Skip to main content
Back to Ehmo Business Hub

Data Protection & Governance Charter

Privacy Policy & Data Rights

Effective: October 2026•Version: 2.4•Statutory Basis: Nigeria Data Protection Act (NDPA 2023) & GDPR

01.Introduction & Data Controller Identity

This Privacy Policy explains how Ehmo Technologies Ltd ("Ehmo Business Hub", "we", "us", or "our") collects, processes, and safeguards personal information across our business operations platform, merchant digital storefronts, and communications infrastructure.

We operate in full compliance with the Nigeria Data Protection Act 2023 (NDPA), the Nigeria Data Protection Strategic Roadmap, and international frameworks including the General Data Protection Regulation (GDPR) for global cross-border operations.

02.Data Categories We Process

We process two distinct classifications of data:

  • Platform & Operator Data: Names, business emails, CAC registration numbers, encrypted passwords, session tokens, and billing records required to provision workspace accounts and fulfill Paystack/Stripe payment obligations.
  • Storefront Visitors & Drop Subscribers: When customers interact with a merchant storefront (ehmo.sogx.top//yourbrand) and opt-in for "Priority Product Drops", we collect their voluntarily provided Email address or WhatsApp phone number, timestamp of opt-in, and opt-in channel.

03.Storefront Media, Cloudinary CDN & Social Previews

When merchants upload photographs or video tours for their product listings:

  • Images are securely ingested and stored via Cloudinary Media Services and distributed across geo-distributed Content Delivery Network (CDN) edge nodes to ensure sub-second rendering.
  • Published listings generate public OpenGraph image URLs and Schema.org Product structured metadata. This allows instant preview cards on WhatsApp Status, Instagram, TikTok, Facebook, LinkedIn, and Twitter, as well as AI web indexing.
  • Merchants can unpublish or delete an item at any time, which purges the preview links and invalidates the cached CDN entry.

04.Third-Party Messaging Channels (WhatsApp, Telegram, Email)

When a buyer clicks "Inquire via WhatsApp" or "Inquire via Telegram" on a product showcase, Ehmo Business Hub constructs a prefilled deep link containing the item title and price. The user is redirected to the respective third-party application (Meta WhatsApp or Telegram FZ-LLC).

Ehmo Business Hub does not inspect, log, or record private one-on-one chats occurring natively inside WhatsApp or Telegram between buyers and merchants. Those communications are governed exclusively by WhatsApp and Telegram privacy policies.

05.Zero LLM Training on Business Memory

We maintain an uncompromising boundary regarding tenant data confidentiality:

  • Your ingested knowledge documents, customer broadcast contact lists, and internal draft communications are strictly partitioned under tenant-isolated workspace schemas.
  • We enforce a strict Zero Public Model Training Policy: tenant data is never utilized to train, retrain, or fine-tune public foundation AI models (OpenAI, Mistral, Google).

06.Cryptographic Token Storage & Security Architecture

All sensitive third-party connection credentials — including Google OAuth refresh tokens, Telegram bot secrets, and Bring-Your-Own-Key (BYOK) AI provider keys — are encrypted at rest using military-grade AES-256-GCM authenticated encryption.

Decryption keys are isolated from the database and maintained in system environment memory. All HTTP transmissions are enforced over TLS 1.3 encryption.

07.Google API Services User Data Policy & Limited Use Disclosure

Ehmo Business Hub's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Google Data We Access:

When a merchant connects their Google account via OAuth to Ehmo Business Hub (operating at ehmo.sogx.top/), our application requests access strictly to:

  • Basic Profile Data (.../auth/userinfo.email, .../auth/userinfo.profile): To verify account ownership, authenticate login sessions, and associate your workspace with your verified identity.
  • Gmail Messages (.../auth/gmail.readonly, .../auth/gmail.send): To read incoming customer support emails sent to your business email address and display them in your Unified Inbox, and to allow you to approve and send outbound email responses directly to your customer inquiries.
How We Use Google Data:

Google user data is used exclusively to provide user-facing features on Ehmo Business Hub: specifically, presenting customer inquiries inside your operator inbox and transmitting replies authorized by you. We do not use Google user data for advertising, market research, or lead scraping.

Limited Use & Strict Non-Sharing Policy:
  • We never sell Google user data to third parties, data brokers, or advertisers.
  • We never transfer Google user data to third parties, except as strictly necessary to fulfill the core support inbox functionality (such as hosting and database storage under encrypted protocols), to comply with applicable laws, or as part of a corporate merger or acquisition.
  • We never use or transfer Google user data for serving personalized, retargeted, or interest-based advertising.
  • We never use Google user data to train, retrain, or fine-tune artificial intelligence (AI) or machine learning (ML) models.
  • We never allow human access to read your private email content unless: (a) we have obtained your affirmative agreement for specific messages (e.g. for customer support troubleshooting); (b) it is necessary for security purposes (such as investigating abuse); (c) to comply with applicable law; or (d) the data is aggregated and anonymized for internal technical operations.
Revocation & Data Deletion:

You can disconnect your Google account and revoke access at any time through your dashboard under Channel Connections, or via the Google Security Permissions Dashboard. Upon disconnection or account termination, all stored OAuth tokens are immediately and permanently erased from our encrypted database.

08.Subscriber Consent & 1-Click Unsubscribe Mandate

In accordance with NDPA 2023 regulations and international anti-spam standards:

  • 1-Click Email Unsubscribe: Every outbound email dispatched via Ehmo Business Hub carries RFC-compliant List-Unsubscribe headers and direct 1-click unsubscribe links. When a recipient clicks unsubscribe, our automated endpoint immediately flags their contact status as inactive.
  • WhatsApp Opt-Out: Customers receiving WhatsApp broadcast updates can reply with UNSUBSCRIBE at any time to immediately cease further notifications.

09.Your Statutory Rights (NDPA 2023 & GDPR)

Every data subject possesses the following rights:

  • Right of Access: Request a full copy of personal records held by Ehmo Business Hub.
  • Right of Rectification: Request correction of inaccurate, outdated, or incomplete data.
  • Right to Erasure ("Right to be Forgotten"): Request permanent deletion of customer records and catalog data upon workspace termination.
  • Right to Data Portability: Export contacts, catalog listings, and communication histories in standard machine-readable formats.

10.Data Protection Officer (DPO) Contact

To exercise your statutory data rights, request compliance audits, or submit inquiries to our designated Data Protection Officer, please contact:

DPO Office: Data Protection & Regulatory Compliance Desk

Email: privacy@ehmo.app

General Support: support@ehmo.app

Address: Lagos, Nigeria