1. Who we are
Natu is an estate visitor access service operated by MOAA TECH Nigeria Limited (“MOAA TECH”, “we”, “us”), Suite 307, Plot 307 The Kings Plaza, Ahmadu Bello Way, Kado, Abuja, Nigeria. This policy explains how personal data is handled across the Natu app, the natu.ng website, the visitor pass pages and the superadmin console (together, the “Service”), in line with the Nigeria Data Protection Act 2023 (NDPA).
2. Estates, residents and visitors
Three kinds of people appear in Natu. Account holders are estate managers and residents who sign up. For their account data, MOAA TECH is the data controller. Visitors do not have accounts: a resident types a visitor name when creating a pass, and the gate records when that pass was used. For visitor names and gate records the estate is the data controller and MOAA TECH processes that data on the estate’s instructions. A visitor who wants to know what an estate holds about them should ask the estate; we help estates answer those requests.
3. What we collect
When you sign up we collect your email address, your name and, if you choose to add it, a phone number. To keep sessions safe we record a device identifier and, if you turn notifications on, a push token. Estate managers give us the estate name, location and the list of homes. Residents give us visitor names and pass details. Gate phones record which pass was shown, when, and whether it was allowed, plus manual admits with the visitor name the guard typed. We also keep technical logs (IP address, app version, error reports) needed to run and secure the Service. Card payments are handled by Paystack; we never see or store card numbers.
4. How we use data
We use personal data to run the Service: creating and verifying passes, showing the gate which home a visitor is going to, telling a household when their visitor is admitted, sending sign-in codes, invitations and password resets, billing estates, providing support, preventing abuse and meeting legal obligations. We do not sell personal data and we do not use it for advertising.
5. Retention
Visitor records are kept for 30 days. Passes and gate entries are deleted 30 days after the pass ends. After that only anonymous daily counts (entries, denials, passes created) remain, so an estate can see how busy its gate is without any personal data. Account data is kept while the account exists. Invoices and payment records are kept for as long as accounting and tax law require.
6. Sharing
We share data only with the providers we need to run Natu: email and SMS delivery, push notification services (Apple and Google), payment processing (Paystack) and hosting. Each may use it only to provide that service to us. Within an estate, managers can see the homes, residents and gate log of their estate, and a household sees its own passes and entries. We disclose data to authorities only where the law requires it.
7. Security
Pass codes are unique among active passes in an estate and each single-use pass can be used exactly once. QR codes are signed so an altered code is refused. Data is encrypted in transit, passwords are stored hashed, gate phones can be revoked by the manager at any time, and privileged actions are recorded in an audit log.
8. Your rights
Under the NDPA you may ask for access to, correction of, or deletion of your personal data, and you may object to or restrict certain processing. You can update your profile and delete your account inside the app under Me, or write to us. See how to delete your account. If you are a visitor, start with the estate that admitted you.
9. Cookies
The website uses a cookie only to keep the superadmin console signed in. Visitor pass and invitation pages set no cookies and are not indexed by search engines.
10. Changes and contact
We may update this policy from time to time. Material changes are announced in the app or by email before they take effect. For any privacy question or request, write to hello@natu.ng. See also our terms of service.