Privacy Policy

The data controller for account, billing, and platform administration data described in this Policy is Blaitware Limited, a company registered in Nigeria. Bytstack is a product brand of Blaitware Limited.

Registered in Nigeria — address available on request via [email protected].

Privacy and internal redress contact: [email protected]. We have not published a separate Data Protection Officer contact on this page; use the privacy address above for all data-protection requests.

This Policy covers personal data we process as a data controller when you create a Bytstack account, join a workspace, connect integrations, pay for the Service, or contact support.

Content you deploy or store in customer workloads (application code and runtime data, customer databases, environment values you set, logs emitted by your apps, and similar customer content) is processed by Blaitware as a data processor on your instructions. For that content, you (or your organisation) are the data controller and remain responsible for a lawful basis and notices to your end users under the Nigeria Data Protection Act, 2023 (“NDPA”) and other applicable laws. A data processing arrangement may be provided on request for enterprise customers.

Depending on how you use Bytstack, we may process:

• Account and identity data — name, email address, password hashes (if you use password auth), email verification status, and profile preferences.
• Workspace and membership data — workspace name, roles, invites, and activity related to team administration.
• Authentication and integration data — OAuth tokens and identifiers from providers you connect (for example Google or GitHub), repository metadata needed to build and deploy, and webhook delivery metadata.
• Billing and tax data — billing email, plan, payment references, invoices, and VAT or tax fields you provide. Card and bank details are typically processed by our payment providers (for example Paystack or Stripe), not stored in full on our systems.
• Support and communications — messages you send us and related correspondence.
• Usage, security, and operations data — IP addresses, device and browser information, timestamps, API request metadata, deploy and platform event logs, and similar telemetry needed to operate, secure, and improve the Service.
• Cookies and similar technologies — as described in section 12.

We collect data directly from you, from your workspace administrators (for example when you are invited), from connected providers you authorise, and automatically from your use of the Service.

Under the NDPA, we process personal data only where a lawful basis applies. Typical bases and purposes include:

• Performance of a contract — creating and securing your account, providing deployments, databases, domains, previews, billing entitlements, and customer support.
• Legitimate interests — protecting the platform, preventing abuse, measuring reliability, improving product features, and communicating service-related notices, balanced against your rights.
• Consent — where required (for example certain non-essential cookies or optional marketing). You may withdraw consent without affecting prior lawful processing.
• Legal obligation — tax, accounting, lawful requests, and regulatory compliance (including Nigerian VAT where applicable).

Acknowledgement of this Privacy Policy is not, by itself, consent to processing. Where consent is required, we will request it separately in a clear manner.

We may share personal data with categories of recipients who need access for the purposes above:

• Infrastructure and cloud providers — hosting, storage, networking, and related operations. For Nigerian companies and customers, workload and related data may be hosted in our data centres in Abuja and Lagos. We may also use cloud regions outside Nigeria (including facilities such as africa-south1 Johannesburg) depending on product configuration, redundancy, and subprocessors.
• Source-control and identity providers — for example GitHub or Google, when you connect them.
• Payment processors — for example Paystack and Stripe, to process payments and manage subscriptions.
• Email and transactional messaging providers — to send verification, security, and service emails.
• Professional advisers and authorities — where required by law or to establish, exercise, or defend legal claims.
• Workspace members and admins — who can see membership and operational data within your organisation’s Bytstack workspace.

We require processors who handle personal data on our behalf to protect it and process it only on documented instructions, consistent with the NDPA.

Bytstack is built for teams in Nigeria and elsewhere. Where you are a Nigerian company or customer using Nigerian hosting options, personal data and Customer Content associated with your workloads may be processed and stored in data centres in Abuja and Lagos, Nigeria.

Personal data may also be transferred to, stored in, or accessed from countries outside Nigeria (including South Africa and other countries where our cloud or SaaS subprocessors operate)—for example for platform control-plane services, payment processing, email delivery, or integrations you connect. Where we transfer personal data outside Nigeria, we do so in accordance with the NDPA and applicable NDPC guidance, using appropriate transfer mechanisms and contractual or organisational safeguards with recipients.

We keep personal data only as long as needed for the purposes described, including:

• Account and workspace data — for the life of the account/workspace and a reasonable period after deletion or termination to complete winding-down, resolve disputes, or meet legal holds.
• Billing and tax records — for periods required by tax and commercial law.
• Security and operational logs — typically for shorter rolling windows unless needed for incident investigation or legal compliance.

When retention ends, we delete or irreversibly anonymise personal data, subject to backup and archival limitations.

We implement technical and organisational measures appropriate to the risk, including access controls, encryption in transit for platform interfaces, isolation between customer environments where the product design provides it, and monitoring for abuse. No method of transmission or storage is perfectly secure; you are responsible for safeguarding credentials and configuring your workloads carefully.

Subject to the NDPA and applicable exceptions, you may have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete personal data;
• request deletion of personal data in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• withdraw consent where processing is based on consent;
• request data portability where processing is automated and based on consent or contract, where technically feasible; and
• object to and challenge decisions based solely on automated processing that produce legal or similarly significant effects (see section 11).

To exercise these rights, email [email protected] with enough detail for us to verify your identity and locate the data. We will respond within the timelines required by law. Workspace admins may also update certain membership data in-product.

If you believe we have not handled your personal data in accordance with the NDPA, you may lodge a complaint with the Nigeria Data Protection Commission (NDPC) after contacting us, or as otherwise permitted by law. NDPC information is available at ndpc.gov.ng.

We do not use solely automated decision-making that produces legal or similarly significant effects on you without meaningful human involvement. Platform checks (for example plan entitlements, rate limits, or abuse signals) may run automatically as part of providing the Service; they are not used to profile you for unrelated purposes.

We use cookies and similar technologies that are necessary to operate the site and dashboard (for example session authentication and preference storage such as theme). We may use additional analytics or marketing cookies only where permitted, and where consent is required we will seek it. You can control cookies through your browser settings; blocking essential cookies may prevent the Service from working.

Bytstack is directed at businesses and developers. It is not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact [email protected] and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Material changes may also be communicated by email or in-product notice where appropriate. Continued use of the Service after the effective date constitutes awareness of the updated Policy; where the NDPA requires fresh consent for a change, we will request it.

Questions about this Policy or our processing: [email protected].

Related: Terms of Service.