Privacy Policy

ChuksForge AI Solutions Ltd(hereinafter “ChuksForge”, “we”, “us”, or “our”) is a formally registered technology company incorporated under the laws of the Federal Republic of Nigeria (RC No. 9523804). We provide artificial intelligence systems engineering, software development, automation systems, data analytics, and technology consulting services to clients locally and internationally.

Our principal place of business is in Nigeria. We operate the website at https://chuksforge.com, a client portal for project briefs and proposals, and various software products and APIs, most notably the BOS (Business Operating System) app, a business management product for Nigerian micro, small, and medium enterprises (MSMEs). BOS is available as a web app at https://app.bosafora.com and, when released, as mobile apps.

For the purposes of the Nigeria Data Protection Act 2023 (NDPA), ChuksForge AI Solutions Ltd is the data controller for personal data processed in connection with its own operations. For BOS, that includes your account and sign-in data, subscription and payment records, security and service-performance data, referral and agent data, and the operation of our website and client portal.

For the business records a BOS subscriber enters (sales, expenses, stock, debts, and the names and phone numbers of that business's own customers, staff and suppliers), the BOS subscriber is the data controller and ChuksForge acts as a data processor, handling that data on the subscriber's instructions. Section 11 explains what this means in practice. The same is true where we operate software on behalf of any other business client.

This Privacy Policy applies to all personal data collected, processed, or stored by ChuksForge across the following surfaces:

• Our website: chuksforge.com and any subdomains
• Our client portal: the authenticated area of our website where prospective and active clients submit project briefs, and view proposals and documents we share with them
• BOS (Business Operating System): the BOS web app (app.bosafora.com), the BOS mobile apps, the in-app chat, voice notes, generated documents, reports, notifications, and the BOS web dashboard, together with the servers behind them (api.bosafora.com)
• One-time login codes: sent by SMS and, if SMS fails, by a WhatsApp authentication message (see Section 6). BOS previously also operated as a WhatsApp chatbot; that service is being discontinued and Section 6 explains how historic WhatsApp data is treated
• Client-facing SaaS products: any other products we operate or white-label for clients
• APIs and integrations: REST APIs, webhook endpoints, background processing services, and third-party integrations we operate or maintain
• Client engagements: data shared with us during consulting, assessment, and project delivery
• Communications: email, contact forms, and any other direct communication channel

Where ChuksForge acts as a data processor for a business client, that client's privacy notices govern their own customers' and staff members' data. This policy governs data for which ChuksForge is the data controller, and describes how we process data as a processor.

ChuksForge processes personal data in compliance with the following regulatory instruments:

• Nigeria Data Protection Act (NDPA) 2023: the primary statute governing data protection in Nigeria, signed into law on 12 June 2023
• NDPC General Application and Implementation Directive (GAID) 2025: the operational directive issued by the Nigeria Data Protection Commission, in force since 19 September 2025. It replaced the Nigeria Data Protection Regulation (NDPR) 2019 and its Implementation Framework as the operative regulatory instrument; things done under the NDPR before then remain valid
• Meta WhatsApp Business Policy and Meta Platform Terms: applicable to the WhatsApp authentication messages BOS sends through the WhatsApp Business Cloud API

Registration, Data Protection Officer and audits

Because BOS processes the personal data of a large number of people, we treat ChuksForge as a data controller and data processor of major importance under the NDPA and the GAID. We therefore hold ourselves to the duties that come with that status: registration with the NDPC, a designated Data Protection Officer, data protection impact assessments for higher-risk processing (such as the financing eligibility check described in Section 9), and an annual compliance audit.

Data subjects may contact us at hello@chuksforge.com regarding privacy concerns or to exercise their rights under applicable data protection law. See Section 25.

We collect personal data only when there is a lawful basis and a genuine operational need. The categories of data we collect depend on how you interact with us:

Via our website contact form

• Full name, email address, company or organisation name
• Nature of your enquiry and project description
• IP address and browser metadata collected automatically by our hosting infrastructure

Purpose: to respond to your enquiry, assess fit, and initiate an engagement where appropriate.

