Privacy Policy

This Privacy Policy will be reviewed annually to ensure compliance with applicable data protection laws and regulations in all jurisdictions where the Services are provided, including but not limited to the Nigeria Data Protection Act (NDPA), 2023, and where applicable, US state privacy laws. Nonetheless, we are continually improving our methods of communication and adding new functionalities and features to our website and existing services. Because of these ongoing changes, changes in the law and the changing nature of technology, our data protection practices will change from time to time. If and when our data protection practices change, we will update this Policy to describe our new practices and publish them on our website and applications.

Citruss has two kinds of users, and our responsibilities differ depending on which one you are.

2.1. Professionals. People and businesses who create a Citruss account to publish a booking page, set their availability, list services and receive payments. Coaches, creators, freelancers, consultants, agencies, service businesses and their team members. For information about Professionals, we are the data controller.

2.2. Clients. People who visit a Professional's booking page at citruss.app/[username], book a service and make a payment. Clients book as guests and do not hold a Citruss account. For information a Client submits when booking, the Professional is the data controller and we act as a processor on their behalf.

2.3. If you are a Client, the Professional you booked with decides what they collect from you, how long they keep it and what they do with it. Their own privacy notice applies. If you want your booking information corrected or deleted, contact the Professional first. If you contact us instead, we will pass the request on to them. We do use limited information about bookings for our own purposes as a controller, specifically to operate and secure the Services, send transactional communications such as booking confirmations and appointment reminders, prevent fraud and abuse, and meet our legal obligations.

2.4. Visitors. Anyone who browses usecitruss.com or contacts us without creating an account. We are the controller for that information.

We are committed to informing and limiting the collection of essential personal information.

We can get your personal information when you:

3.1. Register a Citruss account as a Professional, providing your name, email address, phone number and chosen username (your public handle at citruss.app/[username]).

3.2. Set up your booking page, including your display name, business name, profile photo, bio, tagline, professional category, social media handles (Instagram, TikTok), WhatsApp number, contact email, location and time zone.

3.3. Configure your booking settings, including your services (name, description, price, currency, duration, delivery method and meeting link), your recurring weekly availability, buffer between sessions, minimum notice and how far ahead clients can book.

3.4. Add team members to your account, providing their names, email addresses, phone numbers, job titles, bios and availability.

3.5. Connect a payment provider. Payments are processed by Paystack for Professionals in Nigeria (NGN), Ghana (GHS), Kenya (KES), South Africa (ZAR), and Côte d'Ivoire (XOF). We do not store full card numbers or bank credentials. We hold your connected provider type, payout account status (bank name and last 4 digits of the account number), transaction references, amounts, currencies, platform fees, payout history and your payout schedule.

3.6. Make or receive a booking. When a Client books a Professional, we collect the Client's name, email address, phone number (if the Professional asks for it), the service selected, the date and time chosen, the assigned team member where applicable, any notes added, and the payment outcome.

3.7. Subscribe to newsletters or other communications from us, ask us for more information, or contact us with a question or complaint.

3.8. Take part in a promo or survey.

3.9. Visit, browse or use our website, booking pages or other platforms. We automatically collect device and connection data (IP address, browser type, operating system and device identifiers), usage data (pages viewed, features used, booking page views and their referral source such as Instagram, TikTok or a direct link, service taps and session timestamps), and approximate location derived from your IP address for currency defaults, time zone handling and fraud prevention. We do not collect precise device location.

3.10. With your permission or consent and/or as permitted by law, we may also collect information about you from other organisations or third parties if this is appropriate and allowed by law. These include Paystack (payment and verification status), our email provider, error monitoring tools, and social login providers such as Google.

We might use cookies (small text files in your browser) and other techniques such as pixels and local storage. These collect information that makes the website remember you and tells us how you use our website, booking pages and services.

This, in turn, helps us make the Services relevant to your needs. They also help us find information once you have logged in, or help us link your browsing information to you and your personal information, for example when you choose to register. We may use a persistent cookie (that stays linked to your browser) to record your details so we can recognise you if you visit again.

