Effortless Scale Back to the onboarding form

Legal

Privacy Policy

Effective date: 12 June 2026 Last updated: 12 June 2026

1. Introduction

This Privacy Policy explains how Effortless Scale (“Effortless Scale”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects your personal data when you interact with our business through WhatsApp, Instagram, our website, our storefronts on Selar and Paystack, or any other channel we operate.

We are committed to handling your personal data lawfully, transparently, and with the care it deserves. This Policy is written to comply with the Nigeria Data Protection Act, 2023 (the “NDPA”) and the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), and to align with the platform terms of Meta Platforms, Inc. (“Meta”), under which we use WhatsApp Business Platform, Instagram Graph API and the Messenger API .

Please read this Policy carefully. By using our services or messaging us through any of our channels, you confirm that you have read, understood, and agreed to the practices described here.

2. Who We Are (Data Controller)

Effortless Scale is a Nigerian digital studio that builds AI-powered systems — prompt packs, Notion templates, automation workflows, and WhatsApp/Instagram/Messanger messaging automations — for skilled professionals and businesses operating in Nigeria.

For the purposes of the NDPA and GDPR, the Data Controller responsible for your personal data is:

If you have any questions about this Policy or about how we handle your personal data, please reach out to us using the contact details above before submitting a complaint to a regulator.

3. Scope of This Policy

This Policy applies to personal data we process about:

  • Visitors to our website (when launched) and digital storefronts;
  • Customers who purchase digital products or services from us through Selar, Paystack, or directly;
  • Users who contact us via WhatsApp, Instagram, email, SMS, or phone;
  • Users who interact with our automated WhatsApp and Instagram messaging systems;
  • Subscribers to our newsletters, broadcasts, or notification lists;
  • Business partners, suppliers, and other third parties we deal with in the ordinary course of business.

This Policy does not apply to third-party websites, applications, or services that we do not own or control, even where we link to them.

4. Key Definitions

Throughout this Policy, we use a number of defined terms. We have tried to keep the language plain. The most important terms are:

  • “Personal data” means any information that identifies you or could reasonably be used to identify you — for example, your name, phone number, email address, WhatsApp profile information, payment reference, or device identifiers.
  • “Processing” means anything we do with your personal data — collecting it, storing it, organising it, using it, sharing it, or deleting it.
  • “Data Subject” means you, the individual whose personal data we hold.
  • “Data Controller” means the person or organisation that decides how and why personal data is processed. For most data described here, the controller is Effortless Scale.
  • “Data Processor” means a third party that processes personal data on our behalf and under our instructions (for example, our payment provider or hosting provider).
  • “Meta Platforms” means Meta Platforms, Inc. and its affiliates, which own and operate WhatsApp, Instagram, Facebook, and the underlying business APIs we use.

5. Information We Collect

We only collect personal data we genuinely need in order to provide our products and services, communicate with you, comply with the law, and improve what we offer. The categories below describe what we may collect.

5.1 Information you give us directly

  • Identity and contact data: your name, business name, WhatsApp number, phone number, email address, Instagram handle, and location (city/state).
  • Customer and transaction data: details of products or services you purchase, order references, invoices, receipts, and the records of our communications with you.
  • Payment data: we do not store full card or bank account details. When you pay through Paystack, Selar, or any other licensed payment provider, those providers collect and process your payment information directly. We receive only limited information such as your name, transaction reference, amount, status, and the email or phone number you used at checkout.
  • Support and feedback data: messages, screenshots, voice notes, files, testimonials, or other content you share with us when you ask a question, request support, or give feedback.
  • Marketing preferences: your consent to receive broadcasts, newsletters, or promotional content, and any opt-out you communicate.

5.2 Information we collect automatically

  • Messaging metadata: when you message us on WhatsApp , Messenger or Instagram, we automatically receive information such as your WhatsApp profile name, your phone number, your Instagram username and ID, the timestamps of your messages, and the content of the messages you send to us. This is information you have chosen to send to us by initiating the conversation.
  • Website and device data (when our website is live): IP address, browser type and version, device type, operating system, referring page, pages viewed, and approximate location derived from your IP address.
  • Automation logs: records of how our automated workflows handled your message — for example, which reply template was sent, whether a handoff to a human happened, and any errors encountered. These logs help us debug and improve the service.

