1. Who we are
Kedova is provided by Korevra Technologies Limited (RC 9471172), 12B Sule Abore Street, Ojodu, Lagos State 101233, Nigeria (“Korevra”, “we”). For the personal data described in this policy, Korevra is the data controller.
2. What this policy covers
This policy covers personal data about people who visit this website, sign up for or use Kedova, or contact us. It does not cover the audience data our customers bring into their workspaces — their contacts, subscribers, followers and the people who message them. For that data, the customer is the controller and Korevra acts as their processor under the data processing agreement. If you are part of a Kedova customer’s audience, please contact that business about your data; we will help them respond.
3. Data we collect
- Account data: name, email address, phone number, role, organisation and workspace membership. Sign-in is handled by Firebase Authentication; we do not see your password.
- Notification preferences: your WhatsApp number and your consent to receive approval messages, digests and alerts, if you turn them on.
- Workspace content: your website content, documents, brand kit, plans, drafts, approvals, comments and reports. This can include personal data, such as names of staff in your documents.
- Connected-account credentials: tokens and keys for the accounts you connect, stored encrypted with a key unique to your workspace.
- Billing data: plan, invoices and payment status. Payments are processed by Flutterwave or Paystack; we do not receive or store full card numbers.
- Usage and device data: log records such as IP address, browser, pages and actions in the app, timestamps and errors, used to run and secure the service.
- Communications: messages you send us by email, WhatsApp or in the app.
This marketing website does not set cookies and does not use analytics or advertising trackers. See the cookie policy.
4. How we use it, and our lawful bases
| Purpose | Lawful basis under the NDPA |
|---|---|
| Creating your account and providing Kedova | Performance of a contract |
| Billing, invoicing and tax records | Contract; legal obligation |
| Approval notifications, digests and alerts by email and WhatsApp | Contract; consent for WhatsApp messages |
| Security, fraud prevention, abuse handling and audit logs | Legitimate interests; legal obligation |
| Support and service communications | Contract; legitimate interests |
| Improving Kedova using aggregated, de-identified usage information | Legitimate interests |
| Product news and marketing emails to you | Consent, which you can withdraw at any time |
| Complying with law and responding to lawful requests | Legal obligation |
Where we rely on legitimate interests, we have balanced them against your rights and expectations. You can object at any time (see section 10).
5. AI processing
To draft, check and illustrate your marketing, Kedova sends the relevant workspace content to AI providers — Anthropic for writing and reasoning, and Google Vertex AI for images and embeddings — through their business APIs. We send only what each task needs. Under their commercial terms, these providers do not use that content to train their models.
Kedova does not make decisions about individuals that produce legal or similarly significant effects. People review what it drafts and decide what is published.
6. Who we share it with
- Service providers who process data on our behalf under contract, listed on our security page: Google Cloud and Firebase, Anthropic, Google Vertex AI, Flutterwave, Paystack and Meta (WhatsApp Cloud API).
- Platforms you connect, when you ask Kedova to publish or read on your behalf.
- Professional advisers, such as lawyers, auditors and insurers, under duties of confidentiality.
- Authorities, when the law requires it or to protect rights, safety and property.
- A successor in a merger, acquisition or reorganisation, subject to this policy.
We do not sell personal data.
7. Transfers outside Nigeria
Kedova is hosted on Google Cloud in the europe-west1 region (Belgium), and some providers process data in the United States and elsewhere. When personal data leaves Nigeria, we rely on the grounds in Part VIII of the NDPA and the GAID, such as an adequate level of protection in the destination or appropriate safeguards, including contractual clauses with our providers. Enterprise customers can ask about in-country data residency.
8. How long we keep it
- Account and workspace data: for as long as your account is active. When a subscription ends, workspace data stays readable for 30 days so it can be exported, then it is deleted. When you delete your account, your login is deleted; if you own an organisation, its data is deleted after 30 days.
- Billing records: for as long as tax and company law requires, generally six years.
- Security and audit logs: for up to 12 months, unless needed longer to investigate an incident.
- Market signals gathered for intelligence briefs keep only public headlines and links, and expire after 90 days.
- Backups are overwritten on a rolling basis.
9. Security
We use technical and organisational measures appropriate to the risk, including workspace isolation enforced on the server, encryption in transit and at rest, per-workspace encryption of connected-account tokens with keys held in Google Secret Manager, role-based access and audit logging. No system is perfectly secure; if a personal data breach is likely to put your rights at risk, we will notify you and the Nigeria Data Protection Commission as the NDPA requires. Read more on our security page.
10. Your rights
Under the NDPA you have the right to:
- be informed about how your personal data is used, and to access a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data erased, and to restrict processing, in the circumstances the law provides;
- object to processing based on legitimate interests, and to direct marketing at any time;
- receive your data in a commonly used, machine-readable format, and have it transmitted to another controller (portability);
- withdraw consent at any time, without affecting processing done before you withdrew it;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects.
You can export your workspace and delete your account in the app. For anything else, email hello@korevra.com with “Data protection request” in the subject. We may need to verify your identity, and we will respond within the time the law allows.
11. Children
Kedova is for businesses and professionals and is not intended for anyone under 18. We do not knowingly collect personal data from children.
12. Contact and complaints
Our data protection contact can be reached at hello@korevra.com (subject “Data protection”) or at Korevra Technologies Limited, 12B Sule Abore Street, Ojodu, Lagos State 101233, Nigeria.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the Nigeria Data Protection Commission (NDPC).
13. Changes to this policy
We will post any changes here and update the date above. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect.