Privacy policy

OgaKey is a service for finding homes to rent and managing rentals in Kaduna and Abuja, Nigeria, used by tenants and Ogas (agents and property owners who list and manage homes). This policy explains what personal data the service holds, why, and what you can do about it. It is written to follow the Nigeria Data Protection Act 2023 (NDPA).

OgaKey is for people aged 18 and over. Everyone confirms their age when they sign up. If we learn that an account belongs to someone under 18, we close it and delete its data.

• Account details: your name, email, phone number, role (tenant or Oga), business or agency name for Ogas, and the date you gave consent. For Ogas, which access code was used to sign up. Passwords are stored only as a one-way hash; we cannot read them.
• Property records entered by an Oga: properties, units, rent figures and the bank account tenants pay into.
• Tenant records entered by the Oga: name, phone, email, National Identification Number (NIN), occupation, employer, next of kin name and phone, and notes.
• Leases and payments: tenancy dates, rent and fees, and payments recorded as received, who recorded them and whether they were confirmed (amount, date, method and reference).
• Management agreements signed before 27 October 2026, when agreements between landlords and agents were retired: the terms agreed, the names typed to sign, when, and the network address they signed from. They are kept as a record only.
• Activity log: a record of changes made to an Oga's records and who made them, including OgaKey's decisions on their listings.
• Listings and enquiries: listing details and photos, which OgaKey reviews before a listing goes live, and the messages and WhatsApp numbers tenants send with an enquiry, shared with the Oga who owns that listing.
• Inspection requests: the times you choose and any note, shared with the Oga who owns the listing, and your NIN if you choose to give it. Giving a NIN is optional; it is stored encrypted and is not shown to the Oga.
• Reports: reports about listings, with the reason and details given. The person reported is not told who sent a report.
• Maintenance requests: what was reported, by whom, its priority and status.
• Technical data: a sign-in cookie that keeps you logged in, and the network address of sign-in and password-reset attempts, kept briefly to block password guessing. The sign-in cookie is needed for the service to work, so no cookie banner is shown; there are no advertising or analytics cookies.

We do not use advertising or analytics trackers, and we do not sell personal data.

To run the service you asked for: showing each person the properties, tenancies, rent position and repairs they are entitled to see, and keeping accounts secure. Account holders give explicit consent when they sign up. Ogas who enter tenant details are responsible for having a lawful reason to share them, normally the tenancy itself.

• An Oga sees every record about their own properties. No Oga can see another Oga's records.
• OgaKey administrators see listings, including those waiting for approval, and the account details needed to review them and to act on reports.
• A tenant sees their own home, lease, payments, enquiries and the issues they reported.

OgaKey uses three providers, who process data only on our instructions and only to run the service:

• Vercel (Vercel Inc., United States) runs the app on servers in Frankfurt, Germany. Public pages, such as live listings, may be delivered from its network in other countries.
• Neon stores the database, including photos, in Frankfurt, Germany.
• Resend (United States) delivers OgaKey's emails, so it handles your email address and the text of the emails we send you.

Germany is covered by the European Union's General Data Protection Regulation. You agree to this storage outside Nigeria when you sign up, and you can withdraw that agreement by closing your account.

When an Oga enters details about their tenants, the Oga decides what is kept and why. OgaKey stores and processes those details only to provide the service to that Oga, as set out in the terms.

Data travels encrypted. Passwords are stored only as a one-way hash, and NIN, phone numbers, bank details and messages are also encrypted in the database. If a breach puts your personal data at risk, we report it to the Nigeria Data Protection Commission within 72 hours and tell the people affected without delay.

Records stay for as long as the account that manages them is open. An Oga can delete tenants, properties and leases from their dashboard. Activity entries are kept as a record for as long as the Oga's account is open. When an account is closed, its records are removed with it. Password-reset links expire after 60 minutes and invite links after 14 days.

Under the NDPA you can ask to:

• see the personal data held about you;
• have it corrected or deleted;
• withdraw consent or object to how it is used;
• receive a copy in a usable format.

Tenants can also ask their Oga, who controls the record. If you are not satisfied with a response, you may complain to the Nigeria Data Protection Commission.

Contact details for privacy and account requests will be published here before launch.