Data Protection

• Every request runs over HTTPS, and the app sets a strict Content Security Policy.
• Access to a row in our database is decided by row-level security, not by application code - so a bug in a page cannot expose another user’s data.
• Passwords are hashed by our authentication provider. Nobody at Sync can read yours.
• Card details never touch our servers - our payment processor handles them directly.
• Identity documents are stored in restricted buckets, readable only by the verification team.

Our database and file storage are hosted by Supabase, and the application by Vercel. Some processors store data outside Nigeria; where they do, we rely on their contractual data protection terms.

Account data for as long as your account is open. When you delete an account we archive it and purge it after 60 days, except transaction and verification records, which we keep where the law requires. Logs are kept for a short operational window and then discarded.

To access, correct, export or delete your data, email hello@letsyncyou.com from the address on your account. We respond within 30 days. If you are not satisfied you can complain to the Nigeria Data Protection Commission.

If a breach affects your data we will investigate immediately, notify the regulator as required, and tell you directly what happened, what was affected and what to do about it. We would rather tell you early than tell you neatly.

See the Privacy Policy for what we collect and why, and the Cookie Policy for what we store in your browser.