Privacy Policy

Burdva Limited ("Resida", "we", "our", "us") is the data controller responsible for personal data collected through the Resida platform (resida.app and all subdomains). Resida is incorporated under the laws of the Federal Republic of Nigeria, with its registered office in Victoria Island, Lagos, Nigeria.

This Privacy Policy explains what personal data Resida collects, why we collect it, how we use and share it, how long we retain it, your rights as a data subject under the Nigeria Data Protection Act 2023 (NDPA) and its implementing regulations, and how to exercise those rights.

For all privacy and data protection matters, including Subject Access Requests, right-to-erasure requests, and data-related complaints, contact our Data Protection Officer (DPO) at privacy@resida.app.

This Policy was last updated on June 2026. We will notify registered Users by email at least 30 days before any material change takes effect. Continued use of the Platform after the effective date constitutes acceptance of the revised Policy.

"Personal Data" means any information relating to an identified or identifiable natural person (a "data subject"), as defined in Section 65 of the NDPA 2023.

"Special Category Data" means data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, genetic data, or biometric data used to uniquely identify a natural person.

"Processing" means any operation performed on personal data, including collection, recording, storage, use, disclosure, or deletion.

"Sub-Processor" means a third-party service provider who processes personal data on Resida's behalf.

"DVA" means Dedicated Virtual Account — a bank account number issued through Paystack (Titan Trust Bank or Wema Bank) to facilitate Platform Wallet funding.

"AI Feature" means any functionality powered by a large language model (LLM) or multimodal AI model — specifically Google Gemini — used within the Platform.

"NDPA" means the Nigeria Data Protection Act 2023 and all related regulations and guidelines issued by the Nigeria Data Protection Commission (NDPC).

IDENTITY DATA: Full legal name, date of birth, government-issued ID number (NIN, passport, or driver's licence); photographs including selfie/liveness capture; biometric indicators derived from liveness checks (not raw biometric templates).

CONTACT DATA: Email address, phone number (including WhatsApp-registered number), residential address, Lagos Local Government Area.

FINANCIAL DATA: Bank Verification Number (BVN); bank account number(s) provided for withdrawal; DVA account number; wallet balance and transaction history; Paystack customer code; subscription billing history; card type and last 4 digits only (raw card numbers are never stored); payment reference numbers.

KYC DOCUMENTATION: Scanned or photographed government-issued ID; utility bills or address verification documents; guarantor details provided during lease onboarding.

PROPERTY DATA: Property address, type, unit details, photos, videos, description, amenities, pricing, and occupancy history for listings created by Owners and Agents.

LEASE AND BOOKING DATA: Lease start/end dates, rent amount, payment frequency, next due date, lease status; shortlet check-in and check-out dates; inspection scheduling details.

COMMUNICATIONS DATA: In-platform chat messages (Tenant ↔ Agent ↔ Handyman threads); AI-assisted draft replies and message summaries; email and SMS delivery logs; WhatsApp message logs (inbound commands, template delivery receipts).

TECHNICAL DATA: IP address at account creation, login, and each financial transaction; browser and device type (User-Agent); session identifiers stored in Redis (5-minute TTL for OTP, 60-minute TTL for sessions, 7-day TTL for refresh tokens); API access logs.

USAGE DATA: Pages and features accessed; timestamps of actions; AI Feature calls (which feature, timestamp, charge incurred); WhatsApp commands received; referral link clicks and attribution data (ref codes, share_events).

LOCATION DATA: GPS coordinates collected from Cleaners at task check-in for proximity verification. Not collected from any other user role. Not used for profiling or marketing.

ESTATE ACCESS DATA: Visitor access codes; gate entry/exit timestamps; guard identifier who processed each scan. Retained for 12 months.

HANDYMAN / CLEANER PROFESSIONAL DATA: Trade skills, base service charge, service history, ratings, availability status, GPS check-in records.

B2B COMPANY DATA: Company registration information (name, RC number, address); staff roster (names, emails, roles, branch assignments); CRM client and lead records; commission and expense records; agreement content.

AI-GENERATED METADATA: Outputs generated about you or your properties, including risk scores, fraud probability signals, property valuations, maintenance cost estimates, maintenance category classifications, lead quality scores, rent reference letter drafts, photo quality scores, and OCR extracts from identity documents. These outputs are stored as decision-support records.

