Privacy Policy
Last Updated: October 17, 2026 • Effective for PAICEY LTD (RC: 9724436)
Contents & Quick Jump
1. Introduction & Scope
The Privacy Policy provided by PAICEY LTD., including our affiliates and subsidiaries (collectively, "We," "Our," "Us," or "PAICEY"; incorporated under the laws of the Federal Republic of Nigeria with Registration Number RC: 9724436), is based on our deep respect for the privacy of You, as our visitors, registered users, or subscribers (collectively, "Members," "Users," "You," or "Your"). We are unconditionally committed to the transparent, responsible handling and rigorous protection of Your personal information.
This Privacy Policy governs the manner in which We collect, use, maintain, host, transfer, and disclose information collected from Users of the PAICEY mobile application ("PAICEY App"), web application, predictive 4-segmentation Quality of Life models, 2x daily check-in protocols, and all related software, content, and subscription offerings (collectively, the "Services").
This Privacy Policy applies to personal information collected online through our Services as well as customer inquiries. It does not apply to third-party websites, applications, or social media platforms that We do not own or control, even if linked from our Services.
2. Categories of Personal Information We Collect
We collect personal information directly from You when You interact with our Services, automatically when You navigate the platform or synchronize devices, and from authorized third parties. Depending on Your interaction, We collect:
A. Account & Passwordless Identity Information
Your full name, email address, country code, selected language, and account identifiers provided through WorkOS Passwordless Identity (Email Magic Code tokens, FIDO2/WebAuthn Passkey biometric authentication hashes, Google OAuth tokens, and Time-based One-Time Password [TOTP] multi-factor authentication tokens). We never receive, store, or log plaintext passwords.
B. 4-Pillar Quality of Life (QOL) & Assessment Data
Information provided when answering assessments and completing check-ins across the four core life segments:
- Physical Pillar: Step counts, daily kinetic volume, movement duration, workout completions, perceived physical strain, and resting recovery indicators.
- Mental Pillar: Subjective focus indices, cognitive fatigue ratings, stress self-assessments, and mindfulness reflections.
- Environmental Pillar: Sleep duration, sleep hygiene indices, bedtime regularity, circadian rhythm alignment, and noise/workplace comfort evaluations.
- Social Pillar: Interpersonal engagement scores, community workout participation, accountability streaks, and shared challenge milestones.
C. 2x Daily Check-in & Habit Logs
Subjective morning readiness self-reports and evening restorative reviews captured twice daily. These timestamped inputs are mathematically weighted by our predictive kinetic model to calculate rolling 7-day and 30-day forecast curves.
D. Voluntary Member Preferences
Preferred workout times, notification delivery intervals, nutritional preferences and dietary restrictions, community visibility toggles, and audio/haptic feedback settings.
3. Usage Data, Predictive Models & Algorithmic Nudges
When You interact with our Services, our systems automatically collect technical telemetry:
- Device Telemetry: Hardware model, operating system version, browser type, unique device identifiers, preferred language, and screen resolution.
- Network & Routing Data: IP address, Internet service provider, and country origin derived via secure Bunny Edge CDN request headers (
cdn-requestcountrycode) for localized currency and server caching. - Algorithmic Behavioral Response: How You interact with personalized nudges (e.g., whether a movement reminder triggered a walk, check-in completion velocity, and nudge snooze rates). Our predictive engine uses this behavioral feedback to dynamically recalibrate nudge timing so it remains motivating without becoming intrusive.
4. Information Collected from Third-Party Sources
You may choose to connect external accounts or services to enrich Your PAICEY experience:
- Authentication Identity Providers: When You sign in using Google Sign-In, Google transmits Your verified name, email address, profile photo URL, and OAuth provider identifier under Google’s privacy policy.
- Health & Fitness Ecosystems (Apple HealthKit & Google Health Connect / Google Fit): If You grant explicit permission via Your device operating system, PAICEY imports your step counts, active energy burned, and exercise sessions. You may modify or revoke this permission at any time directly in Your iOS or Android device system settings.