Via our client portal

• Account identity and email address, managed through our authentication provider
• Project brief details you submit: project type, problem description, current technical context, budget range, timeline, and success criteria
• Proposals and documents we share with you, and your access history for those documents

Purpose: to scope, propose, and deliver engagements, and to give you a persistent place to track them.

Via client engagement and onboarding

• Contact details of individuals at client organisations (name, email, phone, role)
• Business information, project briefs, and technical specifications shared during scoping
• Payment and invoicing information processed through third-party payment providers; we do not store full payment card data
• Signed agreements and correspondence

Purpose: to deliver contracted services, manage the engagement, and comply with legal and financial obligations.

Via BOS sign-up and sign-in

• Your mobile phone number, which is your BOS login
• One-time login codes: we store only a one-way hash of each code, it expires after five minutes, and repeated wrong attempts are blocked
• Business name, business type or category, and operating location(s)
• Branch names where a business registers more than one location
• Referral or agent code used at sign-up, where applicable
• Preferred language for system responses: English, Yoruba, Hausa, or Igbo
• Subscription tier and plan selection
• Session records that keep you signed in, and the tokens that identify a signed-in device (see Section 21)

Purpose: to create and secure a BOS account, keep you signed in, and personalise the service for your business.

Automatically collected technical data

• Server access logs including IP addresses, request timestamps, and response codes
• Error logs, crash reports and performance telemetry from systems we operate, sent to our error-monitoring provider
• Rate-limiting counters tied to IP address or phone number, which expire after about an hour
• Security audit records for sign-ins, sensitive account actions and data changes, which can include an IP address

Purpose: system maintenance, abuse and fraud prevention, security monitoring, and performance optimisation. This data is not used for marketing profiling.

BOS lets a business record sales, expenses, stock and debts, produce receipts and invoices, see reports and insights, and manage branches and staff, whether by typing, by tapping through forms, or by talking to the BOS chat. This section describes what BOS stores when you do.

Business records you create

• Sales, expenses, payments received and other transactions, with dates, amounts, item names, quantities, prices and notes
• Inventory items, quantities, cost and selling prices, and low-stock thresholds
• Customers and debtors: names, phone numbers if you add them, and what they owe or have paid (see Section 11)
• Receipts, invoices and device receipts you generate, including any customer details and, for device receipts, the device model, IMEI and serial number
• Accounts you set up to track cash, bank or mobile-money balances. These are figures you enter: BOS does not connect to your bank and never asks for banking credentials
• Reminders you set for yourself, and your business profile, logo and preferences
• Data imported from spreadsheets you upload

Records are stored on your behalf and are accessible to you in the app. Older transactions (after about a year) may be moved to an archive within our database; they remain part of your account and are included when you export or delete your data.

Chat history

The BOS chat keeps a history so you can scroll back. It contains your typed messages, the transcripts of your voice notes, BOS's replies, notifications sent to you, and links to files BOS generated. It is stored against your account for as long as the account is active and is included in your data export and removed when you delete your account (Section 20). It is not used for advertising.

Files BOS creates

Receipts, invoices, device receipts, spreadsheet exports and your logo are stored in our cloud file storage. Files are private: you open them through time-limited links, and BOS renews the link when you open an older message. A file leaves your account only when you share it yourself.

Branches and staff

• Where a business registers more than one location, BOS stores branch names and tags each record with its branch. In the app, reports, briefings and summaries show the branch you are currently working in
• Staff members can be linked to a business by its owner. We store the staff member’s phone number, role and branch, and BOS attributes records to the person who entered them
• A staff member’s own sign-in details are handled as their own account data; the records they enter belong to the business

Notifications

BOS sends in-app notifications and, if you allow them, push notifications: morning and daily briefings, weekly reports, stock alerts, reminders you set, and payment or subscription notices. To do this we store a push registration for each device or browser (a device token or a browser subscription). Depending on your device settings, a notification can show business figures on your lock screen; you can turn notifications off in the app, browser or device settings at any time.

How this data is used

• Content is processed to do what you ask: record a transaction, update stock, produce a report, answer a question
• It is used to compute the reports and insights you see (Section 12)
• It is not used for advertising or behavioural profiling, and it is not shared beyond the providers needed to run the service (Section 16) and the consent-based sharing described in Section 9

What WhatsApp is used for now

BOS was originally a WhatsApp chatbot. WhatsApp messaging is being discontinued as a way to use BOS. The only remaining use of WhatsApp is to deliver a one-time login code as a Meta “authentication” message when you request one and the SMS did not arrive. To do this, your phone number and the code are passed to Meta Platforms, Inc. through the WhatsApp Business Cloud API. We do not use WhatsApp for marketing. Meta's handling of WhatsApp data is governed by its own privacy policy, and we operate in line with the WhatsApp Business Policy and Meta Platform Terms.

SMS

Login codes are sent first by SMS. Our SMS provider receives your phone number and the text of the message (which contains the code) in order to deliver it.

Data from the WhatsApp era

Records that were created through WhatsApp (transactions, customers, inventory, summaries and the message text and voice transcripts they came from) form part of your BOS account. They are kept, exported and deleted on the same terms as records created in the app (Sections 17 and 20). Voice notes that were sent over WhatsApp were retrieved from WhatsApp's servers, transcribed and not stored as audio, as described in Section 7.

Opting out

We send WhatsApp and SMS messages only when you request a login code. If you do not want to receive them, do not request one. To close your account or ask us to delete your data, see Section 20.

BOS accepts voice notes as an input method for people who prefer speaking over typing. In the app this uses your device's microphone, which BOS asks your permission to use; you can withdraw that permission in your device or browser settings at any time.

What happens when you send a voice note

• The recording is uploaded to our servers and sent to a third-party speech-to-text service (currently OpenAI) to be turned into text
• To make names and products come out right, the request includes vocabulary hints drawn from your own records, such as your item names and your customers’ names. This means the names of your customers can reach the transcription provider even if you did not say them
• The transcript is then processed by our AI-assisted parsing layer to extract the business information you meant to record
• We do not store the audio. It is held only for the duration of the transcription request and then discarded. The transcript and the records it produced are kept, and the transcript appears in your chat history

Audio data and third-party processing

The transcription provider processes audio under terms that prohibit using it to train its models by default. It may retain submitted data for a limited period for abuse and safety monitoring under its own terms. See Section 16 for our sub-processor arrangements.

BOS operates a referral and agent programme that enables existing users and enrolled agents to introduce new businesses to the platform and earn commissions on successful referrals.

Referral codes and peer sharing

• Each registered BOS business account is assigned a unique referral code
• When a new user registers using an existing user's referral code, a referral relationship is recorded in our system
• The linking of referrer and referee accounts is used solely for commission calculation purposes; no personal data is shared between the two parties

Agent accounts

• Agents enrolled in the BOS agent programme are assigned a unique agent identifier
• Agent accounts store: agent name, phone number, bank account details where provided for commission payouts, and a record of businesses onboarded under the agent's code
• The agent’s bank account number is stored encrypted, with only the last four digits and the account name visible to us in ordinary operation
• To pay commissions, the bank details are passed to our payment provider (Paystack), which creates a transfer recipient and moves the money

Commission records

Commission calculation records, including amounts, dates, and associated account identifiers, are retained for 7 years from the date of the relevant transaction, consistent with Nigerian financial record-keeping requirements.

BOS can tell you when your records suggest you may be a good fit for financing, and can suggest suppliers when stock runs low. Both are optional, and neither shares your data unless you choose it.

Financing check

• BOS compares your own records against simple criteria (a steady revenue history, low outstanding debt, or a tight cash runway) and shows you the result. This is calculated by BOS from your records and is indicative only
• Only the account owner can start or confirm a financing check; staff accounts cannot
• Before anything is shared you are shown exactly what would be shared: your business name and phone number, the summary figures on screen (not your raw transaction history), and your BOS subscription tier, and who would receive it
• Nothing is shared unless you reply “yes share my info” within five minutes. If you do not, nothing happens
• When you agree, we record your consent: what was shared, with whom, why the check was triggered, and when

The financing partner then contacts you or gives you a link to continue. The partner, not BOS, decides whether to offer or approve anything, and any loan is between you and the partner. From the moment the partner receives your details it handles them under its own privacy policy. We cannot recall data once shared, but if you tell us you no longer want to be contacted, we will pass that on to the partner. We name the partner to you at the time of each check.

Supplier suggestions

When an item runs low, BOS may suggest a supplier. Some suppliers have a commercial relationship with ChuksForge. We do not give a supplier your details: if you ask for a contact, BOS shows you how to reach them and you decide whether to get in touch. We record that you asked, so we can tell whether the feature is useful.

Payment processing

• All subscription payments are processed by regulated third-party Nigerian payment service providers (currently Paystack and Flutterwave)
• ChuksForge does not store, transmit, or have access to full payment card numbers, bank login credentials, or BVN data
• We receive and store only a payment reference, transaction status, amount, and timestamp from the payment provider
• Subscription status is stored in our database and linked to the relevant business account

Business financial data entered by users

Sales figures, revenue data, stock values, balances and expense amounts entered into BOS by a business owner are that business's own commercial data. This data is stored on the business owner's behalf and is not accessed by ChuksForge staff except for authorised technical support with the account owner's explicit consent, system maintenance, security investigation, or as required by law.

A BOS business inevitably records information about other people: its customers and debtors, its staff, and its suppliers. This section explains who is responsible for that data.

• You are the controller of it. The business that enters a customer's name, phone number or debt decides why and how it is used. We process it on your instructions, to run BOS for you.
• You need a lawful reason to record it and, where the law requires, to tell the people concerned what you hold and why. Your BOS subscription terms say the same.
• We do not contact your customers unless you ask us to. Where BOS helps you write a receipt, invoice or payment reminder, you send it yourself.
• If you are a customer or staff member of a BOS business and want to see, correct or delete what that business holds about you, ask the business first. If you write to us, we will pass your request to the business and help it respond.
• Staff. The account owner can see records attributed to their staff and can unlink a staff member at any time. Staff sign in with their own phone number.
• Where third-party names go. Names of your customers can be sent to our AI and speech-to-text providers when they are needed to understand or transcribe a request (Sections 7 and 12), and appear on receipts and invoices you generate.

ChuksForge develops and operates APIs and software systems as standalone products and as components of client-commissioned systems. BOS uses AI-assisted processing to interpret what you type or say and convert it into structured business records, and uses our own software to produce reports and insights from those records.

AI processing

• Your message text, including voice note transcripts, is sent to a third-party AI language model provider (currently OpenAI) to identify what you want and extract the details
• The provider may also receive the short pieces of context needed to answer correctly (for example the names of customers or items you mention, or the conversation just before) and the text of short messages BOS drafts for you, such as a thank-you note. We do not send your full ledger
• AI processing occurs in real time; request and response logs may be retained briefly on our side for debugging before deletion
• Data submitted to our AI providers is processed under terms that prohibit using it to train their models without explicit opt-in. Providers may retain it for a limited period for abuse and safety monitoring under their own terms
• AI-assisted parsing does not make decisions with legal or similarly significant effects on you; it produces structured records that you can review and correct

Insights BOS computes from your records

• Reports and briefings: balances, weekly summaries, top items, item profit, end-of-day recaps, and morning and daily briefings
• Predictions and scores: restock predictions, a business health score, a cash-flow forecast, and customer patterns such as slow payers or customers who have stopped buying
• A financing eligibility check (Section 9)

These are produced by our own software from your records and shown to you. They are aids to your own judgement, not decisions about you. The financing check only ever leads to an offer to share your details with your consent.

Background processing

• Certain platform functions, including scheduled notifications, report generation, and document processing, are handled by background processing services
• Data within these services is processed transiently and is not retained beyond what is required to complete the task

Other software products

ChuksForge operates additional software products including data extraction pipelines, observability platforms, and client-commissioned automation systems. Data handling in these products is described in product-specific agreements with the relevant client organisations.

Some BOS users first found us through Meta (Facebook and Instagram) ads that opened a WhatsApp conversation. For those users only, we store the advertising click identifier Meta attaches to that click, and we report two events back to Meta so that we can measure whether the ads worked: that the user recorded their first transaction, and that they paid for a subscription tier (with the amount, in naira). These reports contain the click identifier, the event and the amount. They do not contain your name, phone number, business records or messages.

This applies only to people who arrived through such ads. It is our only sharing of data with an advertising platform, and we expect it to stop when WhatsApp messaging ends. Nothing in BOS is used for behavioural advertising, and we do not use any advertising or analytics trackers in the app.

Under the Nigeria Data Protection Act 2023, we process personal data on one or more of the following lawful grounds:

• Consent: where you have given free, specific, informed, and unambiguous consent, such as agreeing to share your details with a financing partner, allowing push notifications or microphone access, or opting into optional communications. Consent may be withdrawn at any time.
• Contractual necessity: processing is required to perform a contract with you or your organisation, or to take steps at your request before entering into a contract. This is the primary basis for BOS and client portal service delivery.
• Legal obligation: processing is required for compliance with applicable Nigerian law, including financial, tax, and regulatory obligations.
• Legitimate interests: processing is necessary for our legitimate business interests, such as maintaining system security, detecting fraud and abuse, improving our services, and measuring our advertising, provided these interests are not overridden by your rights and freedoms.

We do not process special categories of sensitive personal data as defined under the NDPA (such as health data, biometric data, or data revealing ethnic or religious identity) in the course of our standard services. The multilingual capability of BOS (Yoruba, Hausa, Igbo, English) does not constitute processing of ethnicity data; language preference is stored solely as a user interface setting. Where a business records information about its own customers or staff, the business is responsible for its own lawful basis (Section 11).

We use personal data for the following purposes, each tied to a lawful basis described in Section 14:

• Responding to enquiries and conducting business development activities
• Delivering contracted services, including BOS operation, client portal access, software development, consulting, and managed services
• Signing you in and keeping your account secure, including sending one-time login codes
• Interpreting your messages to create structured business records on your behalf
• Transcribing voice notes and processing the resulting text to extract business information
• Processing spreadsheets you upload for bulk imports and producing exports, receipts and invoices
• Sending in-app and push notifications, such as briefings, weekly reports, stock alerts, reminders you set, and subscription notices
• Producing reports and insights for you, including branch-level reports for businesses with several branches
• Sharing your details with a financing partner where, and only where, you agree (Section 9)
• Calculating and recording referral commissions and paying agents
• Processing subscription payments and maintaining subscription status records
• Operating, maintaining, and improving our software products
• Sending service-related communications, including project updates, proposals, invoices, and support responses
• Complying with legal, regulatory, and financial obligations under Nigerian law
• Detecting, preventing, and responding to security threats, fraud or misuse of our systems
• Generating anonymised or aggregated analytics to improve platform performance
• Measuring the results of our own advertising, as described in Section 13

We use these purposes to guide, not exhaust, how we process data, but we do not use personal data for unsolicited marketing, behavioural advertising, or sale to third parties. Beyond that, we commit specifically that we do not:

• Sell your personal data.
• Share your personal data with third parties for their own marketing or advertising. (The only signal we send to an advertising platform is the one described in Section 13.)
• Contact your customers unless you ask us to do so through BOS.
• Use your content to train or fine-tune third-party AI models.

To improve our own parsing rules we may review messages that BOS misunderstood, limited to what is needed to fix the problem and handled under the same confidentiality and access controls as the rest of your data.

We engage carefully selected third-party service providers (“sub-processors”) where operationally necessary to deliver our services. Each is engaged under contractual terms designed to ensure appropriate confidentiality, security, and data protection standards consistent with applicable laws, and we limit what each receives to the minimum necessary for its role.

Our principal providers today

• OpenAI: language understanding and speech-to-text (United States)
• Meta Platforms: WhatsApp authentication messages and ad conversion events
• Termii: SMS delivery
• Paystack and Flutterwave: payments and payouts
• Supabase: database and file storage
• Railway: servers and background processing
• Vercel: web hosting
• Cloudflare: DNS, content delivery and firewall
• Expo: push notification delivery and app build services
• Sentry: error monitoring
• A log-management provider for operational logs

We update this list when providers change. A current list with locations may also be requested from hello@chuksforge.com.

Data sharing with client organisations

Where ChuksForge builds and operates systems on behalf of a business client, data generated within that system is made available to the client as the data controller.

Financing partners and other parties you choose

We share your details with a financing partner only under Section 9, and with any other third party only if you ask us to.

Legal disclosures

We may disclose personal data where required by Nigerian law, a valid court order, or a legitimate request from the Nigeria Data Protection Commission (NDPC) or other competent regulatory authority.

Business transfers

In the event of a merger, acquisition, or transfer of business assets, personal data may be transferred as part of that transaction, subject to equivalent privacy protections and notification to affected data subjects where required by the NDPA.

We do not sell, rent, or trade personal data, and we do not share data with data brokers. See Section 15 for the full list of commitments on what we don't do with your data.

We retain personal data for as long as is necessary for the purpose for which it was collected, subject to legal and contractual obligations:

• Website contact form enquiries: retained for up to 2 years from last engagement
• Client portal accounts, briefs, proposals, and documents: retained for the duration of the client relationship, then for 7 years from the conclusion of the engagement, consistent with Nigerian financial record-keeping requirements
• Client engagement records: retained for 7 years from conclusion of the engagement, consistent with Nigerian financial record-keeping requirements
• BOS business records (transactions, customers, inventory, accounts, branches, invoices, receipts, reminders, summaries): kept while your account is active and after you stop using BOS, so that you can come back, until you ask us to delete them (Section 20). Accounts that finish sign-up but record nothing may be removed automatically after a few days
• Chat history: kept while your account is active and removed when you delete your account
• Generated files (receipts, invoices, device receipts, exports, logo): kept while your account is active and removed when you delete your account. The links that open them expire and are renewed on request
• Tamper-evident activity log records: retained for the lifetime of the business account plus 7 years for financial integrity, security and compliance purposes
• Commission and payment records: retained for 7 years from the date of the relevant transaction
• Financing consent records: retained for as long as needed to evidence your consent, and no longer than 7 years
• Referral and agent linkage records: retained for the lifetime of the relevant accounts plus 7 years for commission audit purposes
• Advertising attribution records: retained for the lifetime of the account
• Login codes: stored only as a one-way hash and valid for five minutes
• Push registrations: kept until you sign out, revoke permission, or delete your account, or until the push service reports them invalid
• Voice note audio: not stored. Voice note transcripts: kept as part of your chat history and the records they created
• Message text used to create records: kept with the record it produced as an audit trail; on account deletion its personal content is removed (Section 20)
• Uploaded spreadsheets: processed to perform the import and not kept as files
• Server and API logs: retained for 30–90 days in raw form; aggregated or deleted thereafter
• Session and rate-limit data: expires automatically, typically within an hour for rate-limit counters and when a session ends or expires for sessions
• Backups: deleted data can persist in encrypted backups until they are overwritten in the normal backup cycle, and is not restored into live systems

You may request deletion of your personal data at any time. Requests will be honoured subject to overriding legal obligations. See Section 20 for how to exercise this right and exactly what deletion covers.

We implement technical and organisational measures appropriate to the sensitivity and volume of the data we process. These measures include:

• Encryption of data in transit and, where appropriate, at rest; sensitive fields such as agent bank account numbers are additionally encrypted at field level.
• Passwordless sign-in with one-time codes that are stored hashed, expire quickly and are attempt-limited; web sessions kept in HttpOnly cookies that page scripts cannot read.
• Access controls, role-based permissions, and separation between each business's records.
• Private file storage with time-limited access links.
• A web application firewall, rate limiting and abuse controls in front of our servers.
• Logging, monitoring, and security event detection, with a tamper-evident record of sensitive data changes.
• System availability and resilience measures, backup and recovery procedures.
• Ongoing review and improvement of our security practices.

