through Resend. We ask you to confirm by email first, and every issue has an unsubscribe link.
• To keep the platform safe: to detect abuse, prevent spam, and respond to security incidents.
• To improve the product: aggregate, anonymous analytics on which features are used so we can make better decisions about what to build.
• To comply with the law: including responding to lawful requests from Nigerian regulators such as the Nigeria Data Protection Commission (NDPC).

Under the Nigeria Data Protection Act 2023 and (for users in the EU/UK) the GDPR / UK GDPR, we rely on the following lawful bases:

• Contract: most of what we do is necessary to provide you the service you signed up for.
• Legitimate interests: security, fraud prevention, anonymous product analytics, and direct communications about your account.
• Consent: for anything optional, including the newsletter and volunteer sign-ups (for 15 to 17-year-olds, a parent or guardian gives permission too). You can withdraw consent at any time without affecting processing that already happened.
• Legal obligation: when we must process data to comply with applicable law.

We do not sell your data. We share it only with service providers (data processors) we need to run the platform. Each is bound by a data-processing agreement and processes data only on our instructions.

• Supabase: hosts our database, file storage (your profile photo), and authentication. See their privacy policy.
• Vercel: hosts the website and provides basic privacy- preserving analytics. See their privacy policy.
• Resend: delivers transactional and contact-form emails. See their privacy policy.
• Google: only if you choose “Sign in with Google”. See their privacy policy.
• Cloudflare Turnstile: checks that sign-up, sign-in and volunteer forms are filled in by a person, not a bot. See their privacy policy.
• Sentry: captures application errors so we can fix bugs. See their privacy policy.

We may also disclose data when required by law, court order, or to protect rights, safety, or property.

Some of the service providers above store and process data outside Nigeria (typically in the United States or European Union). When that happens, we rely on the providers' own safeguards, including Standard Contractual Clauses (SCCs), adequacy decisions where they apply, and the security certifications published in their trust documentation.

If you are in the European Union or United Kingdom, you can ask us for a copy of those safeguards by emailing privacy@whoigobe.com.

• Active accounts: for as long as your account exists.
• Deleted accounts: we hard-delete your profile and personal data within 30 days of account closure. Database backups roll off within 90 days of that.
• Match records: kept while either party still has an active account; otherwise deleted on the same schedule above.
• Contact-form messages: kept in our support inbox for up to 24 months, then deleted.
• Newsletter subscriptions: kept until you unsubscribe or ask us to delete them. Sign-ups that are never confirmed are deleted after 30 days.
• Volunteer details: kept until you withdraw your offer or ask us to delete them. Sign-ups from under-18s are deleted after 30 days if a parent or guardian hasn't given permission.
• Logs and error reports: retained by Sentry and our hosts for up to 90 days.

Under the NDPA 2023 (and GDPR / UK GDPR if you are in those regions), you have the right to:

• Access the personal data we hold about you.
• Rectify data that is wrong or out of date.
• Eraseyour data (we can't always do this if a legal obligation says otherwise).
• Restrict or object to processing.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent at any time, where consent is the basis.
• Not be subject to a decision based solely on automated processing that produces legal effects for you. Our mentor-match suggestions are informational. A human (you) always decides whether to send a request.

To exercise any of these rights, email privacy@whoigobe.com. We will respond within one (1) month, free of charge, unless your request is manifestly unfounded or excessive.

We use a small number of cookies:

• Session cookies set by Supabase to keep you signed in. Strictly necessary: without them the service does not work.
• Analytics cookies from Vercel Analytics. These are privacy-preserving and do not track you across sites.

You can clear cookies through your browser at any time. Doing so will sign you out of the platform.

Who I Go Be is intended for adults. You must be at least 18 years old to create an account. If you believe a child has created an account, please email privacy@whoigobe.com and we will delete it.

People aged 15 to 17 may offer to volunteer without an account. When they do, we email their parent or guardian to ask for permission, and they cannot volunteer until it is given. If permission isn't given within 30 days, we delete their details.

We protect your data with a layered approach:

• Encryption in transit (HTTPS / TLS) and at rest on our hosts.
• Row-level security (RLS) policies in our database so each user sees only their own data.
• Passwords are stored as one-way hashes. We never see your password.
• Administrative access is restricted to named staff and logged.

No system is perfectly secure. If you discover a vulnerability, please report it to privacy@whoigobe.com.

We may update this policy as the service evolves or the law changes. When we make a material change we will update the “Last updated” date above and notify you by email or in-app notice before the change takes effect.

Questions, requests, or complaints about how we handle your data: email privacy@whoigobe.com.

If you are not satisfied with our response, you have the right to lodge a complaint with a supervisory authority:

• Nigeria: the Nigeria Data Protection Commission (NDPC), ndpc.gov.ng.
• European Union: your local data protection authority.
• United Kingdom: the Information Commissioner's Office (ICO), ico.org.uk.