5. Payment Processors & Transaction Security
Paid subscriptions and renewals on PAICEY are handled exclusively through certified, Level 1 PCI-DSS compliant financial technology partners:
- Hydrogen Pay (Hydrogen Payment Services Company Limited / Access Bank Group): Central Bank of Nigeria (CBN) licensed payment switch and Level 1 PCI-DSS compliant gateway processing Nigerian Naira (NGN) card payments, instant bank transfers, and automated recurring billing.
- Squad by HabariPay (Guaranty Trust Holding Company PLC / GTCO): CBN licensed and Level 1 PCI-DSS compliant gateway processing card payments, bank transfers, and USSD payments denominated in Nigerian Naira (NGN).
- Creem.io (Creem Technologies): Processes international cards, US Dollar transactions, and multi-currency checkouts outside Nigeria.
- Web-Only Subscription Architecture (No In-App Purchases): All subscription orders, renewals, and account creations are executed strictly on the web platform (paicey.com). The mobile applications do not support in-app registration or in-app payments, serving solely as companion clients for registered subscribers.
{uid}_{timestamp_ms}_{uuid}.
6. How We Use Your Personal Information
We process Your personal information for legitimate business purposes, including:
- Operating & Delivering the Services: To authenticate Your identity, maintain Your member profile, calculate Your 4-pillar QOL scores, and compute rolling recovery predictions.
- Algorithmic Adaptations & Nudges: Generating timely, non-invasive habit nudges, physical activity goals, and nutritional guidance customized to Your daily cadence.
- Billing & Subscription Lifecycle: Validating transactions, provisioning subscription extensions and stackable months, invoicing, preventing payment fraud, and evaluating audit logs and kinetic telemetry to verify non-usage or usage for processing legitimate full or partial refund requests under our 14-day conditional refund policy.
- Scientific Model Advancement & Research: PAICEY originated from empirical Human Kinetics undergraduate research at the University of Lagos (UNILAG) led by Laura Bolade. Aggregated, mathematically de-identified kinetic trends may be analyzed to refine biomechanical models and predictive quality-of-life forecasting curves.
- Security, Auditing & Fraud Prevention: Protecting against malicious activity, detecting unauthorized access, verifying cluster worker node health, and safeguarding platform integrity.
- Communications & Support: Responding to Your customer inquiries, sending critical security notices, and providing service update announcements.
7. How We Disclose Personal Information
PAICEY does not rent, sell, or monetize Your personal information to data brokers or third-party marketing companies. We disclose personal data only under strict contractual safeguards in the following situations:
- Infrastructure & Service Providers: Trusted enterprise vendors who process data on our behalf under confidentiality and data protection agreements, including Google Cloud Platform (European Union core backend compute & storage), Scaleway S.A.S. (European Union S3 Object Storage, encrypted document backups, and durable webhook failover queues), Bunny.net (Content Delivery Network, Magic Containers edge compute, and distributed libSQL edge database), WorkOS (Authentication & Identity Directory), and certified cloud compute providers.
- Payment Gateways: Hydrogen Pay, Squad by HabariPay (GTCO), and Creem.io to authenticate and confirm Your subscription orders.
- Community & Leaderboards (User Directed): If You opt into community streaks, leaderboard challenges, or group workouts, your chosen display name and streak count may be visible to other participating members. Your private 2x daily check-in responses and health questionnaires are never made public.
- Legal & Regulatory Compliance: When required by valid subpoenas, court orders, or applicable statutory laws in Nigeria, the United Kingdom, the European Union, or the United States, or to protect the rights, safety, and property of PAICEY, our members, or the public.
- Corporate Transactions: In the event of a merger, acquisition, reorganization, asset sale, or bankruptcy, personal information may be transferred as an acquired business asset subject to this Privacy Policy.
8. Non-Medical & Non-HIPAA Wellness Statement
PAICEY IS NOT A MEDICAL PROVIDER, CLINICAL HEALTHCARE PRACTITIONER, OR LICENSED MEDICAL DEVICE.
