Privacy Policy

1. Who this policy covers & who we are

Update ("we", "us") operates a live-coverage platform: organizations run events, and contributors — people at those events — send updates in by instant messaging, the web, or the Update mobile app. Organizations moderate what goes public on their own event pages ("reader pages") and inside the app.

This policy covers everyone whose personal data we process through that: readers/contributors (people who send in or view updates, whether or not they create an account), organization staff (people who sign up an organization and moderate its events), and site visitors to our marketing pages.

2. What data we collect

What we collect depends on how you interact with us — sending a message via WhatsApp is different from creating a full reader account. Here's the actual breakdown:

We do not ask channel-only contributors (a phone number or Telegram ID with no linked account) to create a password or hand over any more information than the message itself — you can contribute without ever "signing up."

3. How we use it, and our legal basis

Both the EU General Data Protection Regulation (GDPR) and Nigeria's Data Protection Act / NDPR require a lawful basis for every use of personal data. Here's ours:

4. Who we share it with

We don't sell personal data. We share it only where it's necessary to run the service:

• The organization hosting the event you're posting to — they can see everything about your submission needed to moderate it (your message, media, and the channel/identity you sent it from).
• Meta (WhatsApp Business Platform) and Telegram — the messaging channels themselves, only for messages you send through them, subject to their own privacy policies.
• Cloudinary — our media hosting provider, for photos and videos you upload.
• Google / Facebook — only if you choose OAuth sign-in, to authenticate you.
• Our email delivery provider — to send OTP codes and account notifications.
• Our hosting/infrastructure provider — who stores the database and runs the servers on our behalf, under a data processing agreement.
• Authorities, only when we're legally required to (a court order, a lawful regulatory request), and we'll push back on anything overbroad.

Every one of these is bound to only use your data for the purpose we've given it to them for — none of them may use it for their own independent marketing.

5. International transfers

Update operates across multiple countries, and our infrastructure/processors may be located outside your own country (including outside the EEA or Nigeria). Our servers and processors are located in Nigeria, the United States, the United Kingdom, and South Africa. Where we transfer personal data internationally, we rely on recognized safeguards — Standard Contractual Clauses (GDPR Art. 46) for transfers out of the EEA/UK, and NDPR-compliant adequacy/contractual safeguards for transfers out of Nigeria.

6. How long we keep it

We keep data only as long as it's actually needed:

• Published content (approved updates) — kept for as long as the organization's event page exists, since it's the historical record of that event.
• Raw inbound message payloads (the original webhook data) — retention is configurable per deployment; by default it is not automatically deleted, but any organization can set a retention window after which raw payloads are permanently erased while the approved content itself remains.
• Rejected/unmatched messages — kept only long enough for moderation review, then eligible for deletion.
• Account data — kept while your account is active, deleted (or anonymized where deletion would break another user's own record, e.g. a reply thread) within a reasonable period after you delete your account.
• Security/rate-limit logs — short-lived, rolling windows, purged automatically.

7. Security

We apply technical safeguards proportionate to the sensitivity of the data:

• Passwords are hashed, never stored in plain text.
• Public per-event live chat messages are encrypted at rest.
• API access is rate-limited and access-controlled per organization — one organization can never read another's private data.
• Administrative actions (blocks, deletions, key changes) are recorded in an append-only security log.
• We run automated checks against known scraping/bot signatures and enforce upload size limits to reduce abuse surface.

No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify affected users and the relevant supervisory authority as required by applicable law (GDPR: within 72 hours where feasible; NDPR: without undue delay).

8. Your rights

Subject to the conditions and exceptions in applicable law, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), including deleting your account.
• Restrict or object to certain processing, including processing based on legitimate interest.
• Port your data to another service in a structured, machine-readable format.
• Withdraw consent at any time, where processing is based on consent (this doesn't affect processing already carried out).
• Lodge a complaint with your local data protection authority — see §14.

To exercise any of these, use the in-app account deletion/edit tools where available, or contact us — see §14.

9. Automated moderation

Approved updates can be published automatically without human review when the sender has an established trust level an organization has configured as sufficient (for example, a verified, previously-approved contributor). This is a content-publishing decision, not a decision that produces legal or similarly significant effects about you as an individual — but in the interest of transparency, we disclose it here. An organization may always manually review, unpublish, or reject any update regardless of how it was published.

10. Children's privacy

Update is not directed at children, and we do not knowingly collect personal data from children under the age required by applicable law to consent to data processing on their own behalf (13 in many jurisdictions; higher in some EU member states, and under Nigeria's framework). If you believe a child has provided us personal data, contact us and we will delete it.

11. Cookies

Our website and portals use a limited set of cookies/local storage for sign-in sessions and essential site function. See the full Cookie Policy for details and how to control them.

12. If you're an organization, not a reader

If you sign up an organization, we also process your organization's staff accounts, API keys, and branding settings as necessary to operate your account. As a data controller for the content posted into your events, you have your own obligations under GDPR/NDPR toward your contributors — this platform gives you the tools (moderation, retention settings, block/removal) to meet them, but the underlying legal responsibility for how you use those tools is yours.

13. Changes to this policy

We'll update this page when our practices change, and update the "last updated" date at the top. Material changes will be highlighted in the app or by email where we have one on file.

14. Contact & complaints