Applies across Jóli Markets (Nigeria, Australia, United Kingdom, United States, Canada, South Africa, Ghana, Germany, France, and the United Arab Emirates). Same substance as in-app Settings → Legal. This is a product policy for transparency — not a substitute for advice from qualified counsel in each jurisdiction. Contact: hello@jolinaija.com
1. Who we are
Jóli is operated by Drewbie Ventures Ltd (RC 7411103, registered in Nigeria) (“we”, “us”) and provides an events, ticketing, messaging, and cash-gifting platform. This Privacy Policy explains how we collect, use, store, share, and protect personal data when you use the Service across: Nigeria, Australia, United Kingdom, United States, Canada, South Africa, Ghana, Germany, France, and the United Arab Emirates. It is designed to align with the Nigeria Data Protection Act 2023 (NDPA) and NDPR, GDPR / UK GDPR, Australia Privacy Act 1988 (APPs), Canada PIPEDA and applicable provincial laws, South Africa POPIA, Ghana Data Protection Act 2012, UAE Federal Decree-Law No. 45/2021 (PDPL), and US state privacy laws including California CCPA/CPRA where they apply. This in-app text is a product privacy disclosure for transparency—not a substitute for advice from qualified counsel in each jurisdiction.
2. Data we collect
Account data: account type (individual or organisation), display name, optional organisation category and legal name, contact person for organisation accounts, phone number and dial code, email, Market/location choice, profile photo, and authentication artefacts (hashed PIN, device trust tokens—not raw Face ID templates, which remain on-device where the OS provides them). Event & social data: events you create or attend (including Going / Pending / Past), guest lists, follow graph (who you follow and who follows you), digital invites, messages to Jo, and support notes. Messaging data: 1:1 and event group-chat content, attachments you send, reply metadata, membership in event rooms, invite tokens (e.g. getzurla.com/g/<token>), and read/receipt state when cloud messaging is enabled. Payment data: ticket and gift amounts, currency, FX disclosure snapshots, payout bank details (account name, number, bank), payment method type, and payment-provider references. We do not store full card PAN or CVV on Jóli servers. Card details you type or Autofill from your device are processed by payment partners (Flutterwave). When Apple Pay is offered — for diaspora Markets (e.g. Australia, United Kingdom, United States), including visits to Nigeria, or after a Nigeria resident leaves Nigeria — we receive tokenised payment references from Apple and our partners, not your full card number. Apple Pay is not offered to Nigeria locals while they stay in Nigeria. Location signals: Residence Market (settings); GPS hub (after permission); Discover explore city (browse-only, not written as GPS). Device & usage: device model, app version, approximate location if you enable it, IP address, crash logs, push tokens when notifications are enabled, and interaction analytics. We do not use cookies for advertising or tracking on any platform — preferences (theme, session continuity) and short-lived client caches are kept in on-device storage; see §17 for detail. When you are signed in, account, event, social, messaging, and payment records described above are stored on our application servers (Supabase Postgres) and related processors listed in §7 — they are not localStorage-only. On-device storage holds preferences, session continuity helpers, and caches that sync from or mirror the cloud store; it is not a substitute for your server-side account.
3. Why we process data (purposes & legal bases)
We process data to: create and secure accounts (including OTP on new device or after idle periods); set Market and gift currencies; personalise Home discovery (including GPS hub content and creators you follow); sell tickets and process gifts; pay hosts; operate messaging and invite links; send transactional push/email/SMS; prevent fraud, abuse, and money laundering; provide customer support; improve the Service; and meet legal obligations. Legal bases include contract performance, legitimate interests (security, product improvement balanced against your rights), consent (where required for marketing or precise location or push), and legal obligation. Marketing messages require opt-in where mandated (e.g. certain EU/UK/AU rules); you can opt out in Settings → Notifications.
4. Market, GPS & Explore (location model)
Residence Market is determined at signup from phone dial code or an explicit country pick and may be updated in Settings → LOCATION → Home country. It drives available send currencies (Nigeria: NGN only; other Markets: local send currency and/or NGN as configured) and default hub when GPS is off. GPS hub is set only after you grant / confirm location permission and appears in the Home location chip and Settings → Near you (GPS); it is not cycled by Discover city pills. Discover LOCATION pills let you browse other cities without changing your GPS hub or Market. Hosts receive Naira. FX rates shown before gift confirm are indicative mid-market references maintained by Jóli (not a live bank feed); the rate, spread, and fees disclosed at confirm are stored as part of the transaction record. Gift fee corridor is based on the currency you send, never GPS.
5. Messaging & cloud storage (Supabase)
Message bodies, attachment metadata, membership, read receipts, and invite tokens are stored in our application database (Supabase Postgres) with realtime delivery via Supabase Realtime when messaging is enabled for your account. Display-name colours in group chat are derived client-side from a hash of user id for readability; they are not a separate sensitive data category. You should assume other members of an event room can see messages you send there. Do not share secrets or payment card numbers in chat.