PAICEY is not a "covered entity" or "business associate" under the United States Health Insurance Portability and Accountability Act of 1996 (HIPAA). The 4-segmentation QOL scores, predictive trajectory curves, 2x daily check-in evaluations, and nutritional habit recommendations generated by PAICEY are developed exclusively for recreational fitness, lifestyle optimization, and behavioral wellness habit-building.
They do not constitute medical diagnoses, clinical treatment plans, prescriptions, or clinical medical advice. Never disregard professional medical advice or delay seeking medical care because of information displayed in PAICEY. You assume full personal responsibility for your physical health and exercise readiness.
9. Wearable Sensors, Pedometer & Biometric Inputs
The PAICEY App may request access to motion coprocessors, pedometers, and hardware sensors on Your mobile device or connected smartwatches (e.g., Apple Watch, Wear OS, Garmin, Fitbit) to record step counts and active kinetic time.
Sensor data is processed on-device and synchronized over encrypted TLS 1.3 connections to our edge database. We do not sell sensor telemetry to insurance companies, advertising networks, or third-party data aggregators. You may disconnect wearable sensor integrations at any time through the PAICEY settings menu or your phone's privacy settings.
10. Cookies, Web Beacons & Analytics
We use essential session cookies, local storage, and privacy-respecting analytics to deliver and safeguard our web platform:
- Strictly Necessary Cookies: Encrypted session identifiers (
wos-session,paicey_session) and CSRF protection tokens that authenticate Your login session and protect against unauthorized form submissions. - Functional Storage: Local storage keys that remember your theme preference (Dark vs. Light mode), preferred currency, and local check-in drafts.
- Aggregated Analytics: Privacy-preserving analytics that track aggregate page load performance, route errors, and conversion rates without tracking You across unrelated websites.
11. International Data Transfers, Third-Party Cloud Processing & Sub-Processors
11.1. Cross-Border Processing Notice
Because our platform operates on hardened global cloud infrastructure to ensure high availability, microsecond kinetic calculations, zero downtime, and robust perimeter defense, your personal data may be transferred to, stored, and processed on servers located outside the Federal Republic of Nigeria (including within the European Union, the United States, and other international jurisdictions).
11.2. Legal Safeguards & Transfer Mechanisms (NDPA & NDPC GAID)
We only transfer your personal data across borders in strict compliance with Sections 41, 42, and 43 of the Nigeria Data Protection Act 2023 (NDPA) and the NDPC General Application and Implementation Directive (GAID). Every international transfer satisfies at least one of the following recognized statutory transfer gateways:
- Appropriate Safeguards (CBDTI): The foreign recipient is bound by an enforceable Cross-Border Data Transfer Instrument (CBDTI) approved or recognized under the NDPA, including Data Processing Addenda (DPAs) incorporating Standard Contractual Clauses (SCCs) providing data protection safeguards equivalent to Nigerian law.
- Contractual Necessity: The cross-border transfer is strictly necessary for the performance of our contract with you (provisioning authenticated accounts, delivering kinetic analytics, and processing subscription renewals) or to execute features requested by you.
- Adequacy Determination: Personal data is hosted in jurisdictions recognized by the Nigeria Data Protection Commission (NDPC) as providing adequate levels of data protection (including member states of the European Union governed by the EU GDPR).
