Effective date: 30 September 2026
HerSafeSpace helps people who are facing technology-facilitated gender-based violence. We collect only what each feature needs to work. We do not sell your data or use it for advertising. You can export or delete your data from the app at any time.
1. Who we are
HerSafeSpace (“HSS”, “we”, “us”) is run by Brain Builders Youth Development Initiative (BBYDI), a non-profit organisation registered in Nigeria as The Incorporated Trustees of Brain Builders Youth Development Initiative (CAC/IT/NO 119116). BBYDI is the data controller for the personal data described here, under the Nigeria Data Protection Act 2023 (NDPA).
- Address: No. 12 T.O.S. Benson Crescent, Utako, Abuja 900108, FCT, Nigeria
- Privacy contact: [email protected]
This policy covers the HerSafeSpace mobile apps, website and WhatsApp service (Kemi on WhatsApp).
2. What we collect
We collect data in three ways: you give it to us, it is created when you use HSS, or it comes from Google or Apple when you sign in with them.
| Feature | What we collect | Required? |
|---|---|---|
| Account | Email address, username, first and last name, profile photo, Google or Apple account ID, sign-in method and time, notification choices, a history of changes to your profile | Yes, to create an account |
| Kemi AI chat | Your messages, images (up to 5 per message) and voice notes. Voice notes are converted to text and not stored. Location data inside photos is removed before they are processed. | Only when you use it. You can chat without an account. |
| Kemi on WhatsApp | Your WhatsApp phone number, chosen language and ratings you give Kemi. Your messages are held only in a temporary session so Kemi can follow the conversation, and are not saved. | Only when you use it |
| Incident reports | Who the report is for, type of abuse, description, date, country, state and city, and up to 5 attachments | Only when you file a report |
| Vault | The files you store, their names, types and sizes, your folders, and your vault PIN (stored only as a secure hash) | Only when you use it |
| SOS | Your trusted contacts' names, phone numbers and relationship to you. When you send an alert: your GPS location, its accuracy, the time, and whether each text message was delivered. | Only when you use it |
| Messaging lawyers | Your messages, attachments, when each message was delivered and read, whether you are online and when you were last active | Only when you use it |
| Lawyer accounts | Full name, email, phone number, country and city of practice, area of specialisation, year called to the bar, bar licence number and certificate, profile photo, a description of your experience, and our review decision | Yes, to be listed as a lawyer |
| Technical data | Your IP address, used to stop abuse (rate limiting) and recorded in server logs | Yes, automatically |
We do not collect your contacts list, your date of birth, payment details, advertising IDs or background location. HSS reads your location only when you send an SOS alert.
3. Sensitive data
Incident reports, Kemi chats and messages to lawyers may reveal sensitive information. This can include details of sexual or gender-based violence, intimate-image abuse, health or your sex life. We process this data only because you choose to share it with us for that feature, and on the basis of your explicit consent. You can withdraw consent at any time by deleting the content or your account (see section 8).
4. How we use your data and why
| What we do | Legal basis (NDPA section 25) |
|---|---|
| Create and secure your account, sign you in, send one-time codes | Performance of our agreement with you |
| Answer you through Kemi, save chats you choose to save, store vault files | Performance of our agreement with you; explicit consent for sensitive content |
| Receive and review incident reports, and refer you to support services | Explicit consent |
| Send SOS text messages with your location to your trusted contacts | Your consent; in an emergency, your vital interests |
| Connect you with a verified lawyer and deliver your messages | Performance of our agreement with you; explicit consent for sensitive content |
| Verify that lawyers are qualified before listing them | Our legitimate interest in keeping users safe |
| Prevent abuse, fix problems and keep HSS secure | Our legitimate interest in running a safe service |
| Produce anonymous statistics, such as the number of reports by type and region, to improve services and support advocacy | Our legitimate interest; the statistics do not identify anyone |
| Send product and safety updates by email | Your consent, which you can turn off in Settings |
We do not use your data for advertising, we do not sell it, and we do not use your chats, reports or files to train AI models.
