Privacy Policy
Your phone number is your account, and we keep as little about you as we can. Here's what we collect, why, and what you can do about it.
Who we are
Unfactory makes things for people, starting in Nigeria, and anyone can join from any country. You ask the AI you already use, it asks us, and we make what you approve. In this policy, "we" and "us" means Unfactory. We are the data controller for the information described here.
Questions about your data: [email protected].
What we collect
| What | Why |
|---|---|
| Your phone number | It is your account. We use it to sign you in and to send your order updates. |
| Sign-in codes | To check it's really you. We only keep a scrambled (hashed) version, and each code expires after 10 minutes. |
| Your founding number, your country and sign-up date | To show you your place in your country and keep the promises we made to early members. |
| Which AI you want to connect | To tell you when your AI can order from us. |
| Your wishes and wish list, and the one-line reasons your AI writes for its surprises | To make them, print the card in your box, and learn what people want us to make next. |
| People you make a wish for: their first name, phone number and city | To tell them something is coming (unless you chose a complete surprise) and to arrange delivery. They give us their own address. |
| Who invited you | To move the person who invited you up the line. |
| Orders: what you asked for, the design, price, delivery address and status | To make the item, deliver it and help if something goes wrong. |
| Messages you send us on WhatsApp or SMS, and delivery receipts | To reply to you and know whether our messages reached you. |
| Basic technical data, such as IP address and device type | To keep the service secure and working. |
We don't ask for your name, ID number or date of birth to sign in. We don't store card details: payments are handled by our payment provider.
Why we're allowed to use it
Under the Nigeria Data Protection Act 2023, we rely on:
- Contract: to give you an account and fulfil your orders.
- Consent: to send you sign-in codes and order updates on WhatsApp or SMS, which you agree to when you tap Send code. You can withdraw it at any time.
- Legitimate interests: to keep the service secure and prevent fraud.
- Legal obligation: to keep records the law requires, such as tax records.
Your AI agent
When you connect an AI such as Claude, ChatGPT or Gemini, it can send us your wishes and requests and receive quotes and updates for you. Your AI knows you; Unfactory only sees what you approve: the wishes themselves and, for surprises, a one-line reason for the card. We never see your conversations. Nothing is ordered or saved without your yes. What your AI provider does with your conversations is covered by their own privacy policy. You can disconnect your AI at any time.
Data stored outside Nigeria
Some of our providers store data outside Nigeria. For example, our database is hosted in the European Union. When data leaves Nigeria, we use providers with strong security and protections that meet the requirements of the Nigeria Data Protection Act.
If you live outside Nigeria
You can join Unfactory from any country. We still handle your data as this policy describes, and you have the rights your own country's law gives you. If you live in the European Union or the United Kingdom, that includes the GDPR: we rely on the reasons listed above, you have the rights listed below, and you can complain to your local data protection authority. Your data may be processed in Nigeria and the European Union.
How long we keep it
- Sign-in codes: expire after 10 minutes and are deleted regularly.
- Sign-in sessions: end after 90 days.
- Your account and wishes: until you ask us to delete them.
- Gift recipients: if they don't join or reply within 60 days of being told, or say STOP, we delete their number. For a complete surprise, we keep it only until we deliver or 60 days after we first contact them.
- Order and payment records: as long as tax and accounting law requires, usually 6 years.
- Messages: up to 12 months, unless needed for an open issue.
Your rights
You can ask us to:
- show you the data we hold about you, and give you a copy;
- correct anything that's wrong;
- delete your data, unless the law requires us to keep it;
- stop or limit how we use it, or object to a use;
- stop sending you messages. Reply STOP on WhatsApp or SMS, or contact us.
Email [email protected] from the number linked to your account, or tell us your number so we can confirm it with a code. We'll reply within 30 days. If you're not happy with our answer, you can complain to the Nigeria Data Protection Commission (NDPC), or to the data protection authority where you live.
Security
Sign-in codes and session tokens are stored only in scrambled form. Our database can only be read by our own servers, and every message from WhatsApp is checked to confirm it really came from Meta. No system is perfect: if a breach affects you, we'll tell you and the NDPC as the law requires.
Age
Unfactory is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has signed up, contact us and we'll delete the account.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you on WhatsApp or SMS before the change applies.