11.3. Authorized Sub-Processors & Transfer Footprint
We engage vetted third-party service providers (sub-processors) to deliver specific software functions. The table below outlines our primary international sub-processors, their functional roles, processing jurisdictions, and governing transfer instruments:
| Sub-Processor | Role / Function | Processing Jurisdiction | Primary Transfer Safeguard |
|---|---|---|---|
| WorkOS, Inc. | User authentication, Single Sign-On (SSO), and identity verification | United States | Data Processing Addendum (DPA) with Standard Contractual Clauses (SCCs); tokenized encryption |
| Google Cloud Platform (GCP) | Core backend compute, private database hosting (ScyllaDB), and internal microservices | European Union (europe-west4 Netherlands, europe-west1 Belgium) / US | Google Cloud Data Processing Addendum (CDPA) with Model Contract Clauses; AES-256 disk encryption at rest; private VPC peering with zero public IPs |
| Scaleway S.A.S. (Iliad Group) | S3 Object Storage (replacing legacy Bunny Edge Storage), encrypted subscription/card/payment/consent document backups, distributed cluster sync locks, and durable webhook failover queues | European Union (nl-ams Amsterdam, Netherlands / Paris, France) | EU GDPR Data Processing Agreement (DPA) & EU Adequacy; AWS SigV4 (HMAC-SHA256) cryptographic request signing & AES-256 server-side encryption at rest |
| Bunny.net (BunnyWay d.o.o.) | Content Delivery Network (CDN), Magic Containers edge compute, DNS routing, and distributed libSQL edge database | European Union (Frankfurt primary) / Global Edge Nodes | GDPR-aligned Data Processing Agreement (DPA) with standard contractual safeguards |
| Creem.io | Payment processing and Merchant of Record for international (non-Nigerian) transactions | European Union / United Kingdom / United States | Merchant Data Processing Addendum and Level 1 PCI-DSS compliant tokenization |
| Zoho Corporation | Transactional email delivery, security notices, and communication notifications | United States / European Union | Zoho Data Processing Addendum (DPA) incorporating Standard Contractual Clauses (SCCs) |
*Note on Domestic Transactions: Payment transactions originating within Nigeria (via Hydrogen Pay / Access Bank Group and Squad by HabariPay / GTCO) are processed domestically on licensed Nigerian financial rails in full compliance with Central Bank of Nigeria (CBN) regulatory guidelines.
11.4. Security & Technical Safeguards
To safeguard personal data during international transmission and foreign cloud storage, PAICEY enforces rigorous technical and organizational measures:
- Cryptographic In-Transit Security: End-to-end encryption across all data transmissions via Transport Layer Security (TLS 1.3 / HTTPS) with strict cipher suite enforcement.
- Zero Public Database Exposure: Backend Go microservices and ScyllaDB database clusters reside within private Google Cloud VPC subnets with zero public IPv4 or IPv6 addresses, completely unreachable from the public internet. Outbound updates route solely through Google Cloud Router with Cloud NAT.
- Zero-Knowledge Layer 4 Passthrough: Edge DMZ proxy nodes forward raw encrypted TLS byte streams over private VPC peering directly to Core nodes without edge decryption of health check-ins.
- Encryption at Rest & S3 Object Storage Security: Industry-standard AES-256 disk encryption applied to all Google Cloud persistent volumes, Bunny libSQL edge database tables, and Scaleway S3 Object Storage buckets in the European Union (
nl-ams), protected via AWS Signature Version 4 (HMAC-SHA256) request authentication. - Access Controls & Least Privilege: Strict Role-Based Access Control (RBAC), multi-factor authentication (MFA) via Google Cloud Identity-Aware Proxy (IAP), scoped Scaleway IAM credentials, and zero public SSH bastions.
- Vendor Assessments: Continuous vendor compliance reviews, annual security audits, and Data Protection Impact Assessments (DPIAs) prior to engaging new sub-processors.
11.5. Your Rights & Inquiries
You have the statutory right under the NDPA to request information regarding the specific safeguards maintained for cross-border transfers or to obtain a copy of our transfer instrument summaries. For questions regarding international transfers or to exercise your rights, contact our Data Protection Officer (DPO):
12. Data Retention, Security & De-identification
We implement administrative, physical, and technical safeguards designed to protect personal data from unauthorized access, destruction, alteration, or disclosure:
- Hardened Cloud Perimeter: Google Cloud Organization environment with private VPC subnets, zero public IPs on database instances, and Google Cloud Router with Cloud NAT.
- Cryptographic Protection & EU S3 Persistence: End-to-end TLS 1.3 transport security, AES-256 disk encryption on Google Cloud persistent disks, AWS SigV4 authenticated Scaleway S3 Object Storage (
nl-amsAmsterdam) for redundant document backups and webhook failover queues, and AES-256-GCM encrypted session cookies. - Identity & Authentication Security: WorkOS SOC 2 Type II certified passwordless authentication infrastructure (Passkeys/WebAuthn, Magic Codes).
