One standard for everybody
The business is Nigerian and the customers are not. Rather than offering a different privacy posture depending on where somebody happens to live, we set one standard at the highest of the regimes and apply it to everybody.
The law that actually binds us is the Nigeria Data Protection Act 2023, which is closely modelled on the GDPR. That makes the rest of this coherent rather than contradictory.
This policy is written by [ENTITY NAME], a company to be incorporated in Nigeria. That placeholder is unfilled because the company is not yet incorporated, and inventing a registration number would be worse than showing the gap.
Who is responsible for what
Two different relationships run through this service, and conflating them is how privacy policies become unreadable.
- Your account. We decide why and how your email address, name and sign-in records are used, so we are the controller for those. This policy is our account of that.
- Your organization's content. Your organization decides what goes into its Concepts and who may see them. It is the controller; we process on its instructions. If you are a member of somebody else's organization and want something in its Concepts changed or removed, ask them first, because they decide and we act on it.
A Data Processing Addendum covering the second relationship formally is being written, and is listed on the legal index as coming before general availability.
What we hold
Three categories, held for different reasons, kept for different lengths of time, and answering differently when you ask us to delete them.
Account data
You can delete it
- What it is
- Your email address, your display name, the organizations you belong to, your role in each, and the sign-in records that keep the account secure.
- Why we hold it
- To let you in, to reach you about the account, and to work out what you are allowed to do.
- How long
- While the account is live.
- If you ask us to delete it
- Deleted within 30 days of you closing the account.
Content
You can delete it
- What it is
- Documents, Drafts, Proposals, comments, attachments, tags, properties, and the Concepts that hold them.
- Why we hold it
- It is the service. We store it so you and the people you authorised can read and change it.
- How long
- While you keep it. Deleting it in the product deletes it here, save for backups that expire on their own cycle within 35 days.
- If you ask us to delete it
- Deleted on request, or on closure after the 30 day export window.
The audit log
Cannot be erased
- What it is
- Who did what, and when. Who wrote, who approved, who published, who changed a setting, who was given or refused access.
- Why we hold it
- So an organization can answer how something happened. Accountability that can be edited afterwards is not accountability.
- How long
- For the life of the organization, and then 7 years, unless the law requires longer.
- If you ask us to delete it
- It stays. The record of an action that happened is not ours alone to erase, and the architecture will not perform it.
Alongside those, we keep ordinary operational records: server logs holding IP addresses and request paths, kept 30 days for troubleshooting and abuse investigation, and error reports that may incidentally contain a document identifier but not its text.
We do not hold payment details, because nothing costs money. We do not hold a phone number, a date of birth, or a physical address, because the service has never needed one.
The record that does not forget
Every meaningful action inside a Concept is written to an audit log: who wrote, who approved, who published, who changed a setting. That log is immutable by design. Nothing in the product edits it or removes an entry from it, and there is no administrator who can.
This is the part of a privacy policy where it is easy to write something reassuring and untrue, so here is the actual position.
- If you close your account, we delete your account data and your organization's content on the schedule in section 13. The audit log entries recording actions you took are not deleted.
- Those entries name the person who acted. That is the entire point of them: a record saying an anonymous someone approved a document is not a record of accountability, it is a record of nothing.
- The people who can read those entries are the members of the organization the actions happened in. They were able to see them while you were a member, and closing your account does not change what they already saw.
What we can do, and will: where you ask, and where the law permits it, we will replace your display name and email address in log entries with a stable pseudonymous reference, so the record of what happened stays intact while the identifier attached to it stops being your name. We will tell you where we cannot, and why. Where a supervisory authority or a court directs otherwise, we will follow that.
Counts, never names
As an owner you see how many people rated, followed or adapted your Concept. You never see who. That asymmetry is not an oversight in the reporting, it is a privacy decision, and it is the same everywhere in the product.
What an owner sees
- Average rating
- 4.6from 38 people
- Followers
- 212
- Adaptations
- 12
What nobody is ever shown
- Who gave which ratingnot shown
- Who follows itnot shown
- Who adapted itnot shown
- Who read itnot shown
Nobody is handed a list of the people paying attention to them, and nobody has to think about being watched back before deciding to follow something. Reading a public Concept needs no account at all, so for most readers there is nothing to attach to a name in the first place.
Two consequences worth knowing. A follow goes dormant rather than being deleted if what you follow stops being public, and comes back on its own if it is published again. A rating stays: it is a record of a judgement a real person made after reading something, and unpublishing does not unhappen that.
Public Concepts are genuinely public
If you make a Concept public, anyone with its address can read what is on the trunk without an account and without belonging to your organization. That is what publishing is for, and it is worth being blunt about what it entails.
- Search engines can index it. Archiving services can keep it, on infrastructure we do not control and cannot withdraw.
- Your display name appears against the writing you published in it, because a reviewed record with anonymous authors would not be worth much.
- Only the trunk is public. Drafts stay private, including the ones that never became anything.
- You can make it private again, and the door closes when you close it. What was read while it was public has been read, and third party archives are beyond our reach.
Do not publish personal data about other people in a public Concept unless you have a lawful basis for doing so. The Acceptable Use Policy covers this, and it is the clause most often broken by accident.
Attachments and where files live
Files you attach travel directly between your browser and object storage rather than through our servers, which is why a Concept full of images behaves like one of plain text. The practical privacy consequence is that our storage provider, named in section 10, holds those files.
