Privacy Policy

This Privacy Policy explains how SabaothCloud ("SabaothCloud", "we", "us", or "our") collects, uses, discloses, stores, and protects personal data when you use our website, dashboard, APIs, managed PostgreSQL databases, compute services, and related products (the "Services").

We process personal data in accordance with applicable data-protection law, including the Nigeria Data Protection Act 2023 where it applies. By using the Services, you acknowledge this Policy. The Cookie Policy provides additional information about cookies and similar technologies.

1. Who is responsible for your data

SabaothCloud is the controller of personal data we process for our own business, account, billing, security, and support purposes. When we process personal data contained in Customer Data on behalf of an organization using the Services, that organization is generally the controller and SabaothCloud acts as its processor. That processing is governed by our Data Processing Agreement.

2. Personal data we collect

Depending on how you interact with us, we may collect:

• identity and account details, such as your name, email address, organization, and role;
• billing and transaction details, such as plan, invoices, payment status, and currency;
• technical and usage data, such as IP address, browser, device, timestamps, logs, and feature activity;
• support and communications data, including messages, feedback, and records of requests; and
• Customer Data that you or your organization choose to store or process through the Services.

We do not need the full details of your payment card. Payment details are handled by our payment providers, such as Paystack, in accordance with their own terms and privacy notices.

3. How we collect data

We collect data directly from you when you create an account, use the dashboard, contact us, subscribe to a plan, or provide feedback. We also collect technical data automatically when the Services are used, and may receive data from payment, authentication, infrastructure, analytics, and other service providers.

4. How we use personal data

We use personal data to:

• create and administer accounts, organizations, subscriptions, and access permissions;
• provide, operate, maintain, secure, troubleshoot, and improve the Services;
• process payments, issue invoices, prevent fraud, and manage credit or billing disputes;
• send service messages, security alerts, support responses, and important account notices;
• understand product usage and develop features, using aggregated or de-identified information where appropriate;
• comply with legal obligations, enforce agreements, and protect rights, safety, and property; and
• send optional marketing communications where permitted and where you have not opted out.

5. Lawful bases

Where required by law, we process personal data because it is necessary to perform a contract with you, to comply with a legal obligation, to protect vital interests, or for our legitimate interests in operating and securing the Services. We rely on consent where consent is required or where we ask for it, and you may withdraw consent at any time without affecting earlier processing.

6. When we disclose personal data

We may disclose personal data to service providers that process it for us, including hosting, infrastructure, payment, communications, security, analytics, and support providers. They may use the data only to provide services to us and must protect it appropriately. We may also disclose data to professional advisers, regulators, law-enforcement authorities, or a successor entity in a merger, acquisition, financing, or sale, where legally permitted or required.

We do not sell your personal data. We do not disclose Customer Data for advertising or unrelated purposes.

7. International transfers

Our primary data-center and storage location is Germany. Some service providers or support systems may process limited data in other countries where necessary to provide the Services. We do not disclose infrastructure partner names in this Policy, but we will provide information about relevant processing locations and recipient categories where required by applicable law.

Before transferring personal data from Nigeria, we take steps required by applicable law to establish an adequate level of protection, use appropriate contractual or other safeguards, and obtain any required approval or consent. You can contact us for more information about the transfer basis and safeguards applicable to a particular processing activity.

8. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including providing the Services, maintaining business and financial records, resolving disputes, enforcing agreements, and meeting legal, tax, accounting, and security requirements. Retention periods vary by data type and relationship. We securely delete or anonymize data when it is no longer needed, subject to backups and lawful retention requirements.

9. Your rights

Subject to applicable law and its conditions, you may have the right to request access to, correction of, deletion of, or restriction of processing of your personal data. You may also object to certain processing, request portability, withdraw consent, and opt out of marketing communications. We may need to verify your identity before completing a request and may retain information where the law permits or requires it.

To exercise a right, contact privacy@sabaothcloud.com. If you are not satisfied with our response, you may have the right to complain to the Nigeria Data Protection Commission or another competent supervisory authority.

10. Security and incidents

We use access controls, authentication, encryption where appropriate, logging, monitoring, backups, and organizational procedures designed to protect personal data. No security measure eliminates all risk. If we identify a personal-data incident that requires notification, we will notify affected parties and regulators as required by applicable law.

11. Children's data

The Services are intended for businesses and developers and are not directed to children. We do not knowingly collect personal data from a child in violation of applicable law. Contact us if you believe a child has provided personal data so we can review and take appropriate action.

12. Changes to this Policy

We may update this Policy from time to time. We will post the updated version and change the date above. Where required, we will provide additional notice or obtain consent for material changes.

13. Contact us

For privacy questions or requests, contact privacy@sabaothcloud.com. General enquiries can be sent to hello@sabaothcloud.com.