- Role-Based Access Control (RBAC): Least-privilege access policies across Google Cloud IAM, Scaleway IAM, and tenant databases.
- Multi-Worker Cluster Synchronization: Multi-worker cluster synchronization with instant IPC cache invalidation and binary Protocol Buffers batch sync.
Retention Period: We retain Your personal information for as long as Your account remains active or as needed to provide Services, resolve billing disputes, and comply with tax and statutory record-keeping obligations. Upon account termination, personal identifiers are permanently deleted or irreversibly de-identified within 30 days, leaving only aggregated statistical kinetics metrics.
13. Children's Privacy (Under 13 / Under 18)
Our Services are strictly designed for individuals who are at least 13 years of age. Paid subscriptions require users to be at least 18 years old or the age of legal majority in their jurisdiction, or have express consent and supervision from a parent or legal guardian.
We do not knowingly solicit or collect personal information from children under the age of 13. If We discover that personal data of a child under 13 has been collected without verified parental consent, We will immediately delete that information from our servers. If you believe a child under 13 has provided us with personal information, please notify us immediately at privacy@paicey.com.
14. Notice to Nigerian Residents: Nigeria Data Protection Act 2023 (NDPA)
If You reside in the Federal Republic of Nigeria, the processing of Your personal data is governed by the Nigeria Data Protection Act 2023 (NDPA) and overseen by the Nigeria Data Protection Commission (NDPC).
Your Statutory Rights Under NDPA:
15. Notice to California Residents (CCPA & CPRA)
This California Privacy Notice supplements the general policy and applies solely to California residents pursuant to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").
| Category of Personal Information | Collected | Sold / Shared |
|---|---|---|
| A. Identifiers (Name, Email, WorkOS UID, IP address) | YES | NO |
| B. Personal records (Cal. Civ. Code § 1798.80) (Masked card info) | YES | NO |
| C. Commercial information (Subscription history, stack extensions) | YES | NO |
| D. Internet / network activity (App clicks, session duration) | YES | NO |
| E. Geolocation data (Coarse country origin via Bunny CDN) | YES | NO |
| F. Sensitive Personal Information (Self-reported physical/mental QOL) | YES (Member Opt-in) | NO |
"Do Not Sell or Share My Personal Information": PAICEY does not sell Your personal information, nor do We share it for cross-context behavioral advertising. We do not use or disclose Sensitive Personal Information for purposes other than providing the Services You requested.
California Shine the Light: Under California Civil Code § 1798.83, California residents may request a list of all third parties to whom PAICEY has disclosed personal information for direct marketing purposes. PAICEY does not disclose personal data to third parties for direct marketing.
16. Notice to EEA, United Kingdom & Swiss Residents (GDPR)
For Users located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR apply. The data controller is PAICEY LTD. (RC: 9724436).
Lawful Bases for Processing:
- Performance of a Contract (Art. 6(1)(b)): Delivering app functionalities, 2x daily check-ins, subscription management, and customer support.
- Explicit Consent (Art. 9(2)(a)): Processing of special category health data (self-reported 4-pillar QOL metrics, physical strain, and sleep habits) is conducted strictly based on Your explicit, revocable consent given during onboarding.
- Legitimate Interests (Art. 6(1)(f)): Platform security, edge caching, error monitoring, and anti-fraud safeguards.
- Legal Obligation (Art. 6(1)(c)): Maintaining statutory accounting, VAT, and financial records for payments.
Your European Rights: You have the right to access, rectify, erase, restrict processing, data portability, and object to processing. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. You also have the right to lodge a complaint with your local EU Data Protection Authority or the UK Information Commissioner's Office (ICO).
17. Contact Us & Exercising Your Privacy Rights
To exercise any of your statutory rights (Access, Correction, Erasure, Export), or if you have questions regarding this Privacy Policy or our data governance practices, please submit a verifiable consumer request to our Data Protection Office:
We will verify your identity before fulfilling any data subject request to safeguard against unauthorized access. We will respond to verifiable requests within 30 days as required by law.