Attachments inherit the access rules of the Concept they belong to. A file added on a Draft is not visible to anybody else until the Draft carrying it is published, and a file removed on a Draft is really gone only when that Draft is published, because a Draft that is abandoned must not take everybody else's file with it.
Email we send you
Email is transactional only: verification codes, password and sign-in notices, notifications you turned on, and messages about the account itself such as a change to these documents.
We do not run a marketing sequence off your sign-up, and we do not add you to a list you did not ask for. Notification emails can be turned off in settings. Account and security emails cannot, because an account you cannot be warned about is worse than an inbox with three more messages in it.
Who else touches your data
Three companies process data on our behalf. We name the hosting provider rather than withholding it: an address lookup answers the question in seconds, so concealing it buys nothing and costs the credibility of everything else here.
- PartyWhat it handlesWhere
Cloudflare
DNS, content delivery, TLS, and the object storage that holds attachments.
Global edge network
Resend
Transactional email only: verification codes, notifications you asked for, and account notices.
United States
Google Cloud
Server hosting and the database.
[REGION NOT YET FIXED]
The Google Cloud region is genuinely not settled yet, so it is left visibly unfilled rather than guessed at. That single fact decides whether content sits in the EU, the US or elsewhere, and it drives the whole of section 11, which is why inventing it would be the worst possible placeholder to fake.
Each of these is bound by a written agreement limiting them to what we instruct. A standing list, with a way to subscribe to changes, is being published as its own page before general availability.
Where in the world it sits
Data is transferred internationally. Our transactional email provider operates from the United States, and our content delivery provider operates a global network, so a request from Lagos and a request from Manchester are answered from different places.
The primary storage region is [REGION NOT YET FIXED]. Once it is chosen this section will name it and state the transfer mechanism relied on, which will be standard contractual clauses or an adequacy finding, depending where it lands.
Whether a Nigerian controller targeting UK and EU customers needs a representative in those territories under Article 27 is an open legal question, flagged here rather than answered, and it is one of the things counsel is reviewing before this document stops being a draft.
Your rights, extended to everyone
These are extended to everybody who uses Takeida, wherever they live, as a commitment under this policy rather than as a claim about which statute binds us.
Access
Ask what we hold about you and get a copy. For content, export already does this and is faster than asking us.
Correction
Fix anything inaccurate. Most of it you can edit yourself; write to us for the rest.
Deletion
Have your account and content deleted. Section 4 sets out the one category this does not reach, and why.
Portability
Take it elsewhere in a usable format. Export writes ordinary Markdown that other tools already read, not an archive only we can open.
Objection
Object to processing based on our legitimate interests. We will stop unless we have grounds that override yours, and we will tell you which.
Restriction
Have processing paused while a dispute about accuracy or lawfulness is worked out.
Withdrawing consent
Where we relied on consent, withdraw it at any time, without that affecting what was lawful before you did.
Complaining
Complain to us first if you want, and to your data protection authority whether or not you did. In Nigeria that is the Nigeria Data Protection Commission.
To exercise any of them, write to privacy@takeida.com. We respond within 30 days and we do not charge for it. We will ask you to confirm you are who you say you are, using the account you are asking about, because handing somebody else's data to a confident stranger would be the more obvious failure.
If the content is in an organization you belong to but do not control, we will pass your request to the organization that does, and tell you we have.
How long we keep things
Summarising what the sections above say, in one place.
- Account data: while the account is live, then deleted within 30 days of closure.
- Content: while you keep it. After closure it stays exportable for 30 days, then is deleted. Backups holding it expire within 35 days of that.
- Audit log: for the life of the organization, then 7 years, unless the law requires longer.
- Server logs: 30 days.
- Support correspondence: 2 years, so we can see the history of a recurring problem.
How it is protected
Traffic is encrypted in transit with TLS. Data is encrypted at rest. Access to production systems is limited to the people who need it, requires multi-factor authentication, and is itself logged.
Inside the product, access is decided by role, per organization and per Concept, and is checked on every request rather than once at sign-in, so access withdrawn takes effect immediately.
If a breach affects your personal data and is likely to result in a risk to you, we will tell you and the relevant authority without undue delay, and within 72 hours of becoming aware where that applies. We will say what happened, what it affected and what we did, rather than issuing a paragraph about how seriously we take security.
To report a vulnerability, write to security@takeida.com. We reply to every report, including the ones that turn out to be nothing.
Children
The service is not for children. You need to be old enough to enter a contract where you live, and in any event at least 16, or 13 with the consent of a parent or guardian where local law allows that and requires it.
We do not knowingly collect data from a child below those ages. If you believe a child has an account, write to privacy@takeida.com and we will remove it.
Changes to this policy
When this policy changes we post the new version here with a new version number and effective date. For a change that materially affects how we handle your data, we give at least 30 days' notice by email before it takes effect.
Two changes would require more than notice, and would ask rather than tell: introducing advertising or third party tracking, and using content to train a model. We have no plan to do either. If that ever changes, it will be opt-in.
Asking us something
Privacy questions and rights requests go to privacy@takeida.com. Security reports go to security@takeida.com. Anything else is on the contact page.
A data protection officer will be named here once the company is incorporated, together with the registered address at [REGISTERED ADDRESS]. You can complain to the Nigeria Data Protection Commission, and to the supervisory authority where you live, whether or not you raised it with us first.