5.3 Information we receive from third parties

  • Meta Platforms: we may receive your basic profile information (name, profile photo, public username) when you message us via WhatsApp or Instagram, in line with Meta's platform terms and your own platform privacy settings.
  • Payment providers: Paystack, Selar, and similar providers share transaction confirmations, refund statuses, and limited customer details with us.
  • Identity verification providers (only where required): where a service genuinely requires identity verification (for example, business onboarding for a regulated client), we may receive verification results from licensed providers such as Smile ID, Youverify, Dojah, or NIBSS — only with your explicit consent and only for the stated purpose.
  • Publicly available sources: such as your public Instagram profile, business directory listings, or content you have chosen to make public.

5.4 Sensitive personal data

We do not seek to collect sensitive personal data (such as data revealing health, religious belief, political opinion, ethnic origin, biometric data, or trade union membership). Please do not share such information with us unless it is strictly necessary, and only with your explicit consent.

6. Why We Process Your Personal Data (Lawful Basis)

Under the NDPA and the GDPR, we must have a lawful basis for processing your personal data. Depending on what we are doing, we rely on one or more of the following bases:

  • Your consent — for example, when you opt in to receive marketing broadcasts, when you submit your details through a form, or when you message us first on WhatsApp or Instagram.
  • Performance of a contract — when you purchase a digital product or service from us, we need to process your data to deliver the product, send the receipt, and provide support.
  • Compliance with a legal obligation — for example, to keep tax records, respond to lawful requests from regulators, or comply with anti-fraud rules.
  • Our legitimate interests — such as running and improving our business, securing our systems, preventing fraud, and communicating with existing customers about similar products — provided that these interests do not override your rights and freedoms.
  • Vital interests or public interest — in rare circumstances, for example to protect someone's life or to cooperate with law enforcement.

Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. How We Use Your Personal Data

We use your personal data only for the purposes set out below. We do not sell your personal data to anyone.

  • To deliver the digital products, automations, templates, and services you have ordered from us.
  • To process payments, issue receipts, and handle refunds through licensed providers (Paystack, Selar, and similar).
  • To respond to your enquiries, questions, and support requests, including via automated WhatsApp and Instagram replies.
  • To run, maintain, and improve our WhatsApp Business, Instagram, website, and back-office systems.
  • To send you transactional messages such as order confirmations, payment receipts, dispatch updates, and product update notices.
  • To send you marketing messages, newsletters, or product updates — only where you have opted in and only until you opt out.
  • To detect, investigate, and prevent fraud, abuse, security incidents, and breaches of our terms.
  • To comply with applicable laws, regulator requests, court orders, and our own legal obligations in Nigeria.
  • To analyse, in aggregated or de-identified form, how our services are used, so we can improve them.

8. WhatsApp and Instagram (Meta Platforms) — Specific Notice

We use the WhatsApp Business Platform and the Instagram Graph API, provided by Meta Platforms, Inc., to communicate with you and to operate parts of our automated customer service. This section sets out what that means for your personal data, in line with Meta's platform terms, the WhatsApp Business Messaging Policy, and Instagram's policies.

8.1 When and how we receive your data from Meta

  • We receive your data only after you initiate contact with us — for example, when you message our WhatsApp Business number, click a wa.me link, tap a “Send Message” button on our Instagram profile, or comment on or DM one of our Instagram posts.
  • We do not buy contact lists or import phone numbers you have not given us. We do not send unsolicited first-contact messages to people who have not opted in.
  • The data we receive may include your name, profile photo, WhatsApp/Instagram identifier, the message content, and any media (images, voice notes, documents) you choose to send.

8.2 What we do with WhatsApp and Instagram data

  • We use your message content and contact details to respond to you, qualify your enquiry, send you the information you asked for, and where relevant, hand the conversation over to a human team member.
  • We may store your messages, message metadata, and our replies in our customer database (hosted on our self-managed servers) so we can keep an accurate history of our conversations and provide consistent service.
  • We may use limited automation logs in aggregate form to improve reply quality, fix bugs, and measure how well our service is performing.

8.3 What we do NOT do with WhatsApp and Instagram data

  • We do not sell, rent, or otherwise commercialise the personal data we receive via WhatsApp or Instagram.
  • We do not share data obtained from WhatsApp or Instagram with third parties for their own independent marketing or advertising purposes.
  • We do not use WhatsApp message content to target you with advertising on other platforms.
  • We do not transfer your WhatsApp or Instagram data to data brokers, lead-generation aggregators, or any party that would use it outside the purposes described in this Policy.

