What changed on 6 November 2026: our website statistics now also record the state and city our hosting provider works out from your connection, as well as the country (section on website statistics below). Your IP address is still not stored, and you still cannot be followed from one day to the next. On 5 November 2026 we started saying “System” where we used to say “server”; that changed words only.
This policy explains what personal information SCPL Cloud collects about you, why, who we share it with, how long we keep it and the rights you have under the Nigeria Data Protection Act 2023. It covers everyone who uses our website, including visitors who chat with Ade before creating an account, and our customers. Words with capitals mean what our Terms of Service say they mean. A “System” has the meaning given in our Terms: a computer we run for you in our cloud, with its storage, restore points, backups and the software on it.
1. Who we are
SCPL Cloud is operated by SCPL Africa, headquartered in Awka, Anambra State, Nigeria (“SCPL”, “we”, “us”). For the information described in this policy we are the data controller: we decide why and how it is used. For data you store on your own Systems, see section 10.
2. The information we collect
Account details: your name, email address, password (stored only as a secure hash we cannot reverse), two-factor sign-in settings, and when you accepted our Terms.
Sign-in and security records: failed sign-in attempts, account lockouts, which devices are signed in, and actions taken on your account by our staff.
Records of attempts to misuse the Services: when someone repeatedly enters wrong passwords or codes, sends forged requests, tries to open staff pages, or tries to get our AI agents to reveal internal information, we record the internet address, the approximate location worked out from it (usually the city of the internet provider, never a precise location), the device and browser details, the account if signed in, and what was sent.
Orders and billing: what you bought, prices, invoices, account credit and payment references. Your card details are entered on Paystack’s pages and handled by Paystack; we never see or store them.
Your services: System names and settings, addresses, status, setup results, events, and health readings sent by our monitoring agent (for example whether the System is up, whether its services are running, and how busy and how full it is).
Code from GitHub (if you connect it): your GitHub account or organisation name, the repository and branch you chose, commit details of each deploy, and the app settings you enter (stored encrypted).
Support: your support tickets and messages, and your chats with Ade. If you chat without signing in, we also keep a scrambled code made from your internet address, which we use only to limit how many questions can be asked. If a message tries to misuse the chat, we record it as described under records of attempts to misuse the Services.
Teams: if someone invites you to their team, or you invite others: the invited email address, who sent the invitation and when, the role, any Systems it is limited to and any end date. We keep only a fingerprint of the invitation link, not the link itself. Once you join, we also record your membership and what you do in that account (its Activity record). We don’t send emails to invited people; the person who invites you sends the link.
Technical information: like any website, the servers that run our website record internet addresses and basic request details in short-lived logs, to keep the site working and secure.
We collect this from you, from your use of the Services, from Paystack (payment confirmations), from GitHub (if you connect it) and from your Systems’ monitoring agent. We do not buy personal information, and we do not collect sensitive information such as health, religion or biometrics.
3. Why we use it, and our lawful basis
To provide the Services you ask for (contract): create your account, deliver and run your services, bill you, deploy your code, give support, and let account holders give other people limited access to their account (teams).
To meet our legal duties (legal obligation): keep financial and tax records, and respond to lawful requests from authorities.
To keep the Services safe and working (legitimate interests): prevent fraud and abuse, protect accounts, monitor Systems, fix problems, and keep a record of who did what in a shared account, so the account holder can hold their team to account. We weigh these interests against your rights and do not use them to override them.
To answer you before you become a customer (legitimate interests, or steps you ask us to take before a contract): chats with Ade and questions about prices.
Marketing (consent only): see section 12.
4. Ade and our other AI agents
Ade, the live chat on our website, is an AI support agent. Section 22 of our Terms explains our levels of support, what our AI agents can and cannot do, and which decisions need a person’s approval.
To answer you, Ade processes what you write and, if you are signed in, the details of your account and services needed for your question. He cannot see your password, card details, private keys or what is stored on your Systems.
