Privacy policy

This policy explains what personal data Kodre handles and why. It is written to meet the Nigeria Data Protection Act 2023 (NDPA) and the GDPR where it applies.

Two kinds of data

• Studio data: your account details, studio profile and billing. We are the controller.
• Client data: names, contact details, booking answers and payment records of your clients. You are the controller; we process it for you under our Data Processing Agreement.

What we collect

• Account: name, email, password (stored hashed), phone.
• Payouts: bank name, the last four digits of your account and the account name. Full account numbers stay with Paystack.
• Usage and security logs: IP address, device and actions in your dashboard, kept for security and auditing.

Who we share it with

Paystack (payments), Cloudflare (photo storage and delivery), Resend (email), Twilio (WhatsApp), Vercel (hosting) and Sentry (error monitoring). Each processes data only to provide its service to us.

How long we keep it

For as long as your account is open. Payment, invoice and receipt records are kept for the period tax law requires, even after deletion requests, with personal details removed where possible.

Your rights

You can access, correct, export or delete your data. Studios can erase a client's personal data from the client page; money records remain, labelled “Deleted client”. Email privacy@kodre.app for anything else.