Your cookie preferences, including whether you accept or reject cookies, may also be stored to remember your choice for future visits.

Strictly necessary cookies are required for the Services to work, including login sessions, security and load balancing. These cannot be switched off. Functional cookies remember preferences such as language, currency and time zone. Analytics cookies help us understand how people use the Services so we can improve them. Error monitoring tools, including Sentry, collect anonymised error and performance data so we can detect and fix platform issues. Advertising cookies, where used, measure and deliver ads about Citruss on other platforms.

Cookies by themselves cannot be used to discover your identity. Cookies do not damage your computer. You can set your browser to notify you when you receive cookies. This enables you to decide if you want to accept them or not. Where required by law, we ask for your consent before setting non-essential cookies, and you can change your choices at any time. If you choose not to accept cookies from our website, this may limit its functionalities or performance. We honour Global Privacy Control and similar opt-out preference signals where they apply.

We may use and analyse your information to:

5.1. Register and maintain your account and publish your booking page at citruss.app/[username].

5.2. Process bookings, manage availability and notify you of new bookings, cancellations and schedule changes.

5.3. Process and facilitate payment for services booked on the platform, through Paystack in the Professional's currency (NGN, GHS, KES, ZAR, or XOF), and calculate and send payouts to a Professional's connected account.

5.4. Send booking confirmations, appointment reminders (the day before and two hours before a session), payment receipts, payout notices, security alerts and changes to our terms. Appointment reminders are sent by email. On a Pro account, when the Client provided a phone number, we also send those reminders on WhatsApp from Citruss. That message is about the appointment with the Professional. We do not read or reply to WhatsApp chats.

5.5. Send Clients who started checkout but did not finish payment a reminder within about five minutes, again the following day, and again about three days later.

5.6. Send Clients a request to review a session after it is completed.

5.7. Show Professionals how their page is used, including page visits, service taps, bookings and where visitors came from.

5.8. Understand how you use our platforms, products and services, so we can develop more relevant products and services and personalise what we offer you.

5.9. Authenticate users, verify identity, and ensure that the data provided is credible.

5.10. Prevent and detect fraud, double bookings and illegal activities.

5.11. Provide customer support, including responding to your enquiries or complaints.

5.12. Comply with all applicable laws and regulations.

5.13. Develop, improve, enhance, modify, add to and further develop our services.

5.14. Fulfil our obligations or claim our rights in legal proceedings.

5.15. Contact you through your telephone number, email address or other contact details.

5.16. Use or disclose it as otherwise authorised or permitted by law.

5.17. For any other purpose with your consent.

You accept this Policy when you sign up and use any of our platforms, products and Services. You also consent to the collection and processing of your personal information (which includes but is not limited to your name, email address, telephone number and booking details) and any other information for the purpose of providing the Services. If you decide to opt out of any of the Services or withdraw consent for the processing of your personal information, you can do so by reaching out to us at legal@usecitruss.com. This Policy governs the use of the Citruss Services and if you are not comfortable with us processing your data, you may not use our Services.

The lawful basis for processing your data is consent, performance of our contractual obligations, compliance with our legal obligations, and our legitimate business interests. The personal data we collect and process in order to fulfil our contractual obligations to you includes, but is not limited to, your name, email address and phone number for confirming and fulfilling bookings, and payment records needed to take payment and pay Professionals. Where processing is based on your consent, you have the right to withdraw such consent at any time.

8.1. Payments on Citruss are processed by Paystack for Professionals in Nigeria (NGN), Ghana (GHS), Kenya (KES), South Africa (ZAR), and Côte d'Ivoire (XOF). When you pay or get paid through Citruss, your card and bank details are collected and processed directly by Paystack under its privacy policy at paystack.com/privacy.

8.2. We do not store full card numbers or bank credentials on Citruss systems. We receive and store limited payment records, including the amount, currency, transaction reference, payment status, platform fee, and whether a charge was a deposit or the balance of a booking.

8.3. Professionals receiving payouts may need to give identity and business information to the payment processor to meet know-your-customer and anti-money-laundering requirements. That information goes to the processor. We receive the verification status, not the underlying identity documents.

