Privacy Policy
Your phone number is your account, and we keep as little about you as we can. Here's what we collect, why, and what you can do about it.
Who we are
Unfactory makes things for people in Nigeria. You ask the AI you already use, it asks us, and we make what you approve. In this policy, "we" and "us" means Unfactory. We are the data controller for the information described here.
Questions about your data: [contact email].
What we collect
| What | Why |
|---|---|
| Your phone number | It is your account. We use it to sign you in and to send your order updates. |
| Sign-in codes | To check it's really you. We only keep a scrambled (hashed) version, and each code expires after 10 minutes. |
| Your founding maker number and sign-up date | To show you your place and keep the promises we made to early makers. |
| Which AI you want to connect | To tell you when your AI can order from us. |
| Orders: what you asked for, the design, price, delivery address and status | To make the item, deliver it and help if something goes wrong. |
| Messages you send us on WhatsApp or SMS, and delivery receipts | To reply to you and know whether our messages reached you. |
| Basic technical data, such as IP address and device type | To keep the service secure and working. |
We don't ask for your name, ID number or date of birth to sign in. We don't store card details: payments are handled by our payment provider.
Why we're allowed to use it
Under the Nigeria Data Protection Act 2023, we rely on:
- Contract: to give you an account and fulfil your orders.
- Consent: to send you sign-in codes and order updates on WhatsApp or SMS, which you agree to when you tap Send code. You can withdraw it at any time.
- Legitimate interests: to keep the service secure and prevent fraud.
- Legal obligation: to keep records the law requires, such as tax records.
Your AI agent
When you connect an AI such as Claude, ChatGPT or Gemini, it can send us your requests and receive quotes, previews and order updates for you. Nothing is ordered until you approve it. What your AI provider does with your conversations is covered by their own privacy policy, not this one. You can disconnect your AI at any time.
Data stored outside Nigeria
Some of our providers store data outside Nigeria. For example, our database is hosted in the European Union. When data leaves Nigeria, we use providers with strong security and protections that meet the requirements of the Nigeria Data Protection Act.
How long we keep it
- Sign-in codes: expire after 10 minutes and are deleted regularly.
- Sign-in sessions: end after 90 days.
- Your account: until you ask us to delete it.
- Order and payment records: as long as tax and accounting law requires, usually 6 years.
- Messages: up to 12 months, unless needed for an open issue.
Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy;
- correct anything that's wrong;
- delete your data, unless the law requires us to keep it;
- stop or limit how we use it, or object to a use;
- stop sending you messages. Reply STOP on WhatsApp or SMS, or contact us.
Email [contact email] from the number linked to your account, or tell us your number so we can confirm it with a code. We'll reply within 30 days. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC).
Security
Sign-in codes and session tokens are stored only in scrambled form. Our database can only be read by our own servers, and every message from WhatsApp is checked to confirm it really came from Meta. No system is perfect: if a breach affects you, we'll tell you and the NDPC as the law requires.
Age
Unfactory is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has signed up, contact us and we'll delete the account.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you on WhatsApp or SMS before the change applies.