8.4 Your control over messaging from us

  • You can stop receiving messages from us at any time by replying STOP, UNSUBSCRIBE, or “stop messages” to any of our WhatsApp or Instagram conversations, or by emailing us at the address in Section 2.
  • You can also block our number or account directly from within WhatsApp or Instagram. We will respect any such signal as an opt-out.
  • Once you opt out, we will stop sending you marketing and broadcast messages. We may still send essential transactional messages (for example, a receipt for a purchase you have already made) where this is required to deliver something you asked for or to comply with the law.

8.5 Meta's own role

Meta Platforms is a separate data controller for the data it processes about you as a user of WhatsApp and Instagram. Meta's own collection and use of your data is governed by its own privacy policies, which you can review at whatsapp.com/legal/privacy-policy and privacycenter.instagram.com/policy. We have no control over those practices.

9. How We Share Your Personal Data

We share your personal data only where we have a clear, lawful reason to do so. The categories of recipients are:

9.1 Service providers (data processors)

We use a small number of trusted service providers who process personal data on our behalf and under written instructions. Each is bound by appropriate confidentiality and data protection obligations. They include:

  • Payments: Paystack (Nigeria), Selar (Nigeria), and, where relevant, other licensed processors.
  • Messaging and communications: Meta Platforms (WhatsApp Business Platform, Instagram Graph API).
  • Hosting and infrastructure: Hostinger (KVM virtual servers), and the open-source tools we self-host on those servers (including n8n, PostgreSQL, and Redis).
  • Identity verification (only where required for a regulated service): Smile ID, Youverify, Dojah, NIBSS, or other licensed providers, used strictly for the stated verification purpose.
  • Analytics and product tooling: industry-standard analytics tools, used in aggregated or de-identified form wherever possible.

9.2 Professional advisers

Lawyers, accountants, auditors, and similar advisers, where this is necessary for compliance, dispute resolution, or proper business operation.

9.3 Regulators and law enforcement

We may disclose personal data to courts, regulators (including the Nigeria Data Protection Commission), and law enforcement agencies where we are required to do so by law, by binding court order, or in response to a valid legal request.

9.4 Business transfers

If Effortless Scale is involved in a merger, acquisition, restructuring, or sale of assets, personal data may be transferred as part of that transaction. We will notify affected data subjects in advance where the law requires us to.

9.5 With your consent

Where you have asked us to share your data with a specific third party (for example, a partner you are collaborating with through us), we will do so on your instructions.

10. International Data Transfers

Effortless Scale operates from Nigeria, and we keep our primary databases on infrastructure located outside of Meta's servers. However, some of our service providers — most notably Meta Platforms — store and process personal data on servers located outside Nigeria, including in the United States, the European Union, and other jurisdictions.

Where we transfer your personal data outside Nigeria, we do so only where:

  • The receiving country has been recognised by the NDPC or the relevant authority as providing an adequate level of data protection; or
  • We have put in place appropriate safeguards (such as Standard Contractual Clauses or equivalent) with the recipient; or
  • A specific lawful exception applies — for example, the transfer is necessary to perform a contract you have asked us to enter into, or you have given your explicit informed consent.

You may contact us at any time to request more information about the safeguards we use for international transfers.

11. How Long We Keep Your Personal Data

We keep personal data only for as long as we genuinely need it. The retention periods below are guidelines; the precise period in any given case depends on the nature of the data and the legal obligations that apply.

  • Customer transaction records: at least 6 years from the date of the transaction, in line with Nigerian tax and accounting requirements.
  • WhatsApp and Instagram conversation history: up to 24 months after the last interaction, unless you ask us to delete it sooner or a longer period is justified for legitimate business or legal reasons.
  • Marketing contact data: until you opt out, plus a short suppression record so we do not accidentally re-contact you.
  • Support tickets and feedback: up to 24 months after resolution.
  • Automation logs and diagnostic data: up to 12 months, then deleted or de-identified.
  • Identity verification records: as required by the licensed verification provider and the regulated activity in question.

When the retention period ends, we securely delete the personal data, or we de-identify it so it can no longer reasonably be linked back to you.

12. Your Rights

Both the NDPA and the GDPR grant you a strong set of rights over your personal data. We respect these rights regardless of where you are based, and the descriptions below apply to all our customers in Nigeria.

