Privacy Policy

1 Overview

This Privacy Policy ("Policy") describes how FamilyTree Nigeria Ltd ("FamilyTree", "we", "us", or "our") collects, processes, and protects personal information you provide when using the FamilyTree platform, including our website at familytreeapp.com.ng, our web application, and any associated mobile applications (collectively, the "Service").

By creating an account or using the Service, you acknowledge that you have read and understood this Policy and agree to the collection and use of your information as described herein. If you do not agree, please discontinue use of the Service.

2 Who We Are

FamilyTree is a product of FamilyTree Nigeria Ltd, a technology company incorporated and operating under the laws of the Federal Republic of Nigeria. We are the data controller for all personal data processed through the Service.

For any privacy-related questions or requests, you may contact our Data Protection Officer (DPO) using the details provided in Section 14 of this Policy.

3 Data We Collect

We collect information in the following categories:

3.1 Account Information

When you register for an account, we collect:

• Full name
• Email address
• Password (stored in hashed, non-reversible form — we never store plaintext passwords)
• Profile photo (optional)
• Country and timezone

3.2 Family Tree Content

The core of our Service involves you voluntarily entering family information. This may include names, dates of birth, dates of death, places, relationships, photos, documents, and personal stories relating to you and other individuals. This data is entered entirely at your discretion.

3.3 AI Conversation Data

When you interact with our AI assistant, the content of those conversations is processed to extract structured family data and build your family tree. Conversation logs are retained for a limited period to enable you to review your history and to improve the accuracy of our AI systems.

3.4 Payment Information

If you subscribe to a paid plan, payment is processed by our third-party payment processors (such as Paystack or Flutterwave). We do not store your card number, CVV, or full payment credentials on our servers. We only retain your subscription status, plan type, and payment reference for billing records.

3.5 Usage and Technical Data

We automatically collect certain technical information when you use the Service, including:

• IP address (used for security and fraud detection)
• Browser type and version
• Device type and operating system
• Pages visited and features used (via analytics)
• Date and time of access
• Referring URL

3.6 Communications

If you contact our support team or subscribe to our newsletter, we retain the content of your messages and your email address in order to respond to you and improve our service.

4 How We Use Your Data

We use the data we collect for the following purposes:

• To create and manage your account and provide you access to the Service
• To power our AI assistant and build your family tree from your conversations
• To process payments and manage your subscription
• To send transactional emails (e.g., account confirmation, password reset, billing receipts)
• To send marketing and product updates — only if you have opted in
• To detect, investigate, and prevent fraudulent or unauthorised activity
• To analyse aggregate, anonymised usage patterns and improve the Service
• To comply with applicable legal obligations
• To respond to your support enquiries

5 Legal Basis for Processing

We process your personal data only where we have a valid legal basis to do so. Depending on the context, the applicable legal bases include:

• Contractual necessity — processing required to deliver the Service you signed up for (e.g., creating your account, building your family tree)
• Legitimate interests — where processing is necessary for our reasonable business interests, such as fraud prevention and product improvement, and does not override your rights
• Consent — for optional activities such as marketing emails or optional cookies, where you have given clear, specific consent that you can withdraw at any time
• Legal obligation — where we are required by applicable Nigerian law or court order to process or disclose data

6 Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We may share data only in the following limited circumstances:

6.1 Service Providers (Processors)

We work with trusted third-party companies that help us operate the Service. These processors may access your data only as necessary to perform their contracted functions and are bound by confidentiality and data protection obligations. These include:

• Cloud hosting providers (e.g., server infrastructure)
• Payment processors (e.g., Paystack, Flutterwave)
• Email delivery services (e.g., for transactional emails)
• Analytics providers (using anonymised or aggregated data where possible)
• AI model providers — conversation data may be processed by our AI infrastructure partner(s) under strict data processing agreements

6.2 Family Sharing Features

When you use the family sharing or collaboration features, you choose which data is visible to invited family members. You are responsible for the information you choose to share within the platform. FamilyTree does not independently share your tree with other users without your explicit action.

6.3 Legal Requirements

We may disclose your information where required by applicable law, regulation, legal process, or enforceable governmental request in Nigeria. We will notify you of such requests where legally permitted to do so.

6.4 Business Transfers

In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the successor entity. You will be notified in advance and your rights under this Policy will be preserved.

7 Data Storage & Security

Your data is stored on secure servers. We implement industry-standard technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These measures include, but are not limited to:

• Encryption of data in transit using TLS (HTTPS)
• Encryption of sensitive data at rest
• Hashed and salted storage of passwords
• Role-based access controls limiting internal staff access to personal data
• Regular security reviews and monitoring

While we strive to use commercially reasonable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we will promptly notify affected users and relevant authorities of any data breach as required by law.

8 Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with the Service. Specifically:

• Account data is retained for the duration of your account plus a reasonable wind-down period following deletion
• Family tree content is deleted within 30 days of a verified account deletion request
• AI conversation logs are retained for up to 12 months to support accuracy improvements, after which they are anonymised or deleted
• Billing records are retained for up to 7 years to comply with financial and tax regulations
• Anonymised, aggregate analytics data may be retained indefinitely

9 Your Rights

You have the following rights regarding your personal data. To exercise any of these rights, please contact us using the details in Section 14.

• Right of Access — You may request a copy of the personal data we hold about you.
• Right to Rectification — You may request that we correct inaccurate or incomplete data.
• Right to Erasure — You may request deletion of your personal data, subject to legal retention requirements.
• Right to Restriction — You may request that we restrict processing of your data in certain circumstances.
• Right to Portability — You may request a machine-readable export of your data (including your family tree in GEDCOM format).
• Right to Object — You may object to processing based on our legitimate interests or for direct marketing at any time.
• Right to Withdraw Consent — Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

We will respond to verified requests within 30 days. We may need to verify your identity before fulfilling a request.

10 Cookies & Tracking Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, and analyse usage. The types of cookies we use are:

• Essential cookies — required for the Service to function (e.g., authentication session cookies). These cannot be disabled.
• Preference cookies — remember your settings and preferences across visits.
• Analytics cookies — help us understand how users interact with the Service so we can improve it. These use anonymised or aggregated data where possible.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies will not affect your core use of the Service. We do not use advertising or tracking cookies for cross-site behavioural profiling.

11 Children's Privacy

The Service is intended for users aged 13 years and above. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately and we will take steps to delete that information.

Users under 18 should use the Service with the knowledge and consent of a parent or guardian. Family tree data about minors entered by an account holder is the responsibility of that account holder.

12 Third-Party Links & Services

The Service may contain links to external websites or integrations with third-party services (such as DNA testing providers). Once you leave the FamilyTree platform, this Privacy Policy no longer applies. We encourage you to review the privacy policies of any third-party services you visit or use. We are not responsible for the privacy practices or content of third-party sites.

13 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you by email (at the address associated with your account) and/or by posting a prominent notice on the Service at least 14 days before the changes take effect.

Your continued use of the Service after the effective date of any updated Policy constitutes your acceptance of the changes. The "Last updated" date at the top of this page always reflects the most current version.

14 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact our Data Protection team: