Legal
Privacy notice
Last updated: 26 October 2026
This notice explains how [IOKO Labs Ltd] ("Snowleaf", "we") handles personal data when you use snowleaf.xyz, apply for a pilot, subscribe to Field notes, or use the Snowleaf product. We follow the Nigeria Data Protection Act 2023 ("NDPA").
Who we are
[IOKO Labs Ltd], RC [ ], [registered address]. Contact for anything in this notice: hello@snowleaf.xyz. [Data protection officer, if the lawyer advises one is required: name and email.]
What we collect, and why
| What | When | Why (lawful basis under the NDPA) | How long |
|---|---|---|---|
| Name, work email, organisation, role, site type, how you record readings, your message | You apply for a pilot or write to us | To reply and discuss a pilot (steps before a contract / legitimate interest) | 24 months after our last contact, unless you become a customer |
| Work email | You subscribe to Field notes | Consent, which you can withdraw at any time | Until you unsubscribe |
| Name, work email, role, and sign-in records (each session's device and IP address) | You use the product | To provide the service (contract) and keep it secure (legitimate interest) | For the life of your account, then deleted 30 days after it closes, except invoices, which we keep as tax law requires |
| Your organisation's energy readings and reports | You or your organisation upload them | To provide the service (contract). This is mainly business data, not personal data | As set out in your contract and our data processing terms |
We do not sell personal data. We don't use it for advertising.
Cookies and analytics. We use only cookies that are strictly necessary for signing in and security. We don't use advertising or tracking cookies, so we don't show a cookie banner. [If analytics are added later, this section and the banner rules change.]
Who we share it with
Only service providers that help us run Snowleaf, under contracts that protect your data: the companies listed on our sub-processors page, each with what it does and the data it sees. Pilot applications and field-note sign-ups arrive by email; no form or newsletter service sees them. We share data with authorities only when the law requires it.
Where it is stored
Your data is stored in Germany: the database with Neon in Frankfurt, the application on a Hetzner server, and uploaded files in Cloudflare R2’s EU region. If your data is transferred outside Nigeria, we do so only on a basis the NDPA allows [adequacy, appropriate safeguards — lawyer to specify].
Your rights
Under the NDPA you can ask us to: tell you what we hold; correct it; delete it; restrict or object to how we use it; give it to you in a portable format; and withdraw consent where we rely on it. Email us and we will reply within 30 days. You can also complain to the Nigeria Data Protection Commission (ndpc.gov.ng).
Security
We protect personal data with access controls and encryption, and limit access to people who need it. Our security page lists each measure and its status. If a breach is likely to put your rights at risk, we will tell the NDPC within 72 hours and tell you without undue delay.
Changes
We'll post changes here and update the date above. If a change is significant, we'll email affected users.