Privacy Policy

This Privacy Policy ("Policy") describes how Ruzzen ("we," "us," "our," or "the Platform") collects, uses, stores, shares, and protects information when you access or use the website located at ruzzen.com, its subdomains, mobile applications, APIs, and any related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this Policy. If you do not agree with any part of this Policy, you must discontinue use of our Services immediately.

This Policy applies to all users of our Services, including but not limited to: casual visitors, registered users, newsletter subscribers, political candidates who claim profiles, advertisers, data partners, media organisations, and any other individual or entity interacting with our platform.

Ruzzen is a political intelligence and data analytics platform. We are NOT a political party, campaign organisation, government entity, or news organisation. We operate independently and are not subject to editorial direction from any political actor, government body, or commercial interest.

The data controller responsible for your personal data is:

Ruzzen
Registered in Nigeria
Email: [email protected]
Website: https://ruzzen.com

For all privacy-related inquiries, complaints, or data access requests, contact us at [email protected]. We will respond within 14 business days.

3.1 Information You Provide Directly

• Email address (newsletter subscription, contact form, profile claim requests)
• Full name (contact form, profile claim requests)
• Phone number and WhatsApp number (optional, contact form, profile claim requests)
• Message content (contact form, feedback submissions, claim correspondence)
• Inquiry type and subject (contact form categorisation)
• Profile content submitted by candidates claiming a profile: bio, achievements, contact URL, video URL, profile photo
• For candidates and officeholders claiming a profile only: a copy of a government-issued identity document (NIN slip, voter's card, driver's licence, or international passport) and a selfie holding that document - see Section 9b for full details on this verification flow

3.2 Information Collected Automatically

• IP address (hashed using SHA-256 with salt for anonymisation - we do NOT store raw IP addresses)
• Browser type, version, and language preferences
• Device type, operating system, and screen resolution
• Pages visited, time spent, and navigation patterns
• Referring URL and search terms used to find our site
• Approximate geographic location (country/region level only, derived from IP)

3.3 User-Generated Content

• Prediction votes cast on state/party races (stored anonymously with hashed IP for deduplication only)
• Questions submitted to The Oracle AI system

3.4 Information We Do NOT Collect from Ordinary Users

From newsletter subscribers, casual visitors, and users of The Oracle or prediction polls, we do NOT collect:

• Passwords for newsletter or polls (these features have no account system)
• Financial or payment information
• Government-issued identification numbers
• Political party membership information
• Biometric data
• Precise geolocation (GPS coordinates)

Exception for candidates claiming a profile: if you are a political candidate or officeholder voluntarily claiming and verifying your Ruzzen profile, you will be asked to submit a government-issued ID and a selfie holding that ID. This is the only context in which we collect identity documents or images of a user's face. Section 9b describes how those documents are stored, who can see them, and when they are deleted.

Direct collection: When you submit forms, subscribe to our newsletter, cast prediction votes, or interact with The Oracle.

Automated collection: Through server logs, analytics tools, and cookies when you browse our platform.

Public sources: We collect publicly available political data from INEC (Independent National Electoral Commission) records, official government gazettes, public filings, court records, verified news reports, and other publicly accessible sources. This data relates to political candidates and office holders - NOT to private citizens.

We process personal data for the following purposes:

• Delivering newsletter content ("The Ruzzen Brief") to subscribers
• Responding to contact form submissions and inquiries
• Processing candidate profile claim requests, including verifying the identity of the person submitting the claim against the public profile they are claiming, and contacting them with questions about their submission
• Preventing abuse through rate limiting (using hashed IP addresses)
• Deduplicating prediction votes to ensure data integrity
• Generating aggregate, anonymised analytics to improve our Services
• Ensuring platform security and preventing malicious activity
• Complying with applicable laws and regulations

We do NOT use personal data for political targeting, voter profiling, campaign messaging, micro-targeting, or any form of political advertising directed at individuals based on their personal characteristics or political views.

We process personal data on the following legal grounds under the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR):

• Consent: Newsletter subscription, contact form submission, prediction voting
• Legitimate Interest: Platform security, abuse prevention, analytics, service improvement
• Legal Obligation: Compliance with Nigerian law, court orders, and regulatory requirements
• Public Interest: Publication of political data that serves the democratic process and public accountability

We do NOT sell, rent, trade, or otherwise commercially distribute your personal data to any third party.

