Privacy Policy

Memberlet is the data controller for personal data processed through the Services, except where a Creator acts as controller for data about their own Members (see Section 5). Our contact details are in Section 15.

This Policy applies to Creators, Members, and visitors to memberlet.com. It does not cover the privacy practices of Telegram, WhatsApp, or any third-party payment processor, each of which has its own privacy policy governing data they process directly.

3.1 Account data: name, email address, phone number, password (hashed), and account preferences.

3.2 Verification (KYC) data — Creators only: government-issued ID details, date of birth, and bank account information, collected to verify identity before enabling payouts.

3.3 Payment data: payment details are collected and processed by our payment processor, Paystack; Memberlet receives transaction confirmations and limited billing information (e.g., last 4 digits of a card, transaction status) but does not store full card numbers.

3.4 Page and Community data: Page content a Creator publishes, and the minimum data (e.g., Telegram/WhatsApp user ID) needed to add or remove a Member from a connected Community.

3.5 Usage data: log data, device/browser information, IP address, and analytics collected automatically when you use the Services.

3.6 Communications: messages you send to our support team.

We do not access, read, store, or analyze the content of messages sent within a Creator’s Telegram or WhatsApp Community. Our bot’s access is limited to membership status (add/remove actions).

We use personal data to:

• Create and manage accounts;
• Verify Creator identity and process payouts;
• Process Member payments and manage access/removal from Communities;
• Detect and prevent fraud, abuse, and violations of our Terms of Service;
• Provide customer support;
• Comply with legal, tax, and regulatory obligations, including anti-money-laundering requirements;
• Improve and secure the Services;
• Send service-related communications (e.g., payment confirmations, renewal notices).

We do not use personal data to serve third-party advertising, and we do not sell personal data.

We process personal data on the following bases under the NDPA:

• Contractual necessity — to provide the Services you’ve signed up for (account creation, payment processing, membership management);
• Legal obligation — to comply with tax, AML/KYC, and regulatory requirements;
• Consent — for optional communications and non-essential cookies, which you may withdraw at any time;
• Legitimate interest — for fraud prevention and Service security, balanced against your rights.

Where a Creator collects information about their Members beyond what Memberlet processes (e.g., within their own Community), the Creator acts as an independent data controller for that data and is responsible for their own compliance with the NDPA.

We share personal data only as necessary, with:

• Paystack (our payment processor), to process payments and payouts;
• Telegram and WhatsApp, limited to the membership-management actions needed to add/remove access (we do not share full account or KYC data with these platforms);
• Service providers who support hosting, analytics, or customer support, under contractual confidentiality obligations;
• Regulators and law enforcement, where required by law, court order, or to investigate suspected fraud;
• A successor entity, in the event of a merger, acquisition, or sale of assets, subject to this Policy continuing to apply.

We do not sell personal data to third parties.

We retain personal data for as long as your account is active and for a reasonable period afterward to comply with legal, tax, and AML record-keeping obligations (typically five (5) years from account closure, unless a longer period is required by law). KYC data is retained for the period required under applicable AML regulation. You may request earlier deletion subject to Section 9.

We apply technical and organizational measures appropriate to the sensitivity of the data we hold, including encryption in transit, access controls, and regular security review. No system is completely secure, and we cannot guarantee absolute security.

Subject to applicable exceptions, you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data (“right to be forgotten”), where legally permissible;
• Restrict or object to certain processing;
• Data portability — receive your data in a structured, machine-readable format;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with the Nigeria Data Protection Commission (NDPC) if you believe your rights have been violated.

To exercise any of these rights, contact us at support@memberlet.com. We will respond within the timeframe required under the NDPA.

If personal data is transferred outside Nigeria (for example, to a cloud hosting or service provider located abroad), we ensure an adequate level of protection through contractual safeguards consistent with NDPA requirements before the transfer occurs.

The Services are not directed at, and may not be used by, anyone under 18. We do not knowingly collect personal data from minors. If we become aware that we have, we will delete it.

We use cookies and similar technologies for authentication, security, and analytics. You can control cookies through your browser settings; disabling some cookies may affect Service functionality.

In the event of a personal data breach that poses a risk to your rights, we will notify the NDPC within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the breach poses a high risk, in accordance with the NDPA.

We may update this Policy from time to time. Material changes will be notified through the Services or by email before they take effect.

For privacy questions, data subject requests, or complaints:

Email: support@memberlet.com

You may also lodge a complaint directly with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.