5. Who we share it with
HSS staff see only what they need. Our team reviews incident reports so we can follow up and refer you to support. A lawyer sees only the conversations you start with them.
We use the service providers below. They process data only on our instructions and under contracts that require them to protect it.
| Provider | What it does for HSS | Data involved |
|---|---|---|
| OpenAI | Powers Kemi's replies and converts voice notes to text | Chat messages, images, voice notes |
| Pinecone | Searches Kemi's knowledge base for WhatsApp answers | A search phrase based on your message |
| Twilio | Runs Kemi on WhatsApp and sends SOS text messages | WhatsApp number and messages; trusted contacts' numbers, alert text and your location link |
| Resend | Sends emails such as sign-in codes and data exports | Email address, email content |
| Railway | Hosts our servers, database and file storage | All data stored by HSS |
| Google and Apple | Sign-in with your Google or Apple account | Account ID, email, name, photo |
| ui-avatars.com | Creates a default profile picture from your initials | Your name |
We may disclose data when Nigerian law requires it, such as a valid court order. Where the law allows, we will tell you first. We will also disclose data if it is needed to protect someone’s life.
6. Transfers outside Nigeria
Our servers, database and file storage are hosted by Railway in the United States. Other providers, including OpenAI, Pinecone, Twilio and Resend, also process data in the United States or elsewhere outside Nigeria. We transfer data only as permitted by Part VIII of the NDPA, relying on appropriate safeguards such as contractual protections, or on your consent.
7. How long we keep it
| Data | How long |
|---|---|
| Kemi chats you do not save | 2 hours after your last message |
| Voice notes | Not stored; deleted as soon as they are converted to text |
| One-time sign-in codes | 5 to 10 minutes |
| Saved chats, vault files, SOS contacts and alerts, profile | Until you delete them or your account |
| Incident reports | Until you delete your account. The report is then anonymised: the description, attachments and link to you are removed, and the type, date and location are kept for statistics. |
| Messages with a lawyer | Kept after you delete your account so the lawyer keeps their record. Your name is replaced with “Deleted account”. |
| Kemi on WhatsApp messages | Not saved. Held in a temporary session and cleared 2 hours after your last message, when a new session starts. |
| WhatsApp number, language and ratings | Until you ask us to delete them |
| Lawyer verification documents | While the lawyer account exists |
| Record that an account was deleted | Kept, with no personal data |
8. Your rights
Under the NDPA you can:
- Access your data. In the app, go to Settings > Export data to get a PDF of your profile, reports, saved chats and vault file list by email.
- Correct your data in Settings > Profile.
- Delete your account and data in Settings > Delete account. We confirm with a one-time code. Lawyers and WhatsApp users can ask us to delete their data by emailing [email protected].
- Withdraw consent at any time, for example by turning off email updates or removing a trusted contact. This does not affect processing already done.
- Object to or ask us to restrict processing, and ask for your data in a portable format.
- Not be subject to decisions with legal effect made only by automated means. Kemi gives information but does not make decisions about you.
We answer requests within 30 days.
9. How we protect it
- No passwords: you sign in with a one-time email code or with Google or Apple.
- Sign-in codes and vault PINs are stored only as secure hashes. The vault locks for 15 minutes after 5 wrong PINs.
- Files are private. They can be opened only through links that expire after 1 hour (10 minutes for vault files).
- Location data is removed from photos you share with Kemi.
- Data is encrypted in transit.
No system is completely secure. If a breach puts you at risk, we will notify the NDPC within 72 hours and tell you without undue delay, as the NDPA requires.
10. Children
HSS is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child under 16 has an account, contact us and we will delete it. You may still file a report about a child who is being harmed; that report is treated as sensitive data.
11. Changes to this policy
We will post any update here with a new effective date. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect.
12. Contact
Privacy questions or requests: [email protected]. Post: BBYDI, No. 12 T.O.S. Benson Crescent, Utako, Abuja 900108, FCT, Nigeria.