We may share limited data with the following categories of service providers, strictly for operational purposes:

• Hosting provider (Vercel Inc.): Infrastructure and content delivery
• Database and storage provider (Supabase): Data storage, including the private storage bucket holding identity documents submitted via the profile claim flow (access restricted to our service role - never publicly accessible)
• Email delivery and inbound parsing (Resend): Newsletter dispatch, transactional emails, and routing of email replies to profile claim threads
• AI provider (Google Gemini): The Oracle question processing (questions are sent without identifying user information)
• Analytics (Plausible Analytics): Privacy-focused, cookieless analytics - no personal data transferred

All third-party service providers are contractually bound to protect your data and use it only for the specified purposes.

Law enforcement disclosure: We will only disclose personal data to Nigerian law enforcement, courts, or regulatory bodies when compelled by a valid court order or statutory requirement. We will resist overbroad or politically motivated requests to the fullest extent permitted by law. See Section 16 for our detailed policy on government requests.

We implement industry-standard security measures to protect your data:

• All data transmitted to and from our platform is encrypted using TLS 1.2+ (HTTPS)
• IP addresses are hashed using SHA-256 with a unique salt before storage - raw IPs are never persisted
• Database access is restricted and authenticated
• Content Security Policy (CSP), HSTS, X-Frame-Options, and other OWASP-compliant security headers are enforced
• Input sanitisation is applied to all user-submitted data to prevent injection attacks
• Rate limiting is applied to all API endpoints to prevent abuse
• CSRF protection via origin/referer validation
• Regular security reviews of our codebase and infrastructure

Despite these measures, no system is 100% secure. We cannot guarantee absolute security of your data and are not liable for breaches resulting from sophisticated attacks, zero-day vulnerabilities, or acts beyond our reasonable control.

• Newsletter subscribers: Retained until you unsubscribe or request deletion
• Contact form submissions: Retained for 24 months, then deleted
• Prediction votes: Retained for the duration of the election cycle they pertain to, then anonymised or deleted
• Oracle questions: Session-cached only - not persisted beyond your browser session
• Server logs: Retained for 90 days, then purged
• Hashed IP data: Retained for rate-limiting purposes for 24 hours maximum
• Profile-claim identity documents (government ID and selfie holding ID): Auto-deleted from our private storage 30 days after the claim is approved or rejected. The deletion is performed by an automated daily process. After deletion, the underlying claim record is retained but the document files themselves are gone.
• Profile-claim records (claimant name, email, status, timestamps, admin decision notes, message thread): Retained for the duration of the candidate's presence on the platform as an audit record of who verified the profile and when. You may request deletion under Section 10.
• Email verification codes (OTPs): 6-digit codes are bcrypt-hashed; the plain code only exists in transit. Codes expire and are marked used within 15 minutes.
• Magic-link login tokens: sha256-hashed; the raw token only exists in the email body. Tokens are single-use and expire 30 minutes after issue.

This section applies only to political candidates and officeholders who voluntarily claim their public Ruzzen profile via the flow at ruzzen.com/claim. It does not apply to newsletter subscribers, casual visitors, or any other category of user.

What we collect:

• A copy of one government-issued identity document of your choice: NIN slip, voter's card (PVC), driver's licence, or international passport (image or PDF, max 8 MB).
• A selfie of you holding the same identity document. This is required because an ID document on its own does not prove that the person submitting it is the person depicted. The selfie binds the two together.
• Optionally, a party endorsement letter and/or a link to a verified social profile.
• The bio, achievements, contact URL, video URL, and profile photo you wish to appear on your verified Ruzzen profile.
• Your contact email and (optionally) phone or WhatsApp number.

Purpose:

• To confirm you are the candidate or officeholder you claim to be, before granting you the ability to control the content of a public profile that voters rely on. This is the sole purpose for which identity documents and the selfie are processed.
• The documents are NOT used for political profiling, advertising, government reporting, KYC for any third party, machine-learning training, or any other secondary purpose.

Storage and access:

• Identity documents are uploaded to a private storage bucket on Supabase. They are not publicly accessible at any URL.
• Only the Ruzzen review team can access these documents, and only by minting a short-lived (5-minute) signed URL through an admin interface that requires authentication. We log the act of minting these URLs.
• Your proposed profile photo is also staged in this private bucket initially. Only after your claim is approved is the photo promoted to the public profile photo storage.

Retention:

• Identity documents (the ID and the selfie) are automatically deleted 30 days after a decision is made on your claim, whether the claim is approved or rejected. An automated daily job performs this deletion. After deletion, only the metadata (claim status, decision date, your name, your email, the admin notes) remains.
• If you would like the identity documents deleted sooner than 30 days after the decision, email us at [email protected].