Decisions that significantly affect you, such as refunds, suspensions or deleting anything, are made or approved by a person. You may ask for a person to review any decision an AI agent was involved in.
Our staff can read chats to help you, to check the quality and safety of answers, and to resolve disputes. To answer you, chats are processed by our AI provider outside Nigeria (see section 6).
We do not use your chats, tickets or data to train AI models, and our AI provider processes them for us under a contract that does not allow it to train its models on them.
Messages to our AI agents are checked automatically, by a separate AI check, for attempts to get internal information or to change how the agents behave. Such attempts are recorded (see section 2) and reviewed by a person; after repeated attempts, the internet address may be kept out of the chat and sign-in for a time. Ordinary questions are not recorded this way.
Chatting with Ade is optional: you can always use a support ticket and a person will reply.
My CTO, our AI technical assistant, works on one of your Systems only when you ask it for a task there. To do the task it runs commands on that System and reads their output (for example a configuration file or a log), which is processed by our AI provider outside Nigeria (see section 6). Passwords, keys and tokens in that output are hidden as soon as it reaches us, before it is stored or sent to our AI provider, and the assistant can’t read SCPL’s own files, private keys or the tools of your encrypted data. It only looks (read-only) until you approve its plan; the changes it makes are exactly the commands you approved, after a snapshot of the System. Its access is limited in time and ends with the task. The task, its commands and their output are kept with your service’s history so you can see what was done.
5. Who we share it with
We do not sell your personal information. We share it only with:
Service providers who work for us, under contracts that limit their use of it to what we ask:
our cloud infrastructure provider, whose Tier III datacentres run your Systems in the location you choose (Lagos, or Kenya), and our website, our customer database and their backups in Lagos;
Paystack, which processes payments;
Anthropic, our AI provider, which processes chats with Ade (see section 6);
GitHub, only if you connect your repositories.
The account holder and their team, if you are a member of someone else’s team. The account holder, and other members whose role allows it, see your name, email address, role, the Systems you work on, any end date, and the Activity record of what you did in that account. They don’t see your own account, your other teams, or your sign-in and security records.
Authorities, when the law requires it, for example a court order or a lawful request from a regulator or the police. Where we are allowed to, we tell you first.
A buyer or successor of our business, if SCPL is sold or merged, under the same protections as this policy.
6. Where your information is kept, and what leaves Nigeria
Your information is kept in Nigeria. Our website, our customer database, its backups and our logs run on our own servers in Tier III datacentres in Lagos, as do your Systems and the data on them unless you choose our Kenya location for a System.
Only these leave Nigeria, and only when you use them:
Systems you place in Kenya. When you choose our Kenya location, that System and everything on it are kept in Kenya, by the same infrastructure provider under the same protections. Systems in Nigeria 1 and Nigeria 2 stay in Lagos.
Chats with Ade. To answer you, what you write in the chat, and the account and service details needed for your question, are sent to our AI provider, Anthropic, in the United States. It processes them only to produce Ade’s answer, keeps them only for the limited time its terms allow, and may not use them to train its models. Ade never receives your password, card details, private keys or what is stored on your Systems. The same applies whenever one of our AI agents helps with your request. If you would rather nothing you write leaves Nigeria, use a support ticket answered by our team instead of the chat.
GitHub, only if you connect your repositories to deploy code: GitHub, in the United States, holds your code, and we exchange with it only what deploys need (repository, branch and commit details).
When information leaves Nigeria, we rely on the safeguards the Nigeria Data Protection Act 2023 allows, such as contracts with protections for your information, and we send only what is needed.
7. How long we keep it
Account details: while your account is open, then up to 90 days after you close it.
Orders, invoices and payment records: six years after the year they relate to, as tax and company law require.
Support tickets and chats with Ade: two years after the last message.
Sign-in, security and staff action records, including records of attempts to misuse the Services: one year, or longer if needed for an investigation or to report a crime.
Service records (settings, events, health readings): while the service exists, then up to one year.
