Legal
Privacy Policy
Last updated 13 October 2026
This policy explains what personal data Zarachtech collects through this website, why we collect it, how long we keep it, and the rights you have over it. We have written it to describe what this site actually does rather than to cover every hypothetical.
AI conversations and advertising choices
The website assistant processes voice through OpenAI or Google, and typed messages through Anthropic or OpenRouter and its selected model provider. You choose when to start a voice conversation and can use text instead. We do not record raw audio. Conversations are processed to answer you; server-side chat context is cleared after the session unless you separately consent to saving it. Consented transcripts are retained for up to 30 days. Confirmed enquiry details are retained for business follow-up, independently of transcript consent.
Opening the assistant sets a necessary zt_assistant_visitor cookie for up to 90 days to protect the free allowance against repeated use. It contains a random signed identifier, not contact details. Usage checks store request timestamps and keyed hashes of this identifier and your network address. The allowance uses a rolling 24-hour window, shared across AI providers; visitors on the same network may share the limit. Expired usage records are removed during later allowance reservations. This security data is not used for advertising. WhatsApp and enquiry forms remain available after the allowance is used.
Optional analytics and advertising cookies remain disabled until you choose them. Advertising consent permits Meta Pixel and server-side Conversions API events, including hashed contact details for saved enquiries and confirmed payments linked to those enquiries, with permitted campaign/cookie identifiers. Payment events include the amount, currency and payment time, never bank or card credentials. Consented enquiry matching data is retained for up to 90 days. WhatsApp clicks measure a click, not a conversation or a sale. Conversation text is not sent to advertising platforms. You can change these choices using Privacy on any page; withdrawal stops future optional tracking and cancels queued events linked to enquiries from your current browser session. Events already delivered cannot be recalled. Contact us to withdraw consent for enquiries from another session.
Promotion preferences store only a campaign identifier and last-shown time in your browser so that popups respect their frequency limit. Optional promotion analytics follow your analytics and advertising choices.
Contact zarachtech@gmail.com to request access to or deletion of enquiry information. Provider processing may involve transfers outside Nigeria; their own privacy terms also apply.
Who we are
Zarachtech (RC: BN3256942) is a web, mobile and VoIP development practice based in Lagos, Nigeria. For the purposes of the Nigeria Data Protection Act 2023 (NDPA), we are the data controller for personal data collected through this website.
Zarachtech (RC: BN3256942)
Lagos, Nigeria
Email: zarachtech@gmail.com
Phone: +234 201 700 1361
What we collect, and when
We only collect personal data when you give it to us, plus a small amount of technical data that is unavoidable when running a website securely.
When you use the contact form
- Your name, email address, subject and message.
- Your IP address and browser user-agent string, recorded with the message.
When you subscribe to the newsletter
- Your email address, and the date you subscribed.
Automatically, on every visit
- A session cookie, so the site can protect forms against cross-site request forgery.
- A short-lived, irreversibly hashed record of your IP address, used only to rate-limit form submissions and blocked login attempts.
- Standard web server logs kept by our hosting provider.
We do not ask for, and this site has no facility to accept, payment card details, government identification numbers or any special category data.
The AI voice assistant
The site offers an optional voice assistant (“Talk to my AI”). It only activates when you press Start call — that action is your consent. While the call is live, your microphone audio is streamed to OpenAI, which processes it to understand you and generate the assistant's spoken replies. Audio passes through OpenAI under its own privacy terms; we do not record or store call audio ourselves.
If you choose to leave your details with the assistant, we store only what you give it — your name, a contact address or number, and a short project description — alongside ordinary contact-form messages, under the same 24-month retention rule. Ending the call stops all audio processing immediately. The assistant is an AI: it can make mistakes, and nothing it says is a binding quote — please don't share payment details, identification numbers or other sensitive data with it.
Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis (NDPA s.25) |
|---|---|---|
| Replying to your enquiry | Name, email, subject, message | Steps taken at your request prior to entering a contract |
| Sending the newsletter | Email address | Your consent, withdrawable at any time |
| Preventing spam and abuse of our forms | Hashed IP, user-agent | Our legitimate interest in keeping the site available and free of abuse |
| Securing the administrative area | IP, user-agent, timestamps of sign-in attempts | Our legitimate interest in protecting the site, and our legal obligation to secure personal data |
| Understanding how the site is used | Analytics data, where enabled | Your consent |
How long we keep it
- Enquiries — retained for up to 24 months after our last correspondence, so we can pick up an earlier conversation, then deleted.
- Newsletter subscriptions — retained until you unsubscribe.
- Rate-limiting records — automatically discarded within an hour.
- Security logs — retained for up to 12 months.
Who we share it with
We do not sell personal data, and we do not share it for anyone else's marketing. Data is disclosed only to:
- Our hosting provider, which stores the site and its database on our behalf.
- OpenAI, which processes voice-assistant call audio while a call you started is live.
- Google, where Google Analytics or reCAPTCHA is enabled — see our Cookie Policy.
- A public authority, where we are required to by Nigerian law.
Where a provider processes data outside Nigeria, we rely on the transfer conditions in Part IX of the NDPA and satisfy ourselves that an adequate level of protection applies.
How we protect it
The site is served over HTTPS with HTTP Strict Transport Security. Administrative access requires a password stored only as a one-way hash, and is protected by session-timeout and rate-limited sign-in. Form submissions carry CSRF tokens, database queries use prepared statements, and a Content Security Policy restricts what the browser will load. Databases, configuration and logs sit outside the publicly reachable path.
No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach that is likely to result in a risk to your rights, we will notify the Nigeria Data Protection Commission and, where required, you directly.
Your rights
Under the NDPA you may ask us to:
- confirm whether we hold personal data about you, and give you a copy;
- correct data that is inaccurate or incomplete;
- delete data where we no longer have grounds to keep it;
- restrict or object to how we use it;
- provide it in a portable, machine-readable form; or
- withdraw consent, where consent is the basis we rely on.
Email zarachtech@gmail.com and we will respond within 30 days. There is no charge. If you are not satisfied with our response, you may complain to the Nigeria Data Protection Commission.
Children
This site is intended for business use and is not directed at children under 18. We do not knowingly collect their data. If you believe a child has provided us with personal data, contact us and we will delete it.
Changes to this policy
If we change how we handle personal data we will update this page and the date shown at the top. Where a change materially affects your rights, we will say so prominently.