Privacy Policy

1. Who Is Responsible for Your Data

Mindshift Business Innovation Limited is the data controller (or equivalent term under applicable law) responsible for the personal data described in this Policy, unless we tell you otherwise for a specific feature. Our contact details are in Section 13.

2. Personal Data We Collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, password, company name, and job title.
• Billing data: billing address, payment card details (processed by our payment processor — we do not store full card numbers), and transaction history.
• Brand and business data: information you submit about your brand, business, or content for the purpose of receiving analysis through the Service, including the Free Analysis or Paid Plans.
• Usage data: log data, device and browser information, IP address, pages viewed, and interactions with the Service, collected automatically through cookies and similar technologies.
• Communications: messages, feedback, or support requests you send us.

We do not intentionally collect special category data (e.g., health, religious belief, racial or ethnic origin) and ask that you do not submit such data through the Service unless specifically requested.

3. How We Use Your Data

• To provide, operate, and maintain the Service, including generating your Free Analysis or Paid Plan outputs;
• To process payments and manage your subscription;
• To communicate with you about your account, updates, security notices, and (where you have consented or as permitted by law) marketing;
• To improve, secure, and develop the Service, including analysing usage trends;
• To detect, investigate, and prevent fraud, abuse, or violations of our Terms and Conditions;
• To comply with legal, tax, and regulatory obligations.
• We only share personal data with third-party service providers where necessary for the operation of the Service. We require such providers to process personal data only on our instructions, implement appropriate technical and organisational security measures, and comply with applicable data protection laws.
• We may use automated tools, including artificial intelligence technologies, to analyse information you provide and generate insights or recommendations. Such processing is intended to assist users and should not be relied upon as professional legal, financial, or other regulated advice.

4. Legal Bases for Processing (EU/EEA and UK Users)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you have signed up for, including Paid Plans and the Free Analysis;
• Legitimate interests — to secure and improve the Service, prevent fraud, and carry out direct marketing where permitted, balanced against your rights;
• Consent — for optional cookies, marketing communications, or specific features where we ask for your consent, which you may withdraw at any time;
• Legal obligation — where processing is required to comply with applicable law.

5. How We Share Your Data

• Service providers: hosting providers, payment processors, analytics providers, and customer support tools that process data on our behalf under contract.
• Professional advisers: lawyers, auditors, and insurers, where necessary.
• Legal and safety: regulators, courts, or authorities where required by law, or to protect the rights, property, or safety of Mindshift, our users, or the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.

We do not sell your personal data to third parties for their own marketing purposes.

6. International Data Transfers

We are based in Nigeria and may use service providers located in other countries, including the United States, the European Union, or elsewhere. Where we transfer personal data of EU/EEA or UK users outside those regions, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum), or another lawful transfer mechanism, and we will provide further details on request.

Where we transfer personal data of UAE users outside the UAE, we take steps consistent with applicable UAE data protection law, including contractual protections with recipients.

7. Data Retention

We retain your personal data for as long as your account remains active and for up to seven (7) years after account closure, where required to comply with legal, tax, accounting, regulatory, or dispute resolution obligations. Where retention is no longer necessary, we will securely delete or anonymise your personal data.

8. Security

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights — Nigeria

Under the Nigeria Data Protection Act 2023 and applicable regulations of the Nigeria Data Protection Commission (NDPC), you have the right to be informed about our processing of your data, to access your data, to request correction or deletion, to object to or restrict certain processing, and to lodge a complaint with the NDPC. You may exercise these rights by contacting us using the details in Section 13.

10. Your Rights — EU/EEA and UK Users

If the GDPR or UK GDPR applies to you, you have the right to: access your personal data; request rectification of inaccurate data; request erasure ("right to be forgotten"); restrict or object to processing; request data portability; and withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

11. Your Rights — UAE Users

If you are located in the UAE, you have rights under Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, including the right to request access to, correction of, or deletion of your personal data, to object to certain processing, and to withdraw consent where processing is based on consent. You may contact us using the details in Section 13 to exercise these rights.

12. Cookies and Similar Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, and understand usage patterns. Where required by applicable law (including in the EU/EEA and UK), we will request your consent for non-essential cookies through a cookie banner or settings tool, and you can manage your preferences at any time through your browser or our cookie settings.

13. Contact Us and Complaints

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Mindshift Business Innovation Limited
46 Bolaji Banwo Street, Aguda, Surulere, Lagos State, Nigeria
Email: Eri@reqal.co

If you are not satisfied with our response, you may have the right to lodge a complaint with your local data protection authority — for example, the Nigeria Data Protection Commission (NDPC), your EU/EEA member state supervisory authority, the UK Information Commissioner's Office, or the relevant UAE data protection authority.

If you believe your privacy rights have been violated, you may contact us at Eri@reqal.co, and we will acknowledge your complaint within a reasonable period and investigate it in accordance with applicable law. Where required by law, we will notify affected users and the relevant regulatory authorities of eligible personal data breaches.

14. Children's Privacy

The Service is not directed at children under 18, and we do not knowingly collect personal data from children. If we learn that we have collected personal data from a child without appropriate consent, we will take steps to delete it.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email, in-app notice, or by posting the updated Policy with a revised "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.