Selfie images submitted for KYC liveness verification are processed by an AI pipeline to confirm the photo is of a live person. The raw image is stored. A liveness confidence score is produced but raw biometric templates are not extracted or retained. Government-issued identity documents may reveal nationality by implication; this data is processed solely for identity verification and not analysed separately.

Resida does not collect health, political, religious, or trade union data. If any such data appears voluntarily in a free-text field (e.g., a maintenance request), it is used only to fulfil the stated purpose and is never used for profiling, marketing, or secondary processing.

Legal basis for Special Category Data: explicit consent (obtained at KYC submission) and, where applicable, necessity to comply with Nigerian financial regulatory obligations.

DIRECTLY FROM YOU: Account registration; KYC submission; property listing; lease creation or acceptance; booking submission; maintenance requests; wallet funding; subscription payment; WhatsApp inbound messages; in-app chat; feedback forms; dispute submissions.

AUTOMATICALLY: HTTP-only session cookies and local storage (authentication tokens); server-side IP and User-Agent logging per API request; Celery task metadata; Redis session data.

FROM THIRD PARTIES: Paystack — DVA account details, payment status webhooks (charge.success), transfer status, bank account name; Meta/WhatsApp — inbound messages and delivery receipts; Google Gemini — OCR extracts from submitted documents.

FROM REFERRALS: If you register via a referral link, the referring user's code is associated with your account. A share_event record is created linking your account to the referrer for reward attribution.

CONTRACT PERFORMANCE (NDPA s.25(1)(b)): Creating your account, provisioning your DVA, executing lease and booking transactions, deducting rent, processing withdrawals, and providing Platform features.

LEGAL OBLIGATION (NDPA s.25(1)(c)): KYC identity verification and retention under the Money Laundering (Prevention and Prohibition) Act 2022 and CBN KYC directives; financial transaction records for 5+ years; responding to court orders, NFIU directives, or NDPC investigations.

LEGITIMATE INTERESTS (NDPA s.25(1)(f)): Platform security and fraud detection; anomaly detection in wallet transactions; duplicate account detection; abuse prevention; improving the Platform through anonymised usage analytics; referral attribution; sending transactional messages about your account activity; immutable audit logging for operational integrity.

CONSENT (NDPA s.25(1)(a)): Processing biometric/liveness data (KYC selfie); WhatsApp outbound notifications; SMS notifications (Termii); marketing communications; optional cookies; AI photo scoring of property images.

VITAL INTERESTS (NDPA s.25(1)(d)): If you report a safety emergency via the SOS feature or a maintenance request, we may share your details with emergency services.

You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw, email privacy@resida.app or use notification preferences in your account Settings.

ACCOUNT MANAGEMENT: Creating and maintaining your account; authenticating identity; managing RBAC; enforcing access controls; notifying you of security events.

FINANCIAL OPERATIONS: Provisioning DVA; crediting Wallet deposits via Paystack webhook; executing rent deductions via Celery Beat at 00:00 WAT; processing late fee accrual; handyman and cleaner payouts; shortlet and event bookings; withdrawals; subscription billing; AI usage fee (₦3 per LLM call); recording all transactions in the ledger and audit log.

PROPERTY AND LEASE MANAGEMENT: Enabling property listing; managing lease lifecycle (PENDING → ACTIVE → EXPIRED); scheduling next_due_date advancement; managing shortlet calendar and double-booking prevention; generating inspection codes; managing vacate notice workflows.

COMMUNICATIONS: Sending transactional emails via Resend; sending SMS OTPs via Termii; sending WhatsApp template messages via Meta Cloud API (rent reminders, savings nudges, vacancy broadcasts, inspection confirmations, maintenance alerts, rent certificates, landlord onboarding steps); facilitating in-platform three-way chat.

KYC AND COMPLIANCE: Reviewing submitted identity documents; using AI OCR to assist field extraction; making KYC decisions (always human-reviewed); retaining KYC records for audit and regulatory compliance; reporting suspicious activity to the NFIU where legally required.

FRAUD AND SECURITY: Detecting duplicate accounts via shared phone numbers or email hashing; AI-assisted fraud scan (Gemini) to identify inconsistent KYC data or anomalous wallet patterns; generating fraud probability scores stored as AI-generated metadata; creating immutable fraud_flag audit entries; notifying administrators for human review.

MARKETING AND REFERRALS: Sending promotional messages to opted-in users; tracking referral attribution (ref codes, share_events); crediting referral rewards; generating growth metrics (anonymised aggregates only).