  • Right to be informed — to know what personal data we hold about you and how we use it. This Policy is part of how we meet that obligation.
  • Right of access — to ask us for a copy of the personal data we hold about you.
  • Right to rectification — to ask us to correct personal data that is inaccurate or incomplete.
  • Right to erasure (“right to be forgotten”) — to ask us to delete your personal data where there is no good reason for us to continue holding it.
  • Right to restrict processing — to ask us to limit how we use your personal data in certain circumstances.
  • Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format, or to ask us to transfer it to another organisation.
  • Right to object — to object to our processing of your personal data, in particular for direct marketing or where we rely on legitimate interests.
  • Right to withdraw consent — where we rely on your consent, you may withdraw it at any time, without affecting the lawfulness of any processing carried out before the withdrawal.
  • Right not to be subject to fully automated decisions — including profiling — that produce legal or similarly significant effects on you. Our automated WhatsApp and Instagram replies are not fully automated decisions in this sense; a human is always available on request.
  • Right to lodge a complaint — with the Nigeria Data Protection Commission (NDPC) or any other competent supervisory authority. See Section 20.

13. How to Exercise Your Rights

To exercise any of the rights described in Section 12, please contact us using the details in Section 2 (Who We Are). For most requests, an email or WhatsApp message is enough.

When you contact us, please:

  1. Tell us clearly which right you are exercising;
  2. Provide enough information for us to identify you (for example, the email or phone number you used to deal with us);
  3. Tell us, where relevant, exactly what data your request relates to.

We will respond to your request within 30 days of receiving it. Where a request is particularly complex or where you have made several requests, we may extend that period by a further 30 days, and we will tell you if so. We do not charge a fee for handling a reasonable request.

We may need to verify your identity before acting on a request, in order to protect your data from unauthorised disclosure.

14. How We Protect Your Personal Data

We take the security of your personal data seriously. The measures we use include:

  • Encryption of data in transit using HTTPS/TLS for our website, dashboards, and API endpoints.
  • Access controls that limit who on our team can see customer data, with role-based permissions and password rules.
  • SSH key authentication and restricted shell access on our servers, with logging of administrative actions.
  • Regular software updates and patching of our hosting stack, including the operating system, reverse proxy, database, and automation tools.
  • Backups of important data, stored securely and tested periodically.
  • Written confidentiality and data-protection commitments from third-party processors before we entrust them with personal data.

No security measure is perfect. If, despite our efforts, a personal data breach occurs and is likely to result in a risk to your rights and freedoms, we will notify the Nigeria Data Protection Commission, and where required, you directly, within the timeframes set by the NDPA and (where applicable) the GDPR.

15. Children's Data

Our services are intended for adult business users (18 years of age and above). We do not knowingly collect personal data from children under the age of 18 (or under the relevant age of digital consent in your jurisdiction).

If you believe that a child has provided personal data to us, please contact us using the details in Section 2 and we will take prompt steps to delete that data.

16. Cookies and Similar Technologies

When our website goes live, it may use cookies and similar technologies (such as pixel tags and local storage) to make the site work, remember your preferences, measure traffic, and where you have opted in, support marketing. The website will display a cookie notice the first time you visit, and you will be able to accept, reject, or manage non-essential cookies through that notice.

Our WhatsApp and Instagram conversations are not delivered through cookies on our side, but the platforms themselves may use cookies in the apps and web clients you use to access them, governed by their own policies.

17. Third-Party Links

Our messages, posts, and (when live) website may contain links to third-party websites, applications, or platforms (for example, Selar, Paystack, Notion, Gumroad, or news sources). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before sharing personal data with them.

18. Changes to This Policy

We may update this Privacy Policy from time to time — for example, to reflect changes in our services, in technology, or in the law. When we make a significant change, we will update the “Last Updated” date at the top of this Policy, and where appropriate, we will notify you directly through WhatsApp, Instagram, email, or a notice on our website.

We encourage you to review this Policy periodically to stay informed about how we protect your personal data.

19. How to Contact Us

If you have any questions, concerns, or complaints about this Policy or about how we handle your personal data, please contact us first. We will do our best to resolve the matter quickly and fairly.

  • Email: effortlessscale.ng@hotmail.com
  • WhatsApp / Phone: +234 (704) 700 4882
  • Instagram DM: @effortlessscale_ng
  • Postal address: 50 Olurunfumni Street, Off Olusosun Street, Ikeja, Lagos
  • Data Protection Officer / Compliance Contact: Kachi Mba, mbakachi208@gmail.com

20. Your Right to Complain to the NDPC

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC), Nigeria's independent data protection authority.

If you are located in the European Union or the United Kingdom, you may also lodge a complaint with the supervisory authority in your country of residence.

We would, however, appreciate the chance to address your concerns directly before you escalate them, and we encourage you to contact us first using the details in Section 19.