Legal basis: Your explicit consent at the point of submission, in combination with our legitimate interest in operating an accurate, accountable political-information platform. You can withdraw consent and request deletion at any time per Section 10. We will retain only what is strictly necessary to maintain a public-interest record that the profile was verified and by whom (your name and email), and we will delete the rest on request.

After approval: Once your claim is approved you receive a single-use email login link (a "magic link") that lets you sign in to edit your profile content directly. The link is valid for 30 minutes and can only be used once. Sessions persist for 7 days. You can request a fresh magic link at ruzzen.com/claim/login.

Under the Nigeria Data Protection Act 2023 and applicable international frameworks, you have the following rights:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Restrict Processing: Request that we limit how we use your data
• Right to Data Portability: Request your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interest
• Right to Withdraw Consent: Withdraw previously given consent at any time (e.g., unsubscribe from newsletter)

To exercise any of these rights, email [email protected] with the subject line "Data Rights Request." We will respond within 14 business days and fulfil valid requests within 30 days.

You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your data rights have been violated.

Ruzzen uses minimal cookies and tracking technologies:

• Essential cookies: Required for basic platform functionality (session management, security)
• Analytics (Plausible): Cookieless, privacy-focused analytics that does not use cookies or track individual users
• Session storage: Used to cache Oracle responses and track question limits during your session - cleared when you close your browser

We do NOT use advertising cookies, social media tracking pixels, fingerprinting technologies, or any form of cross-site tracking.

Our Services are intended for users aged 16 and older. We do not knowingly collect personal data from children under the age of 16. If you are a parent or guardian and believe your child has provided personal data to us, contact us immediately at [email protected] and we will delete such data.

Our infrastructure providers (Vercel, Turso) may process data in locations outside Nigeria. Where such transfers occur, we ensure appropriate safeguards are in place, including contractual protections consistent with the Nigeria Data Protection Act 2023 and applicable international data transfer frameworks.

Ruzzen uses artificial intelligence (Google Gemini) to generate political analysis, prediction narratives, daily articles, and responses through The Oracle feature. Important disclosures:

• Intelligence-generated content is clearly labelled or contextually indicated as such
• AI outputs are based on publicly available data and historical patterns - they are NOT insider information
• Ruzzen predictions are probabilistic assessments, NOT guaranteed outcomes
• Questions submitted to The Oracle are processed by Google Gemini. We strip all identifying information before transmission - only the question text and relevant political context is sent
• Intelligence-generated content does not constitute political advice, endorsement, or recommendation to vote for any candidate or party
• We are not responsible for decisions made based on Intelligence-generated content

Ruzzen maintains strict political neutrality. This means:

• We are not affiliated with, funded by, or operationally connected to any political party, candidate, campaign, or government entity in Nigeria or any other country
• Our data, predictions, and analysis are generated independently using publicly available information and algorithmic models
• No political actor has editorial control, approval authority, or influence over our content, predictions, or platform operations
• Candidate profile claims (free and premium) do not influence prediction scores, rankings, or analytical outputs
• We reserve the right to publish political intelligence that may be unfavourable to any party, candidate, or government - this is protected speech under Section 39 of the Constitution of the Federal Republic of Nigeria

Ruzzen takes the following position on government and law enforcement requests for user data:

• We will only comply with requests accompanied by a valid court order issued by a court of competent jurisdiction in Nigeria
• We will NOT comply with informal requests, verbal instructions, or demands from security agencies that lack proper judicial authorisation
• We will resist requests that we reasonably believe are politically motivated, overbroad, disproportionate, or intended to identify anonymous users for the purpose of political retaliation
• We will challenge any request that we believe violates the fundamental rights guaranteed under Chapter IV of the Nigerian Constitution, including the right to privacy (Section 37), freedom of expression (Section 39), and freedom of the press
• Where legally permitted, we will notify affected users of government requests for their data
• We will publish transparency reports detailing the number and nature of government data requests received, where legally permitted to do so

Note to government actors: Ruzzen is a lawful platform that publishes publicly available political data for the purpose of democratic accountability. Attempts to compel disclosure of user data for purposes of political surveillance, intimidation, or suppression of lawful political expression will be vigorously resisted through all available legal channels.

We may update this Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Post a notice on our homepage for at least 7 days
• Notify newsletter subscribers of significant changes via email

Continued use of our Services after changes take effect constitutes acceptance of the updated Policy.

For privacy-related inquiries, data requests, or complaints:

Email: [email protected]
General: [email protected]
Website: https://ruzzen.com/contact

If you are unsatisfied with our response, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) at https://ndpc.gov.ng.