PLATFORM IMPROVEMENT: Aggregated, anonymised usage statistics to understand feature adoption. Resida does not use individual user data to fine-tune the Gemini model — all Gemini API calls are inference-only.

The Platform uses Google Gemini to provide AI Features including: listing copy generation, property valuation (AVM), maintenance triage, agreement drafting, agreement review, chat draft replies, ad copy generation, rent reference letter drafting, document OCR for KYC, photo tagging, photo quality scoring, and virtual tour narrative generation.

DATA SENT TO GOOGLE GEMINI varies by feature: (a) Listing copy: property name, location, type, price, amenities — no user identity. (b) Maintenance triage: request description only — no tenant name. (c) Agreement drafting: unit details, lease dates, rent amount, tenant name included. (d) Document OCR: image URL pointing to the document in cloud storage — fetched directly by Gemini. (e) Photo scoring: image URL only — no personal data. (f) Fraud scan: structured account summary (age, transaction volume, flag count) — name and email included. (g) Chat draft reply: recent message thread including sender names. Resida never sends BVN, raw card numbers, wallet balances, or DVA account numbers to Gemini.

DATA PROCESSING BY GOOGLE: Google LLC processes Gemini API data as a Sub-Processor under Google's API Terms and Cloud Data Processing Addendum. Google's servers are located primarily in the USA and EU. Resida has enabled "Do not use content to improve Google models" in our Gemini API configuration. Google does not use Platform user data to train AI models.

AUTOMATED PROFILING: The Platform generates the following profiles: (a) Tenant risk score: 0–100 from payment history, late fee count, support ticket count. Used to alert property managers. Not used to automatically reject tenants. (b) Lead quality score: from listing engagement data for agent prioritisation. (c) Fraud probability signal: from Gemini fraud scan and deterministic rules. Flags trigger human review — no automatic suspension. (d) Anomaly detection: Z-score analysis on wallet transaction values and frequencies. Anomalies generate administrator alerts, not automated account actions.

RIGHT NOT TO BE SUBJECT TO SOLELY AUTOMATED DECISIONS (NDPA s.34): No significant decision (account suspension, lease rejection, fraud report to NFIU) is made solely by automated means without human review. To request human review of a decision that has significantly affected you, contact privacy@resida.app.

When you interact with Resida via WhatsApp, your phone number, message content, and delivery metadata are processed by Meta Platforms Ireland Ltd under Meta's Privacy Policy and Business Messaging Terms.

Inbound WhatsApp messages are received via Meta Cloud API webhook, stored to process your command, and retained for 90 days. Outbound template delivery logs are retained for 90 days.

Multi-step WhatsApp conversational sessions store state in Redis with a 30-minute TTL. Abandoned sessions are automatically purged at TTL expiry.

To opt out of WhatsApp notifications, send UNSUBSCRIBE to our WhatsApp Business number or email privacy@resida.app. Critical security notices may still be sent.

Sharing a referral link (resida.app/register?ref=YOUR_CODE) generates share_events records containing: referring user ID, ref code, channel parameter (whatsapp, instagram, copy, etc.), and timestamp. No personal data about the person who clicks is collected before they register.

On registration via a referral link, your account is associated with the referrer's code. This association is stored permanently as part of the audit record and is used to credit referral rewards and generate anonymised growth metrics.

Referral rewards are credited to the referring user's Wallet as a CREDIT transaction. Resida does not withhold tax on referral income. Users are responsible for declaring referral income under applicable Nigerian tax law.

GPS coordinates are collected only when a registered Cleaner submits a task check-in. The browser's Geolocation API (with explicit permission) provides latitude and longitude, compared against the unit's registered coordinates using the Haversine formula. Check-in is accepted within 300 metres.

GPS coordinates are stored in the cleaning task record, visible to the property manager, and retained for 12 months then deleted.

Resida does not collect continuous or background location data. Geolocation is requested only at check-in, with a standard browser permission prompt. Location data is never used for marketing or profiling.

BETWEEN USERS: (a) Tenant name, phone, email, and KYC status are visible to the Agent and Owner of their occupied unit. (b) Requester's name, unit address, and request description are visible to the assigned Handyman. (c) Guest name and booking dates are visible to the property Host.

