BondCircle Privacy Notice

Updated 2 August 2026. This notice explains the current product's data practices, including one-time circle activation, and remains subject to Nigerian privacy counsel review.

1. Who controls your information

Bond Circle is the supplied service identity and data controller for the activities described here. Its supplied contact address is 6 Jehova Elohim, Gowon Estate, and telephone contact is +234 906 228 4074. Its RC number, official privacy email and Data Protection Officer details must still be confirmed before public launch. Google acts as a processor for configured Firebase services.

2. Scope

This notice applies to BondCircle registration, authentication, profiles, circles, invitations, contribution records, receipts, announcements, activity, one-time circle activation and support interactions. A selected activation-payment provider will publish its own privacy notice and will process checkout information independently or as otherwise stated at checkout.

3. Information we collect

Depending on the features you use, we collect:

Account data such as display name, email address, phone number, profile image, identifiers and verification status.
Circle data such as membership, roles, invitations, targets, tiers, deadlines, contribution status and delivery status.
Content such as announcements, comments, support messages and payment-proof images you choose to upload.
Technical and security data such as IP address, device or browser information, authentication events, session data, error logs and audit records.
Legal-choice records such as the version and time of Terms agreement and Privacy Notice acknowledgement.

4. Information we intentionally do not request

The current registration flow does not request gender, precise location, bank-login details, card numbers, PINs or authentication codes. Do not include those details in profile text, comments or payment proof.

5. Sources

We receive information from you, circle organisers or members who invite you or update a circle, your chosen sign-in provider, your device, and service providers that operate the platform.

6. Why we use information and our legal bases

We use necessary account and circle data to provide the service and perform our agreement with you. We use security, fraud-prevention, audit and service-improvement data for legitimate interests and legal obligations, balanced against your rights. We use consent only where it is the appropriate legal basis, and you may withdraw it without affecting earlier lawful processing.

Any optional marketing or materially different use will have its own clear, unticked choice.

7. What other participants can see

Circle participants may see your display name, profile image, role, invitation or contribution status and information needed to coordinate that circle. Organisers may see uploaded payment proof. Exact field-level visibility must be documented and tested before launch.

8. Sharing

We share data with other circle participants as described above, with processors that host and secure the service, with professional advisers where necessary, and with authorities when lawfully required. We do not sell personal data.

A complete, current processor and subprocessor list must be published before launch.

9. Firebase and international processing

BondCircle uses Google Firebase for authentication and related infrastructure. Firebase Authentication may process email addresses, phone numbers, user-agent strings and IP addresses. Data may be processed outside Nigeria on Google infrastructure.

Before launch, BondCircle must document each Firebase service, processing region, transfer destination and the lawful safeguard used for international transfers.

10. Retention

Email verification challenges expire after 10 minutes and current application sessions after 8 hours. Firebase states that Authentication IP addresses are retained for a few weeks and other Authentication information is retained until a user or administrator initiates deletion, after which removal from live and backup systems generally occurs within 180 days.

Retention periods for profiles, circles, receipts, audit logs, support messages and backups must be approved and published before launch. We will not keep personal data longer than necessary for its stated purpose or a legal requirement.

11. Security

We use controls including verified sign-in methods, limited verification attempts, expiring sessions, secure HTTP-only cookies, audit events, access rules and encryption provided by our infrastructure. No system is completely secure, so users should protect their devices and report suspected compromise promptly.

12. Your rights

Subject to the Nigeria Data Protection Act 2023 and applicable exceptions, you may ask to be informed, access your data, correct inaccurate data, erase data, restrict or object to processing, receive portable data, withdraw consent, and challenge certain solely automated decisions.

You may complain to BondCircle and to the Nigeria Data Protection Commission. Identity verification may be required before a request is fulfilled.

13. Account deletion and data export

The in-product request route, verification steps, completion time, export format and lawful retention exceptions must be implemented and documented before launch. Deleting an account may not remove information another participant is legally entitled to retain or records required for security and legal compliance.

14. Children

BondCircle is not designed to collect children’s information without the protections required by law. The minimum age and any verified parental-consent process must be decided before public registration is enabled.

15. Cookies and local storage

BondCircle uses strictly necessary cookies and browser storage for authentication, security, verification and continuity of the registration process. We also use Vercel Web Analytics and Speed Insights to understand aggregate traffic and real-world performance. They may process page or route information, referrer, approximate country, device, browser, operating system and performance measurements. BondCircle removes query strings, URL fragments, invitation tokens and dynamic user or circle identifiers before telemetry is sent. These services are configured without advertising trackers, and BondCircle does not use them to build advertising profiles.

16. Automated decisions and incidents

The current product does not intentionally make decisions with legal or similarly significant effects solely by automated processing. Any such future feature must be disclosed with the required safeguards.

We will assess personal-data incidents and notify the Nigeria Data Protection Commission and affected people when the law requires it.

17. Changes and contact

We will show an effective date and give appropriate notice of material changes. Privacy questions and rights requests will be sent to the privacy contact and Data Protection Officer details inserted before launch.

Pre-launch details required: controller identity and address, privacy email, DPO, age rule, service and region inventory, transfer safeguards, processor list, retention schedule, rights-request timetable, deletion/export process and incident contact.

Official references

This draft was informed by the Nigeria Data Protection Act 2023, NDPC guidance and Google Firebase’s privacy and processing terms.