Privacy Policy

LegitAfrica(“we,” “us,” or “our”) operates a business review platform for African markets. This policy explains what personal information we collect when you use our website and app, why we collect it, how we protect it, and the rights you have over it. By using LegitAfrica, you agree to the practices described here.

1. Information we collect

From everyone with an account:

• Email address, display name, and country — required to register.
• Phone number — optional.
• Your password, which we never store directly: it is one-way scrambled (hashed) so that even we cannot read it back.
• If you sign in with Google, we receive your name, email, and profile picture from Google, not your Google password.

When you write a review:

• The review text, star rating, and (if you choose to add one) a private order or invoice reference number — this reference is never shown publicly and is used only to help verify genuine purchases if a business disputes your review.
• Your IP address, browser type, and a device signature. We use these only to detect coordinated fake-review activity (for example, the same person posting many reviews from one connection in a short time) — never to identify you to other users.
• If a review is disputed, any receipt or proof-of-purchase file you choose to upload.

If you claim or register a business:

• Your role at the business, a work email or evidence of association, and — for identity verification — a business registration number and supporting documents (such as a certificate of incorporation or a director's identification).

We deliberately do not ask for information we do not need to run the service: no date of birth, no gender, no national identity number from ordinary reviewers, and no physical home address.

2. How we use your information

• To create and secure your account, and to let you log in.
• To publish your reviews and, if you choose, your replies as a business owner.
• To automatically screen new reviews for signs of fraud (for example, an account that is brand new, or a burst of reviews from the same connection) before deciding whether a review needs a closer look from our moderation team.
• To have an artificial intelligence service (see “Third parties” below) read the text of a review and flag it for our moderators if the wording looks fake, incentivised, spam, or otherwise against our review guidelines. This never blocks your review from being submitted — it only flags it for a human to check afterward.
• To verify a business claim against the registration details and documents provided.
• To send you emails you cannot opt out of because they are essential to your account (verifying your email address, confirming a claim decision, requesting proof of purchase during a dispute), and, if you have them switched on, optional emails (someone replied to your review, your business got a new review). You can turn the optional ones off at any time from your notification settings, or with the one-click unsubscribe link in any email.

3. Who we share it with

Third parties that process data on our behalf:

• Anthropic (maker of the Claude AI model) receives the text, star rating, and title of a review in order to screen it for content issues, as described above. It does not receive your name, email, or any other account information.
• Our email delivery provider sends the emails described above on our behalf.
• Our cloud storage provider stores uploaded identity documents and receipts. These files are encrypted before they are stored, using a key kept separately from the storage itself — so even a breach of the storage provider would not expose readable documents.

We do not sell personal information to anyone, for any reason. We do not share your email, phone number, or uploaded documents publicly. Published reviews show your display name only — never your email, phone number, or IP address.

4. How we protect it

• Passwords are one-way hashed, never stored in readable form.
• Your login session uses a short-lived key plus a separate renewal key that is kept in a locked cookie your browser's own scripts can never read — so even a malicious script on a page could not steal a month-long login.
• Identity documents and purchase receipts are encrypted at rest with a key held outside the database, and are only ever accessible through a request from you or an authorised staff member — never by a public link.
• Every action a staff member takes on your account, a review, or a business claim is permanently logged, so there is always a record of who did what and when.

5. How long we keep it

We keep your account information for as long as your account is active. Published reviews are kept indefinitely as part of the public record — this is the core purpose of the service — even if you later delete your account (see below). Fraud-detection information such as IP address and device signature is kept only as long as needed for that purpose and is not retained indefinitely.

6. Your rights

• Delete your account.From your account settings, you can permanently delete your account at any time. This immediately scrubs your name, email, phone number, password, and any linked social sign-in, and releases any business you own so it can be re-claimed. Your reviews are kept — re-attributed to “Former user” — so that the ratings and feedback other people rely on are not distorted by an account being deleted. This cannot be undone.
• Control what we email you.Manage or turn off optional notifications at any time from your account settings, or the “manage preferences” / “unsubscribe” link in any email — no login required for that link.
• Ask what we hold on you. You can request a copy of the personal information we hold about you, or ask us to correct it, by contacting us at the address below.

7. Where this applies

We are built for African markets and designed with Nigeria's Data Protection Regulation (NDPR) in mind. If you are located in the European Union or United Kingdom, you also have rights under the GDPR / UK GDPR, which this policy is intended to support alongside NDPR.

8. Children

LegitAfrica is not directed at children, and we do not knowingly collect information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will remove it.

9. Changes to this policy

If we make a material change to how we handle your information, we will update the date at the top of this page and, where the change is significant, notify you directly.

10. Contact us

Questions about this policy, or a request about your data, can be sent to privacy@legitafrica.com.