Teams: invitations, until 90 days after they are used, withdrawn or expire. Memberships, while they last, then 90 days after they end. Activity records, one year, or longer if needed for an investigation or a legal claim.
Data on your Systems: erased when the service is deleted or its Billing Period ends without renewal, as our Terms explain.
We may keep information longer when the law requires it, or to establish or defend a legal claim.
8. How we protect it
We use encrypted connections (HTTPS), store passwords only as secure hashes, encrypt secrets such as app settings and System keys, offer two-factor sign-in, lock accounts after repeated failed sign-ins, check messages to our AI agents for misuse, and give our staff access only to what they need, with their actions logged. No system is completely secure, but we work to protect your information and review our measures as risks change.
9. Your rights
Under the Nigeria Data Protection Act 2023, you can ask us to:
tell you whether we hold information about you, and give you a copy;
correct information that is wrong or incomplete;
delete information we no longer need or have no lawful basis to keep;
restrict how we use it while a question about it is resolved;
stop using it for purposes based on our legitimate interests, or for marketing;
give it to you, or another provider, in a common electronic format;
withdraw consent you gave, without affecting what we did before;
not be subject to a decision based solely on automated processing that significantly affects you.
You can change your password and sign-in settings yourself under Account security. For anything else, open a support ticket titled “Privacy request”, or use Help & contact if you don’t have an account. We may ask you to confirm who you are. We will reply within 30 days and will not charge you, unless a request is clearly unfounded or excessive.
10. Data you store on your Systems
For personal data inside your Systems, databases, apps and storage (your Customer Content), you are the data controller and we process it only to provide the Services, on your instructions, as our Terms explain. We do not look at it unless you ask us to for support, it is needed to keep the Services working or secure, or the law requires it. If you need a data processing agreement for your customers’ data, see our Data Processing Terms.
11. Cookies and visitor statistics
We use only the cookies the website needs to work: one that keeps you signed in, one for the sign-in step of two-factor authentication, and one that remembers your cart. They are not used for advertising or to follow you across other websites.
We count visits to our website with our own statistics tool, built into the website, to see which pages help people and how many visits lead to an order (legitimate interests). It uses no cookies and stores nothing on your device, and nothing is sent to an analytics company. For each page you open we record the page (without the details after “?”, except a campaign name in a link we shared), the site that sent you to us, the kind of device, and your country, state and city as our hosting provider works them out from your connection (roughly; our staff see places with fewer than three visitors only as “other places”). Your IP address is not stored: it is shortened, mixed with your browser’s name and a random daily key, and turned into a code that cannot be turned back. The daily key is deleted after two days, so we cannot follow you from one day to the next or work out who you are. If you add to your cart, sign up or place an order that day, the same code records that step. When you create an account or place an order, we also note on it which site or campaign brought you to us that day (for example “google.com” or an Instagram campaign we ran), so we can see which of our adverts bring customers; nothing else about your visits is kept with your account. Our staff are not counted. We keep these records for 13 months, then delete them. If your browser sends a “do not track” or Global Privacy Control signal, we do not count your visit at all.
12. Marketing
We send newsletters and offers only if you have agreed to receive them, and every message has a link to unsubscribe. We record when and how you agreed. Messages about your account, orders and services (for example invoices, setup results and security notices) are not marketing and are sent as part of the Services.
13. Children
The Services are for businesses and adults. We do not knowingly collect information from anyone under 18; if you believe we have, tell us and we will delete it.
14. If something goes wrong
If a security incident puts personal information at risk, we act at once to contain it, notify the Nigeria Data Protection Commission within 72 hours where the law requires it, and tell you without delay if it is likely to put your rights at high risk, with what you can do to protect yourself.
15. Changes to this policy
We may update this policy. The version and date at the top change each time, and we tell customers by email or on the website before a significant change takes effect.
16. Contact and complaints
For privacy questions or requests, contact our data protection officer through a support ticket titled “Privacy request” or through Help & contact. If you are not satisfied with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).