Privacy Policy

Last updated: 2026

1. Who we are

StackWeaver (“we,” “us”) operates stackweaver.cloud and related services. We are a compliance-engineering company serving regulated businesses in Nigeria and across Africa. This policy explains what we collect and why, in line with the Nigeria Data Protection Act (NDPA) and the GDPR where applicable.

2. Roles we hold

We act in two capacities:

  • Controller for website and inquiry data — we decide why and how it is processed.
  • Processor for engagement data processed on a client’s behalf, acting on their documented instructions under NDPA and GDPR.

3. What we collect

Inquiry data

Name, work email, company, and the details you share through forms or email.

Engagement data

Compliance evidence, controls, artifacts, and communications processed on a client’s behalf.

Website telemetry

Essential cookies and standard browser/device data needed to operate the site. No third-party ad tracking.

4. How we use it

  • To respond to inquiries and run engagements.
  • To deliver and support the StackWeaver platform and Partner Workspace.
  • To meet legal, regulatory, and contractual obligations.
  • To improve the site and services.

5. Sub-processors & transfers

We use a limited set of vetted sub-processors (authentication, database, email, monitoring). Where personal data is transferred outside Nigeria or the EEA, we rely on appropriate safeguards such as data processing agreements and standard contractual clauses. A current sub-processor list is available on request from privacy@stackweaver.cloud.

6. Your rights

Under NDPA and GDPR you may request access, correction, deletion, portability, restriction, and objection. Contact privacy@stackweaver.cloud. We respond within statutory windows (NDPA: 30 days; GDPR: one month).

7. Retention

  • Inquiry data — 24 months.
  • Engagement data — term of engagement plus 3 years.
  • Deletion requests — actioned within 30 days, subject to legal-hold exceptions.

8. Contact

Data Protection Officer: privacy@stackweaver.cloud

Privacy questions

Common questions

What is StackWeaver’s role — controller or processor?

For the website and your inquiries, StackWeaver is the data controller. For data processed during a compliance engagement on your clients’ behalf, StackWeaver acts as a processor under NDPA and GDPR, on your documented instructions.

Where is data stored and does it cross borders?

Data is stored on cloud infrastructure and may be processed in multiple regions. Where personal data leaves Nigeria or the EEA, we rely on transfer mechanisms including DPAs and standard contractual safeguards.

How do I exercise my data-subject rights?

Request access, correction, deletion, portability, or objection by emailing privacy@stackweaver.cloud. We respond within statutory windows (NDPA: 30 days; GDPR: 1 month).

Do you share data with third parties?

Only with vetted sub-processors needed to deliver the service, or where required by law. We do not sell personal data. A sub-processor list is available on request.

How long is data kept?

Inquiry data for 24 months; engagement data for the engagement term plus 3 years; deletion requests actioned within 30 days, subject to legal-hold exceptions.