1. Introduction
xSignal ("we", "us", "our") is a business messaging platform operated by xSignal Provider, providing SMS delivery infrastructure via SMPP and HTTP API to registered business clients. This Privacy Policy explains how we collect, use, store, and protect information you provide when you access or use our platform and services.
This policy applies to business clients - companies, organisations, and developers ("Client", "you") - who register for and use xSignal's services. It does not govern the relationship between our Clients and the end recipients of their messages.
We are committed to complying with the Nigeria Data Protection Regulation (NDPR) 2019 and the Nigeria Data Protection Act (NDPA) 2023.
2. Data We Collect
2.1 Account and Registration Information
When you register for an xSignal account, we collect:
- Business name and registered address
- Contact person name, email address, and phone number
- Government-issued business registration details, where required for verification
2.2 Billing and Payment Information
To process payments, we collect:
- Billing address and invoice details
- Payment transaction references
We do not store card numbers or full bank account details. Payments are processed by third-party payment processors, including Paystack and Flutterwave, who maintain their own PCI-DSS compliant environments.
2.3 Platform Usage Data
When you use the xSignal API or dashboard, we automatically collect:
- API credentials and authentication tokens
- Message metadata: sender IDs, delivery statuses, timestamps, and volume counts
- IP addresses and request logs
- Dashboard activity and session data
We do not store the content of SMS messages beyond the minimum period required for delivery confirmation and dispute resolution.
2.4 Communications
If you contact our support team, submit an inquiry, or request an account, we collect the information you provide in those communications, including name, email, company, and message content.
3. How We Use Your Information
We use the information we collect to:
- Provision, operate, and maintain your xSignal account and API access
- Process billing, generate invoices, and manage wallet top-ups
- Authenticate API requests and enforce access controls
- Monitor platform usage, detect abuse, and enforce our Acceptable Use Policy
- Respond to support requests, inquiries, and account applications
- Send transactional notifications, including account alerts, billing receipts, and service updates
- Comply with applicable Nigerian law and regulatory obligations
- Investigate and resolve disputes
We do not use your data for advertising, and we do not sell your data to third parties.
4. Legal Basis for Processing
Under the NDPR and NDPA, we process your personal data on the following lawful bases:
- Contract performance: processing necessary to deliver the services you have agreed to under our Terms of Use
- Legitimate interests: fraud prevention, security monitoring, and platform integrity
- Legal obligation: compliance with Nigerian law, NCC regulations, and lawful requests from public authorities
- Consent: where you have explicitly provided consent, such as marketing communications where applicable
6. Data Retention
We retain your data for as long as your account is active and for a minimum of 5 years after account termination, in accordance with Nigerian financial record-keeping requirements. Specific retention periods:
| Data Type | Retention Period |
|---|---|
| Account registration details | 5 years post-termination |
| Billing and invoice records | 7 years for tax compliance |
| Message delivery logs and metadata | 12 months |
| API access logs | 6 months |
| Support communications | 3 years |
After the applicable retention period, data is securely deleted or anonymised.
7. Data Security
We implement technical and organisational measures to protect your data, including:
- Encrypted data transmission (TLS/SSL) for all API and dashboard connections
- Access controls and API key authentication
- Role-based access management for internal staff
- Regular security reviews and vulnerability assessments
No system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority (NITDA) in accordance with the NDPA's breach notification requirements.
8. Your Rights
As a data subject under the NDPR and NDPA, you have the right to:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate or incomplete data
- Erasure: request deletion of your data, subject to our legal retention obligations
- Restriction: request that we limit how we process your data
- Objection: object to processing based on legitimate interests
- Portability: request your data in a structured, machine-readable format
To exercise any of these rights, contact us at inquiry@xsignalling.xyz. We will respond within 30 days.
10. Data Protection Officer
In accordance with the NDPA, we have designated a Data Protection Officer (DPO) responsible for overseeing compliance with this policy and applicable data protection law.
DPO Contact: inquiry@xsignalling.xyz
11. International Data Transfers
Our primary infrastructure is hosted within Nigeria. Where data is processed by third-party service providers outside Nigeria, we ensure that appropriate safeguards are in place consistent with the NDPA's requirements for cross-border data transfers.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered Clients of material changes via email or a notice within the dashboard at least 14 days before the change takes effect. Continued use of the platform after the effective date constitutes acceptance of the updated policy.
13. Contact Us
For questions, data subject requests, or concerns about this Privacy Policy, contact xSignal / xSignal Provider.
Email: inquiry@xsignalling.xyz
Website: xsignalling.xyz