9.1. Citruss will not sell or rent your information to third parties. However, we may disclose your information to:

a) Our hosting and database provider, with servers in Ireland, and other infrastructure providers who operate the platform on our behalf.

b) Our payment processor, Paystack, to process payments and payouts.

c) Our email provider, to send booking confirmations, reminders, review requests and account messages.

d) Our error monitoring provider, for anonymised information used to keep the platform stable.

e) The Professional whose service a Client has booked, so they can confirm and provide the appointment. The Client receives the Professional's booking confirmation and the contact details needed for that booking.

f) Team members on a Professional's account, where a booking is assigned to them or the account owner has made it visible.

g) Integrations a Professional chooses to connect, such as a calendar or video meeting tool, limited to what that connection needs.

h) Law enforcement agencies, regulatory organisations, courts or other public authorities if we must, or are authorised by law.

i) Protect us if it is reasonable against fraud, defending our rights or property, or to protect the interests of our users.

j) Investors, financial advisers or auditors, and parties to a merger, financing or sale of the business, subject to confidentiality.

k) Any other person, where you have asked us to or the law allows it.

l) Meta, to deliver a WhatsApp appointment reminder from Citruss to a Client who gave a phone number on a Pro booking. We send that reminder. We do not receive or read WhatsApp conversations.

9.2. Citruss will comply with its obligations under the relevant data protection law in relation to any such disclosures, including using reasonable commercial efforts to ensure that such third parties only use your personal information as reasonably required for the purpose of disclosure and in a manner consistent with the privacy legislation. For example, where commercially practicable, by including suitable privacy and confidentiality clauses in our agreement with those third parties.

9.3. Professionals can update account and page settings at any time while logged into Citruss.

We protect your information using physical, technical and administrative security measures to reduce the risks of loss, misuse, disclosure, alteration and unauthorised access.

Personal information is stored on servers in electronic databases which are located in Ireland and managed by our hosting provider and related vendors. We will ensure that your information is protected and that they only process your information in the way we have authorised them to. These organisations will not be entitled to use your personal information for their own purposes unless authorised by you. Where such cross-border transfers occur, we will ensure that they are carried out in accordance with applicable data protection laws and that appropriate safeguards are implemented to protect your personal data.

We have put in place physical, technical and administrative measures to safeguard the information that we collect. These include encryption in transit and at rest, access controls that limit who can view personal information, and monitoring for errors and abuse. Our website uses HTTPS to protect information sent between your browser and our site.

We will never ask for your password or payment details by unsolicited email, text or phone call. You are responsible for keeping your personal and account information secure and not sharing it with others. We shall not be liable for any unauthorised access or loss of personal and account information caused by you sharing your login details.

Citruss serves users in Nigeria, Ghana, Kenya, South Africa, Côte d'Ivoire, and elsewhere. Your information may be processed in countries other than where you live, including Ireland, where our database is hosted, and in the countries where Paystack and our other providers operate. Where we transfer personal information out of Nigeria, the EEA or the UK, we rely on a lawful transfer mechanism, such as an adequacy decision or standard contractual clauses, as required by the law that applies. You can ask for a copy of those safeguards by emailing legal@usecitruss.com.

We keep personal information only for as long as we need it for the purposes in this Policy, or for as long as the law requires.

11.1. Account and profile information is kept for the life of the account, then deleted or de-identified within 90 days of account closure, except where a longer period below applies.

11.2. Booking records are kept for seven (7) years from the date of the booking.

11.3. Payment, transaction and payout records are kept for seven (7) years from the transaction or payout date, in line with tax and accounting requirements.

11.4. Marketing contacts are kept until you unsubscribe. We then keep a record that you opted out so we do not contact you again.

11.5. Support correspondence is kept for three (3) years from the last message. Security and access logs, and analytics and usage data, are kept for twelve (12) months. Backups are overwritten on a rolling thirty (30) day cycle.

11.6. We may keep information for longer where we need it to comply with a legal obligation, resolve a dispute, or establish or defend a legal claim. When personal information is no longer required, we will take reasonable steps to delete it or de-identify it.

