Introduction
Truko is a product of Stata Insight Technologies Limited (“we”, “our”, or “us”). We operate the Truko platform (a Client Revenue Operating System for Nigerian service businesses) accessible at truko.io
This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have over it. It applies to all users of the Truko platform, including workspace owners, team members, and visitors to our marketing website.
We are committed to protecting your privacy in accordance with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act 2023 (NDPA). By using Truko, you agree to the practices described in this policy.
Data We Collect
Account and workspace data
When you register a Truko workspace, we collect:
- Your full name and email address
- Your workspace name and business sector
- Your password (stored as a cryptographic hash, never in plain text)
- Business details you add voluntarily (address, CAC number, TIN)
Client and prospect data
Truko stores the client and prospect information you enter into your workspace, including:
- Organisation names, contact names, email addresses, and phone numbers
- Contract details, invoice amounts, and payment records
- Interaction notes, call logs, and communication history
This data belongs to you. You are the data controller for your clients' data. Truko acts as a data processor on your behalf.
Usage and technical data
We automatically collect data about how you use the platform, including:
- Log data (IP address, browser type, pages visited, timestamps)
- Device information (operating system, screen resolution)
- Feature usage patterns (which modules are used most)
Payment data
Subscription payments are processed by Paystack. We do not store your full card details. We receive a payment reference, status, and transaction amount from Paystack.
WhatsApp integration data
WhatsApp Business messaging is coming soon. When it launches, we will update this policy to describe what message data is collected and how it is stored.
How We Use Your Data
We use the data we collect to:
- Provide, operate, and improve the Truko platform
- Process subscription payments and send billing notifications via Paystack
- Send transactional emails (account verification, password resets, invoices)
- Respond to support requests and troubleshoot issues
- Detect and prevent fraud, abuse, and security incidents
- Analyse aggregate usage patterns to improve product features (we use anonymised data for this purpose)
- Comply with legal obligations, including tax and regulatory requirements in Nigeria
We do not sell your personal data to third parties. We do not use your client data for advertising.
Data Sharing
We share data only where necessary to provide the service or comply with the law.
Service providers
We use trusted third-party services to operate Truko. Each provider processes data only on our instructions:
Legal disclosures
We may disclose your data if required by Nigerian law, a court order, or a regulatory authority (such as the Nigeria Data Protection Commission). We will notify you of any such disclosure unless prohibited from doing so by law.
Business transfers
If Stata Insight Technologies Limited is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
Data Retention
We retain your workspace data for as long as your account is active or as needed to provide the service.
Workspace data (including clients, contracts, invoices, and interactions) is permanently deleted as soon as you delete your workspace. There is no grace period or recovery window.
Server log data is retained for security and troubleshooting purposes, then permanently purged.
Your Rights
Under the Nigeria Data Protection Act 2023, you have the following rights regarding your personal data:
Request a copy of the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your data. Deleting your workspace permanently erases all your data immediately.
Request your data in a structured, machine-readable format.
Object to processing based on legitimate interests.
Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email [email protected]. We will respond within 30 days.
Security
We implement industry-standard security measures to protect your data:
- All data transmitted between your browser and our servers is encrypted via TLS
- Passwords are hashed using bcrypt, never stored in plain text
- API tokens are rotated on logout and expire automatically after periods of inactivity
- Access to production systems is restricted to authorised personnel only
- We conduct regular security reviews of our infrastructure and code
No method of transmission over the internet is 100% secure. If you discover a security vulnerability, please report it to [email protected].
Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and display a notice in the Truko dashboard at least 14 days before the changes take effect. Your continued use of Truko after the effective date constitutes acceptance of the updated policy.
Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact our Data Protection Officer:
If you are not satisfied with our response, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.