6. Push notifications (OneSignal)
When you enable notifications, we (or our push provider OneSignal) may process a device push token / player id, device type, and coarse app-state needed to deliver alerts. OneSignal delivers via APNs (iOS), FCM (Android), and web push where supported. Push is used for transactional alerts (e.g. new message, someone joined via your group invite, ticket/RSVP updates) and may deep-link into the relevant thread or screen. OneSignal is not the system of record for message content — that remains in Supabase (see §5). You can revoke permission in OS settings and limit categories in Settings → Notifications.
7. Sharing & processors
We share data with: payment partners (Flutterwave and banking rails for NIP payouts; Apple or Google only when you choose Apple Pay / Google Pay where offered); cloud hosting and database providers (Supabase, Vercel); push providers (OneSignal); media hosts for event covers, profile photos, and gift receipts (Cloudinary); identity and authentication providers (including Supabase Auth and, when you choose them, Google or Facebook Login); analytics when enabled (planned: PostHog — product analytics, not ads); and professional advisers. Facebook Login: if you tap Continue with Facebook, Meta authenticates you and provides Jóli with the identifiers and profile fields you authorise (typically name, email, and profile photo per your Facebook settings and Meta’s permissions). We use that data only to create or sign in to your Jóli account and to display your profile. You can revoke Jóli’s access in Facebook’s Apps and Websites settings; deleting your Jóli account (see §9) removes the linked Jóli profile independently. We may disclose data to regulators, courts, or law enforcement when legally required. We do not sell personal information for money. Under CCPA/CPRA, “sale”/“sharing” for cross-context behavioural advertising—if ever enabled—will be disclosed with opt-out controls.
8. International transfers
Data may be processed in Nigeria and in other countries where our providers operate. Where we transfer personal data from the EEA/UK/Switzerland or other regions with transfer restrictions, we use appropriate safeguards (such as Standard Contractual Clauses, UK IDTA/Addendum, or adequacy decisions) and conduct transfer risk assessments as required.
9. Retention & how to delete your data
We keep account data while your account is active. To permanently erase your Jóli account and request deletion of your personal data: (1) Sign in at https://getzurla.com → Settings → ACCOUNT → Delete account, or open https://getzurla.com/delete-account and type DELETE; or (2) Email hello@jolinaija.com with subject “Delete my Jóli account” and the email on the account. Step-by-step instructions (no sign-in required to read): https://getzurla.com/data-deletion. When erase succeeds, we permanently remove your login and anonymise profile faces; chat memberships and personal attendance linked to your identity are removed with the account. Transaction, payout, and AML-relevant records may be retained for periods required by financial and tax rules (often 5–7+ years depending on Market), with personal identifiers removed where practicable. Hosted event listings may remain with a “Deleted account” host name so guest tickets stay usable. Support chats and device logs are kept for shorter operational periods unless needed for disputes or security. On-device data is cleared when erase succeeds. Deletion is subject to legal retention overrides.
10. Security
We apply administrative, technical, and organisational measures including encryption in transit, access controls, and device authentication (Face ID/PIN/OTP). No method of transmission or storage is fully secure. You must protect your devices and codes.
11. Your rights
Depending on your Market, you may have rights to access, correct, delete, restrict, or object to processing; data portability; withdraw consent; and lodge a complaint with a supervisory authority (e.g. Nigeria NDPC, ICO UK, EU DPAs, OAIC Australia, OPC Canada, Information Regulator SA, Ghana DPC, UAE Data Office, California Privacy Protection Agency). You may also have rights to appeal decisions and to non-discrimination for exercising privacy rights (US state laws). Use Settings → Privacy Policy / in-app support to exercise rights. We will verify requests as required by law.
12. Children
The Service is not directed to children under 18 (or higher age of majority). We do not knowingly collect children’s data. If you believe we have, email hello@jolinaija.com and we will delete it where required.
13. Automated decisions
We may use automated rules for fraud scoring, sanctions screening, and rate limiting. Significant decisions with legal or similarly significant effects will include human review avenues where required by GDPR Art. 22 and similar laws.
14. Host plans & product analytics
Plan selection (Starter / Event Plus / Host Pro) and privilege unlocks may be stored with your account to enforce guest caps and features such as door scan. Operational metrics for authorised staff derive from live transaction ledgers (tickets, gifts, payouts). If we enable product analytics (e.g. PostHog), we will update this Policy and store nutrition labels before relying on that data.
15. Changes
We may update this Privacy Policy. The effective date appears at the top of the in-app document (Settings → Privacy Policy). Material changes will be highlighted in-app.
16. Contact
Privacy requests: email hello@jolinaija.com, or use in-app Zai and mark the message PRIVACY. Supervisory authorities in your Market remain available for complaints if we cannot resolve your concern.
17. No advertising cookies — on-device storage
Jóli does not use advertising, tracking, or cross-site cookies on any platform. Preferences (theme, session continuity) and short-lived client caches are kept in on-device storage: the mobile apps (iOS/Android, via Capacitor) store them in WebView / secure on-device storage, and the installable web app (PWA) uses browser storage (localStorage) scoped to your device only — never shared with third parties or used for advertising. Signed-in account, chat, event, and payment data live on our servers as described in §2 and §5; on-device copies are caches, not the sole copy. If we add product analytics (e.g. PostHog), it will be disclosed here first and will not use tracking cookies.