SUB-PROCESSORS (all under data processing agreements): (a) Paystack (PCI-DSS Level 1): payment processing, DVA provisioning, recurring billing — name, email, phone, BVN, bank account number. Servers: Nigeria. (b) Google LLC (Gemini API): AI Feature processing — feature-specific data per Section 8.2. Servers: USA and EU. (c) Amazon Web Services (AWS S3): file storage — images and documents. Servers: EU and/or USA. (d) Cloudinary (alternative storage): same scope as AWS S3. (e) Resend: transactional email — recipient email address and email body. Servers: USA. (f) Termii: SMS delivery — recipient phone number and message body. Servers: Nigeria and EU. (g) Meta Platforms Ireland Ltd: WhatsApp delivery — phone number and message content. Servers: EU and USA. (h) Redis: session caching and Celery broker — hashed session tokens and OTP codes. Servers: configured cloud region.

LEGAL AND REGULATORY: Resida may disclose data to government authorities, law enforcement, courts, or regulators (NDPC, NFIU, CBN, LASRERA) as required by Nigerian law. We will notify affected Users where legally permissible.

CORPORATE TRANSACTIONS: In a merger or acquisition, personal data may be transferred to the acquiring entity under the same privacy protections. We will notify Users before any such transfer.

Resida does not sell your personal data. We do not share your data with advertisers or data brokers.

Your personal data may be transferred to and processed in countries outside Nigeria — including the USA and EU — by our Sub-Processors (Google Gemini, AWS S3, Resend, Meta). Nigeria has not made adequacy decisions in respect of these jurisdictions.

For all international transfers, Resida ensures appropriate safeguards under NDPA Schedule 2, including: Standard Contractual Clauses (SCCs) with each Sub-Processor; verification that Sub-Processors maintain appropriate security certifications (ISO 27001, SOC 2, PCI-DSS, GDPR compliance); and data minimisation — only the minimum necessary data is transmitted per purpose.

You may obtain further information about international transfer safeguards by contacting privacy@resida.app.

ACCOUNT DATA: Retained for account lifetime plus 5 years from closure (Nigerian financial regulations).

KYC DOCUMENTS: Account lifetime plus 5 years from closure (AML/KYC requirements). Rejected applicants who never activated: 90 days.

FINANCIAL TRANSACTION RECORDS: Retained indefinitely on the primary ledger for audit; archived to cold storage after 7 years.

AUDIT LOGS: Retained indefinitely. Immutable — cannot be deleted by any user including Super Admins.

IN-PLATFORM CHAT MESSAGES: 3 years from last message in the thread, then deleted.

WHATSAPP LOGS (Inbound & Outbound): 90 days from message timestamp.

REDIS SESSION DATA: OTP: 5-minute TTL. Sessions: 60-minute TTL. Refresh tokens: 7-day TTL. WhatsApp sessions: 30-minute TTL. All auto-purged at TTL expiry.

AI-GENERATED METADATA: Retained for lifetime of the associated entity (user account, property, lease). Deleted with the entity.

GPS CHECK-IN DATA (Cleaners): 12 months from cleaning task date.

ESTATE GATE LOGS: 12 months from gate event date.

PROPERTY PHOTOS AND FILES: 12 months after a property is permanently deleted. KYC documents per clause 14.2.

RIGHT OF ACCESS (NDPA s.34(1)(a)): Request a copy of all personal data we hold, including purposes, categories, recipients, retention period, and source.

RIGHT TO RECTIFICATION (NDPA s.34(1)(b)): Request correction of inaccurate or incomplete data. Many fields can be updated directly in account Settings.

RIGHT TO ERASURE (NDPA s.34(1)(c)): Request deletion of data no longer necessary, where consent is withdrawn, or where processing was unlawful — subject to legal retention obligations (audit logs, financial records, KYC) which override this right.

RIGHT TO RESTRICT PROCESSING (NDPA s.34(1)(d)): Request restriction while accuracy is contested, processing is unlawful but erasure is contested, or an objection is pending.

RIGHT TO DATA PORTABILITY (NDPA s.34(1)(e)): Request your personal data in a structured, machine-readable format (JSON or CSV) for data processed on the basis of consent or contract.

RIGHT TO OBJECT (NDPA s.34(1)(f)): Object to processing based on legitimate interests. Resida will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

RIGHT NOT TO BE SUBJECT TO SOLELY AUTOMATED DECISIONS (NDPA s.34): Resida does not make significant decisions solely by automated means. You may request human review of any decision that has significantly affected you.

HOW TO EXERCISE YOUR RIGHTS: Email privacy@resida.app with subject line "Data Subject Request — [Right Name]". Resida acknowledges within 5 business days and responds substantively within 30 days. We may request proof of identity.