We may occasionally contact you with product updates, tips and offers from us. You consent to us sending you such information, including by email and other digital channels, when you subscribe to marketing communications from Citruss or where the law allows us to write to existing users.

If at any time you decide you do not wish to receive marketing communications from us, you may click the unsubscribe link in the marketing emails or email legal@usecitruss.com. If you opt out of receiving marketing communications from us, we may still contact you with messages that are not promotional, such as booking confirmations, appointment reminders, receipts and security notices.

We do not add a Professional's Clients to Citruss marketing lists. Client contact details collected through a booking page are used to run that booking, not to market Citruss to the Client.

Our website and booking pages may contain hyperlinks to websites or services of third parties that we do not operate, including social platforms, video meeting tools and payment pages. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement. While we take appropriate care when publishing links, you decide whether to follow them. Citruss does not control those sites or their privacy practices. We urge you to review any privacy statement posted on any site you visit before using the site or providing any personal information.

14.1. Under the law, you have the right to access, correct, amend and delete your personal information or object to processing of your personal information.

14.2. You may make any of the following requests in respect of your personal information within our custody:

a) confirmation of the personal information we hold about you;

b) access to the personal information we hold about you;

c) correction of or updates to the personal information we hold about you;

d) erasure of your personal information that is no longer necessary for us to provide the Services or for our normal business operations, unless an exception applies;

e) data portability. In some circumstances you may ask us to provide a copy of the personal information we hold about you in a structured, machine-readable and commonly used format;

f) restriction of processing in the circumstances the law allows;

g) withdrawal of consent, where we rely on your consent;

h) if you are in Nigeria, a complaint to the Nigeria Data Protection Commission;

i) if you are in the United Kingdom, a complaint to the Information Commissioner's Office;

j) if you are in the European Union, a complaint to your national supervisory authority;

k) if you live in a US state with a comprehensive privacy law, including California, the rights that law gives you to know, correct, delete and opt out of sale or sharing of personal information. We do not sell personal information. If we refuse a request, you may appeal by emailing legal@usecitruss.com with the word Appeal in the subject line.

14.3. You can make any of the above requests by contacting us at legal@usecitruss.com. We may ask you to provide suitable identification when you seek to make any of these requests, to verify your identity. We will respond as soon as we can, and in any case within the time the applicable law allows. If we are unable to comply with your request, we will tell you why.

14.4. If you are a Client and your request is about a booking with a Professional, that Professional is the controller of the booking information. Contact them first, or contact us and we will pass the request on.

14.5. Professionals can update most profile and account information from Settings and My Page in Citruss. Professionals can also delete their account from within Citruss. If you delete your account, your public booking page is taken down, and we will retain personal information in accordance with section 11.

14.6. Citruss may retain your personal information after you have asked us to delete it if:

a) there is an ongoing investigation or unresolved issue relating to your account, such as an outstanding payout or an unresolved claim or dispute;

b) we are required to by any applicable law; and/or

c) it is necessary for our legitimate business interests, such as fraud prevention and user safety; or

d) our retention periods in section 11 still apply.

Citruss is for people running a professional practice or a service business. The Services are not directed at children, and we do not knowingly collect personal information from anyone under 16. You must be at least 18 to create a Citruss account and take payments. If you believe a child has given us personal information, email legal@usecitruss.com and we will delete it.

In compliance with the Nigeria Data Protection Act (NDPA) 2023, you may contact us regarding any issue related to this Privacy Policy or your personal data at legal@usecitruss.com. CROFT TECH LTD is based in Lagos, Nigeria.

This Policy is governed by the laws of the Federal Republic of Nigeria. Where any provision of this Policy is deemed inconsistent with a law, regulation or convention, such provision shall be subject to the overriding law, regulation or convention.

This Policy applies to all Users of the Services provided by Citruss, and to anyone else who contacts Citruss or otherwise submits information to Citruss.

CROFT TECH LTD, a company registered in the Federal Republic of Nigeria under RC 1639565, Lagos, Nigeria.

Email: legal@usecitruss.com.