Privacy Policy

This Privacy Policy explains how CribAssist collects, uses, shares and protects your personal information when you use cribassist.com, and the rights you have. It is written in line with the Nigeria Data Protection Act 2023 ("NDPA").

Who we are

CribAssist is a trading name of KLYMBUP SERVICES, a business name registered with the Corporate Affairs Commission of Nigeria under number BN8398825, of 82 Brigadier Ademulegun Road, Ondo, Ondo State, Nigeria. KLYMBUP SERVICES is the data controller for the personal information described in this policy.

For any privacy question or request, email privacy@cribassist.com, or use Contact & Support and choose "Privacy or personal data request".

Information we collect

Your account

When you create an account we collect your name, email address, the type of account you choose (Renter, Landlord or Property Manager) and your notification preferences. You can also add a profile photo and a short bio.

Signing in

If you sign up with an email and password, your password is stored only in a protected, irreversible form — we never see it. If you sign in with Google or Apple, we receive basic profile details from them, such as your name and email address (Apple may give us a private relay address instead). We never receive your Google or Apple password.

Identity verification

To book an inspection or rent a property, you verify your identity through our partner Prembly, which carries out the check on our behalf:

• you provide your government identity number (such as your NIN), and Prembly retrieves the matching record from official government records; and
• you take a live selfie, which Prembly checks to confirm it is a real, live person and compares with the photo on your record.

From each check we keep the result, the name on your identity record, the face-match score and liveness result, whether you are 18 or over, Prembly's reference for the check, and a protected code created from your identity number so that the same identity cannot verify two accounts. We do not keep your identity number, your date of birth, the photo from your record, your selfie or a copy of any document.

Comparing your selfie with your identity photo involves biometric data, which is sensitive personal information. We only process it with your explicit consent, which you give when you choose to start the check. If you would rather not use the online check, contact us through Contact & Support and we will tell you about other ways to verify.

Listings and public profiles

If you list a property, we collect its details, area and city, photos, units, rent, move-in fees and inspection times, and keep a record of its review. The private inspection address you give us is shown only to renters whose inspection booking you have confirmed.

A Lister's name, profile photo and bio, and whether their identity is verified, are shown publicly with their listings.

Inspections and rentals

We keep records of your inspection bookings and rentals, including the property, the amounts paid, payment and Transaction Protection status, any problem reported, and any refunds or payouts.

Payments and payouts

Payments are processed by Paystack. We receive the payment reference, amount, status and time — never your full card number or security code.

If you receive payouts, you give us your bank and account number, which Paystack confirms with your bank. We keep the bank name, the last four digits of the account number and the account name.

Support requests

When you contact us, we collect your name, email address, the topic, your message and anything else you choose to include, such as a phone number or payment reference. If you are signed in, we link the request to your account. To prevent spam, we keep a scrambled form of your IP address rather than the address itself.

If you message us on WhatsApp, we receive your phone number and messages. WhatsApp also handles those messages under its own privacy terms.

Technical information

We use cookies to keep you signed in and the website working. If you arrive through a referral link, one of our marketing links or a link on another website, we also use a cookie for up to 30 days to remember which link or website brought you, so that we can credit referrals and see which of our marketing works. It holds only the link's labels, not your browsing history. We do not use advertising cookies, and we do not share this information with advertisers. Our hosting providers record technical information such as IP addresses, browser type and the time of requests, to keep CribAssist secure.

How we use your information

• To provide our services — running your account, showing listings, and handling inspections, rentals and payments. Legal basis: performing our contract with you.
• To verify identity and prevent fraud — identity checks, making sure one identity verifies only one account, reviewing listings and investigating misuse. Legal bases: performing our contract, our legitimate interest in keeping CribAssist safe, and, for the selfie comparison, your consent.
• To process payments, refunds and payouts and keep financial records. Legal bases: performing our contract and complying with the law.
• To handle support requests and disputes. Legal bases: performing our contract and our legitimate interest in resolving problems fairly.
• To send you service messages about your account, bookings, rentals and listings. Legal basis: performing our contract. We only send marketing messages with your consent, which you can withdraw at any time.
• To meet our legal obligations, including lawful requests from authorities.

Automated decisions

Identity checks are decided automatically, based on the results Prembly returns. If a check is unsuccessful, we tell you the reason. You have the right to ask for a member of our team to review an automated decision, to give your point of view and to contest it — contact us through Contact & Support.

Who we share information with

• Other users, where needed. When you book an inspection or rent a property, the Landlord or Property Manager sees your name and the booking or rental details.
• Service providers who process information for us: Supabase (database, sign-in and file storage), Paystack (payments, refunds and payouts), Prembly (identity verification), Vercel (website hosting), Resend (email delivery), Google and Apple (if you sign in with them), Mapbox (maps of listing areas) and WhatsApp (if you message us there). They may only use your information to provide their service to us.
• Authorities and professional advisers, where the law requires it or to establish, exercise or defend legal claims.
• A buyer or successor, if our business is reorganised or sold, subject to this policy.

We do not sell your personal information.

International transfers

Our main database is hosted in London, United Kingdom, and some of our service providers process information in other countries. When your information is transferred outside Nigeria, we rely on the grounds permitted by the NDPA and take steps to keep it protected.

How long we keep information

We keep your information while your account is open and for as long as we need it for the purposes above. Records of payments, refunds and payouts are kept for as long as accounting, tax and other laws require. We keep earlier versions of our policies so we can show which terms applied at any time. Support requests are kept for as long as needed to deal with them and any follow-up.

How we protect your information

Access to personal information is restricted: you can only see your own records, and only authorised CribAssist staff can see what they need to run the service. Information is encrypted in transit, card payments are handled entirely by Paystack, and payout changes are protected by two-step verification.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, the people affected, as the NDPA requires.

Your rights

Under the NDPA you have the right to:

• be informed about how your personal information is used;
• access the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted where we no longer need it or have no legal basis to keep it;
• restrict or object to certain uses of your information;
• withdraw your consent at any time, where we rely on it;
• receive your information in a portable format, where applicable; and
• not be subject to a decision based solely on automated processing without the safeguards described above.

You can update your photo, bio and notification preferences in your profile at any time. For any other request, email privacy@cribassist.com. We may need to confirm your identity first, and we will respond within the time the law requires. Some requests may be limited where the law requires us to keep information, such as records of completed payments.

If you are not satisfied with our response, you can complain to the Nigeria Data Protection Commission.

Children

CribAssist is not intended for anyone under 18, and we do not knowingly collect personal information from children.

Changes to this policy

We may update this policy from time to time. The current version and its effective date are always shown on this page. If we make a significant change, we will let you know before it takes effect.