COMPLAINTS: If unsatisfied with Resida's response, lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Technical and organisational measures include: (a) TLS 1.2+ encryption for all data in transit. (b) bcrypt password hashing with salt — plain-text passwords never stored. (c) Short-lived JWT tokens with Redis-backed real-time blocklist for instant revocation on logout. (d) Single-use 6-digit OTP codes valid for 5 minutes, hashed before storage. (e) Row-level SELECT FOR UPDATE locks on all wallet operations to prevent race conditions. (f) Paystack webhooks verified via HMAC-SHA512 against x-paystack-signature before any state change. (g) Immutable audit log on all critical actions (wallet changes, lease changes, KYC decisions, role changes). (h) RBAC enforced on every API endpoint via FastAPI dependency injection. (i) No raw card numbers, BVN, or passwords stored — always processed or hashed.

Resida uses containerised infrastructure (Docker) with environment-variable-based secret management. Secrets are never hardcoded. Source code is in a private GitHub repository with branch protection and CI/CD via GitHub Actions.

While Resida takes reasonable precautions, no internet-based system is completely secure. You are responsible for keeping your credentials confidential and using a secure device and network.

In the event of a personal data breach likely to risk the rights and freedoms of data subjects, Resida will: (a) Notify the NDPC within 72 hours of becoming aware, in accordance with NDPA s.40; and (b) Notify affected data subjects without undue delay where the breach is likely to result in high risk.

Breach notifications will include: nature of the breach; categories and approximate number of individuals and records affected; likely consequences; and measures taken or proposed.

To report a suspected security incident, contact security@resida.app. Our incident response team acknowledges within 4 hours and begins investigation within 12 hours.

STRICTLY NECESSARY COOKIES: HTTP-only session cookies and local storage are used to maintain your authenticated session (access and refresh tokens). These are required for the Platform to function and cannot be disabled without logging you out.

The Platform does not use third-party advertising cookies, tracking pixels, or cross-site behavioural tracking scripts.

The Public Discovery Portal (Next.js) may use lightweight anonymised analytics cookies to measure content performance. No personal data is attached to these records.

If Resida adds new cookie types, we will update this Policy and display a cookie consent banner before placing non-essential cookies.

The Platform is intended for users aged 18 and over. We do not knowingly collect or process personal data from individuals under 18.

If you believe a person under 18 has created an account, contact privacy@resida.app immediately. We will investigate and, if confirmed, delete the data and close the account within 14 days.

Resida may send promotional communications (new features, offers, market reports) by email, SMS (Termii), or WhatsApp to users who have opted in.

Opt out at any time by: clicking "Unsubscribe" in any marketing email; sending UNSUBSCRIBE to our WhatsApp Business number; updating notification preferences in account Settings; or emailing privacy@resida.app with subject "Opt-Out — Marketing".

Opting out of marketing does not affect transactional messages (rent receipts, security alerts, KYC status, booking confirmations), which are essential to the contract and cannot be opted out while your account is active.

Resida has appointed a Data Protection Officer (DPO) as required under the NDPA 2023. The DPO oversees Resida's data protection programme, advises on data protection impact assessments, responds to Subject Access Requests, liaises with the NDPC, and manages data breach response.

DPO contact: privacy@resida.app. Requests acknowledged within 5 business days, substantive response within 30 days.

Resida is registered with the Nigeria Data Protection Commission as a Data Controller under the NDPA 2023.

Resida may update this Privacy Policy to reflect changes in data processing practices, legal requirements, or Platform features.

Material changes will be communicated by email to your registered address at least 30 days before they take effect, with an in-platform notice.

Non-material changes (clarifications, typographical corrections, updated Sub-Processor addresses) may be made without notice and will be reflected in the "last updated" date.

Previous versions of this Policy are available on request from privacy@resida.app.

For privacy concerns, contact our DPO at privacy@resida.app. We will investigate and respond within 30 days.

If unsatisfied with our response, lodge a complaint with the Nigeria Data Protection Commission (NDPC): Website: ndpc.gov.ng | Address: Plot 1288 Tigris Crescent, Off Aguiyi Ironsi Street, Maitama, Abuja, FCT, Nigeria.

Contact details: DPO: privacy@resida.app | Support: support@resida.app | Security: security@resida.app | Disputes: disputes@resida.app | Legal: legal@resida.app