Brakett is developed and operated by The Boring Tech Co. (“we”, “us”), a technology company registered in Nigeria. Brakett helps service businesses (“Businesses”) manage bookings, payments and customer communication. This policy explains how we handle personal data under the Nigeria Data Protection Act (NDPA) 2023.
Roles
- For a Business’s customer data, the Business is the data controller and Brakett is the data processor acting on the Business’s instructions.
- For a Business account (the account holder’s own details), Brakett is the controller.
What we collect
- Business accounts: name, business name, email, phone, logo, login credentials.
- Customers (on behalf of Businesses): name, phone, email, booking history, payment metadata (amounts/references — not card numbers), and the content of WhatsApp/email messages sent through Brakett.
- Device recognition (booking page): after a successful booking, a random device token is stored in that browser so a returning customer on the same device can be greeted and have their details prefilled (shown masked) for the same business — no account or password. The token is stored hashed on our side, is scoped to one business, and clearing browser storage forgets the device. While filling the booking form, a short-lived draft of what you typed is kept in the browser’s session storage (~6 hours) so a page reload doesn’t lose it; it is cleared when the booking completes.
We collect only what is needed to provide the service (data minimisation).
Why we process it (lawful basis)
- Contract / legitimate interest: to deliver bookings, take payments, send transactional messages (confirmations, reminders, receipts, balance requests).
- Consent: for marketing/relationship messages (promotions, win-back, reviews, loyalty, referrals) — opt-in, withdrawable any time.
- Legal obligation: to keep financial records.
Payments
Payments are processed by Paystack. Brakett never stores card details — only a transaction reference and amount.
Who we share with
Named processors only (see our Third-Party Register): Supabase (hosting), Paystack (payments), Resend (email), WhatsApp Cloud API/Meta (WhatsApp). We do not sell personal data.
Retention
We keep data only as long as needed. Communication content is minimised after 12 months; financial records are kept as legally required; full schedule on request. A customer can request erasure (we anonymise personal data while keeping de-identified financial records as the law requires).
Your rights (NDPA)
Access, rectification, erasure, portability, and withdrawal of consent. To exercise them, contact the Business you booked with, or contact us and we will route it. We respond within 30 days.
Security
Encryption in transit (TLS) and at rest, strict tenant isolation (row-level security), secret management via a vault, signed/expiring links, verified webhooks, and audit logging.
Contact
The data controller for Business accounts (and processor for Businesses’ customer data) is:
THE BORING TECH CO. (CAC business name registration BN 9563493) 16, Yomi Ajetunmobi Street, Sangotedo, Lekki, Lagos, Nigeria Email: privacy@usebrakett.com · General: hello@usebrakett.com Phone: +234 912 609 0761
(A Data Protection Officer will be appointed if/when Brakett’s scale requires it under NDPC guidance.)
Changes
We version this policy. Material changes are surfaced for acceptance; the version you accepted is recorded.