While no method of transmission or storage can guarantee absolute security, we seek to maintain security measures appropriate to the risks involved. You can help by keeping your phone secure and signing out of BOS on shared devices.

In the event of a personal data breach likely to result in a risk to the rights and freedoms of individuals, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and will notify affected people without undue delay where the risk to them is high.

BOS uses artificial intelligence and automated processing tools to interpret user inputs, generate summaries, and extract structured business information, and uses rule-based software to produce scores, forecasts and eligibility checks (Section 12).

These systems are designed to assist users and do not make decisions that produce legal or similarly significant effects without human involvement. In particular, a financing eligibility result does not approve or refuse anything: it only offers to share your details, with your consent, with a partner that makes its own decision.

Users remain responsible for reviewing outputs before acting on them, and can correct any record BOS creates.

Where automated processing materially affects you, you may ask for human review, express your views, and contest the outcome by writing to us (Section 25).

We continuously review our AI-assisted systems and implement safeguards intended to promote fairness, accuracy, and reliability.

Under the Nigeria Data Protection Act 2023, you have the following rights with respect to personal data we hold about you:

• Right to be informed: you have the right to know how your data is collected, used, and shared. This policy fulfils that obligation.
• Right of access: you may request a copy of the personal data we hold about you and information about how it is processed.
• Right to rectification: you may request correction of inaccurate or incomplete personal data without undue delay.
• Right to erasure: you may request deletion of your personal data where we no longer have a lawful basis to retain it, subject to legal retention obligations.
• Right to restriction of processing: you may request that we limit processing of your data in certain circumstances, such as while accuracy is contested.
• Right to data portability: where applicable, you may request your data in a structured, machine-readable format.
• Right to object: you may object to processing based on legitimate interests where your interests, rights, or freedoms override those interests, and to processing for direct marketing.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Right not to be subject to solely automated decisions: see Section 19.
• Right to human intervention and review: where automated processing materially affects you, you may request human review, express your views, and contest the outcome.
• Right to lodge a complaint: if you believe your rights have been infringed, you may submit a complaint to the Nigeria Data Protection Commission (NDPC).

Doing it yourself in BOS

• Access and portability: Settings → Privacy & Data → Export my data, or send “export my data” in the chat. You can also export your transactions as a spreadsheet from the Export screen.
• Erasure: Settings → Delete account, or send “delete my data” in the chat and confirm. Deletion needs a confirmation step because it cannot be undone.
• Correction: edit or reverse records directly in the app, or ask BOS in the chat to correct the last entry.
• Consent you gave in the app: turn off notifications or microphone access in the app, browser or device settings; decline any financing or supplier suggestion.

What deleting your account does

When you delete your account, or ask us to, we:

• delete your transactions, customers, inventory, reminders, daily summaries and event records;
• delete your chat history, generated files and logo, notifications, push registrations, branch and account records, invoices and device receipts, and remove the personal content of the messages that created your records;
• deactivate your account and stop all notifications.

Some things are not deleted, and this is why:

• A minimal account record (your phone number and the date you asked for deletion), so that the number is not silently re-registered as though nothing happened and so that we can prove we honoured your request.
• Records we are required to keep by law or need to defend a legal claim: subscription and payment records, commission records for agents, and financing consent records, each for the periods in Section 17.
• Security and audit log entries, which record that an action happened rather than the business content of your records.
• Anonymous, aggregated statistics that cannot identify you.

Where our automated deletion tool does not reach a type of record, we remove it manually as part of the same request, and we will tell you if anything is kept and why. Deleted data can remain in encrypted backups until they are overwritten (Section 17).

By email

To exercise any right by email instead, including restriction, objection, human review or withdrawal of consent, contact us at hello@chuksforge.com with the subject line “Data Rights Request”. Please include your name, the phone number or email address on your account, and a description of your request. We aim to respond within 30 calendar days and will tell you if we need more time and why. We may need to verify your identity before acting on a request.

