Privacy Policy

1. Who We Are

Goallord SmartChat is a product of Goallord Creativity Limited ("Goallord", "we", "us", "our"), a company incorporated in Nigeria. Goallord SmartChat is a multi-tenant AI website-assistant platform that lets our business customers ("Workspace Owners") embed a chat widget on their websites to answer questions from their own approved content.

This policy explains how we handle personal data. It applies to our public website, the Goallord SmartChat dashboard, and the embeddable chat widget.

2. Our Two Roles (Controller vs. Processor)

Under the Nigeria Data Protection Act 2023 (NDPA), the GDPR, and similar laws, our responsibilities depend on whose data is involved:

• For Workspace Owner account data (the person who signs up and runs a workspace), we act as the data controller.
• For website-visitor data that flows through a Workspace Owner's widget (conversation messages, contact details a visitor submits), the Workspace Owner is the data controller and Goallord acts as a data processor on their instructions. Visitors with questions about how their data is used on a particular website should contact that website's operator.

3. What We Collect

(a) Workspace Owner account data.

• Email address and a securely hashed password.
• Optional business profile you provide (business name, website, contact email/phone, industry).
• Billing metadata (plan, subscription status, and a customer/subscription reference). We do not store full card numbers; payments are handled by our payment processors (see §5).

(b) Visitor data (processed on the Workspace Owner's behalf):

• The text of messages a visitor sends in a conversation.
• Any name, email, phone number, or other details a visitor voluntarily submits (for example to leave a lead, book an appointment, request a transcript, or ask to speak to a human).
• Session metadata such as approximate timestamps, browser/user-agent, and the page URL the visitor was on, used for conversation continuity, context, and analytics.

(c) Technical data. To operate the widget we store a session token in the browser's local storage so a visitor's conversation persists across page loads. This is strictly necessary for the service to function and is not used for advertising. We do not use third-party advertising trackers, and we do not sell personal data.

4. How We Use Data & Legal Bases

• Provide the service: generate grounded answers, capture leads, book appointments, escalate to humans (performance of contract / the Workspace Owner's instructions).
• Escalations & notifications: route a visitor's request and details to the Workspace Owner's staff by email, web push, or Telegram.
• Analytics: aggregate, de-identified statistics (volume, deflection rate, escalation rate) so Workspace Owners can measure performance (legitimate interests).
• Service communications: account, security, and important product notices.
• Legal & security: prevent abuse, enforce our Terms, comply with law.

5. Sub-Processors & International Transfers

We use the following vetted sub-processors to run the service. Because these providers are located outside Nigeria (primarily the United States and the EU), using Goallord SmartChat involves international transfers of data, carried out under the relevant provider's data-processing terms and applicable safeguards (such as standard contractual clauses).

AI providers receive the conversation content needed to answer a question. We instruct our providers not to use data submitted through the API to train their models where such an option is offered. This list may change as the service evolves; we will update this page accordingly.

6. Data Retention

Conversation and visitor data is retained until the earliest of: (a) the Workspace Owner or an admin deletes the conversation from the dashboard; (b) the Workspace Owner enables automatic data retention and the data ages past the chosen window (a nightly purge then permanently deletes visitor conversation data older than the cutoff, keeping only de-identified aggregate metrics and appointment records); or (c) the Workspace Owner closes the workspace, which permanently deletes all associated conversations, knowledge-base content, and account data. Automatic retention is opt-in and off by default, so Workspace Owners are responsible for deleting data they no longer need.

7. Security

We apply organisational and technical measures appropriate to the risk, including:

• Encryption of traffic in transit (TLS) and encryption of sensitive fields at rest.
• Strict per-workspace data isolation, so one customer's data is not reachable from another.
• Rate limiting and abuse protection on the widget, sign-in, and sign-up.
• Access controls limiting who within a workspace can view or manage data.

No system is perfectly secure, but we work to protect data against unauthorised access, loss, or misuse.

8. Your Rights

Subject to applicable law (including the NDPA and, where relevant, the GDPR), you may have the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent.

• Workspace Owners can update or delete account information in the dashboard and can close their workspace at any time, permanently deleting all data.
• Visitors should direct requests to the operator of the website where they used the widget (the data controller). If a visitor contacts us directly, we will forward the request to the relevant Workspace Owner and assist as their processor.

You also have the right to lodge a complaint with a supervisory authority, in Nigeria, the Nigeria Data Protection Commission (NDPC).

9. Children

Goallord SmartChat is a business tool not directed to children. We do not knowingly collect personal data from children under 18. Workspace Owners must not use the service to knowingly collect data from children without a lawful basis and appropriate consent.

10. Data Breaches

If we become aware of a personal-data breach that is likely to result in a risk to affected individuals, we will notify the relevant Workspace Owner(s) and, where required, the applicable supervisory authority, without undue delay and consistent with our legal obligations.

11. Changes to This Policy

We may update this policy as the service evolves or the law changes. We will post the updated version here with a new "Last updated" date and, for material changes, notify Workspace Owners by email or in-app notice.

12. Contact

Privacy questions, or to exercise your rights, contact Goallord Creativity Limited at privacy@goallordcreativity.com.