If you are not satisfied with our response, you may escalate your complaint to the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Our marketing website (chuksforge.com) does not use third-party analytics scripts, tracking pixels, or behavioural advertising technologies. The BOS app does not use advertising or analytics trackers either.

What the BOS web app keeps in your browser

• Sign-in cookies: when you sign in, the BOS server sets two strictly necessary, HttpOnly cookies that keep you signed in. They cannot be read by scripts on the page, and are sent only to the BOS servers. They are not used for tracking or advertising. On the mobile apps, the equivalent tokens are held in the device's secure storage.
• A “signed in” marker: a simple flag in browser storage so the app can open instantly and work offline. It holds no credentials.
• An offline queue: if you record a sale or expense with no connection, it waits on your device and is sent when you are back online. Entries that cannot be sent for a week, or that the server declines, are set aside for you to review and are never deleted without your say-so.
• A cache of recently viewed screens: so that BOS can open with a weak connection, the app stores copies of recent responses from our servers on your device. These include your business figures and chat.
• Preferences: for example which tips and banners you have already seen.

Signing out ends your session, but copies of recently viewed data and unsent offline entries can remain on the device until they are cleared, so please clear your browser data or uninstall the app when you stop using a shared or borrowed device.

Device permissions

• Microphone: only when you record a voice note.
• Photos or files: only when you choose a logo or a spreadsheet to import; BOS cannot browse your library.
• Notifications: only if you allow them.
• BOS does not ask for your location, contacts or camera roll.

Server logs

Server-side access logs, including IP address, request path, timestamp, and referrer, are retained by our hosting infrastructure for security and performance purposes, each governed by their respective privacy policies.

If we introduce analytics or additional cookies in future, we will update this policy and implement an appropriate consent mechanism consistent with the NDPA and GAID.

ChuksForge is based in Nigeria, but certain service providers that support our operations, including our AI and speech-to-text provider, Meta, our error-monitoring provider and some infrastructure providers, are located in, or process data in, other jurisdictions, including the United States and the European Union.

Where personal data is transferred outside Nigeria, we seek to implement safeguards appropriate under applicable law. Such safeguards may include contractual protections, data processing agreements, recognised security standards, and limiting the scope of data shared to what is reasonably necessary for the relevant service.

By using our services, you acknowledge that some data may be processed in jurisdictions whose privacy laws differ from those of Nigeria. We seek to ensure that such transfers are conducted in a manner consistent with the Nigeria Data Protection Act 2023 and other applicable requirements.

Additional information regarding sub-processors and their locations may be requested by contacting hello@chuksforge.com.

Our services are designed primarily for businesses and business professionals. We do not knowingly provide services to children or intentionally collect personal data from children.

If we become aware that personal data relating to a child has been collected inadvertently, we will take reasonable steps to delete or otherwise appropriately handle such information in accordance with applicable law, including the Nigeria Data Protection Act 2023 and the Child Rights Act.

We may update this Privacy Policy periodically to reflect changes in our services, legal requirements, or data practices.

When we make material changes, we will:

• Update the "Last Updated" date at the top of this page
• Where appropriate, notify active BOS or client portal account holders in the app, by SMS or by email
• Obtain fresh consent where the change introduces a new processing purpose that requires it under the NDPA

We encourage users to review this Privacy Policy periodically. Where required by law, we will obtain any necessary consent before implementing material changes involving new purposes of processing.

What changed on 21 September 2026

• BOS is now an app and web app; WhatsApp is used only for login-code messages, and this policy no longer describes WhatsApp as the way to use BOS
• Added: chat history, in-app voice notes, files BOS generates, notifications, branch-level reports, and data stored on your device
• Added: who is responsible for the data of your customers and staff (Section 11)
• Added: financing and supplier referrals, and the financing eligibility check (Section 9)
• Added: advertising measurement for users who arrived through Meta ads (Section 13)
• Added: named sub-processors, and what happens on account deletion
• Updated: the legal framework now refers to the NDPA 2023 and the NDPC GAID 2025 (the NDPR no longer applies), and corrected the description of how to exercise your rights in BOS

For questions regarding privacy, personal data, or this Privacy Policy, please contact: