Privacy Policy

Njiwa ("we", "us") is the data controller for the personal data described in this policy: we decide why and how it is processed.

For anything about your data, including the rights in section 10, contact our privacy team at privacy@njiwa.tech. Where the law of your country requires us to appoint a data protection officer or a local representative, their contact details are available from the same address.

This policy applies to:

• our website at https://njiwa.tech, including the business access request form;
• the Njiwa app at https://app.njiwa.tech, used by contributors, reviewers and our staff;
• emails and other messages we exchange with you.

It explains what we collect, why, who we share it with, how long we keep it, and the choices and rights you have. Using the app is also governed by our Terms of Service.

Voice recordings are personal data. A recording can identify you, and it can reveal characteristics such as your accent, approximate age, gender, regional or ethnic origin, or aspects of your health. In some countries this makes it sensitive or special category data. We therefore only process contributions with your explicit, separate consent, which you give by ticking a dedicated box before you can submit any work. That box is never pre-ticked and is separate from accepting the Terms of Service.

When you give that consent, you agree that we may:

• record, store and process your voice recordings and written submissions;
• show them to other contributors and reviewers on the platform, and to our staff, so their quality can be checked;
• clean, segment, label, transcribe, translate and otherwise annotate them;
• combine them into datasets and license those datasets to third parties, such as companies, research institutions and non-profits building language technology;
• use them, and allow licensees to use them, to train, test and improve artificial intelligence and machine learning systems, including speech recognition, speech synthesis, translation and language models.

We protect contributors in the following ways:

• We do not include your name, email address, payment details or other account data in datasets. Contributions are linked only to a random contributor identifier and the language information needed to use the data.
• We do not create voiceprints or use your voice to identify or authenticate you.
• Our licences forbid customers from trying to identify contributors, and from using a contributor's recordings to imitate or clone that specific person's voice in a way that could impersonate them.
• You must not say personal details (yours or anyone else's), such as full names, addresses or phone numbers, in a recording unless a task explicitly asks for fictional examples. Reviewers reject submissions that do.

You can withdraw this consent at any time (see section 11). Reviewers who never submit contributions do not need to give it.

Data protection laws require a legal reason, or "basis", for each use of personal data. Depending on where you live, these are set by laws such as the EU and UK GDPR, Nigeria's Data Protection Act 2023, Kenya's Data Protection Act 2019, South Africa's POPIA, Ghana's Data Protection Act 2012, and similar laws elsewhere.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 10). We do not use your data for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Submissions are accepted or rejected by human reviewers. The reviewer trial is scored automatically against a reference answer; if you fail it you can retake it, or ask us for a human review.

• Other platform users. Reviewers see the contributions they review, but not your name, email or payment details.
• Dataset licensees. Customers who license our datasets receive contributions, as described in section 4, under written licences that restrict their use. We do not give them your account or payment data.
• Service providers who process data on our behalf under contracts requiring confidentiality and security: our database, authentication and file storage provider (Supabase), our website hosting providers, Google (sign-in with Google, and web fonts on our sites), Make.com (handling business access requests), our email provider, and payment or mobile money providers used for payouts.
• Professional advisers such as lawyers, accountants and auditors, under confidentiality duties.
• Authorities when the law requires it, or where needed to protect someone's safety or prevent fraud.
• A buyer or successor if Njiwa is merged, acquired or reorganised. This policy, and the commitments in it, would continue to apply to your data.

We do not sell your account details or contact information. Licensing datasets of contributions is the core purpose of the platform and only happens with your consent. Some laws, such as California's, may treat this as a "sale" or "sharing" of personal information; you can opt out at any time by withdrawing your consent.

Our team, providers, servers and licensees may be in countries other than yours, including countries whose data protection laws differ from your own. When we transfer personal data across borders, we use the safeguards your law requires, such as:

• transfers to countries recognised as providing adequate protection;
• standard contractual clauses approved by the European Commission or the UK, or equivalent contracts recognised under Nigerian, Kenyan, South African and other laws;
• binding written commitments from our providers and licensees to protect the data;
• your explicit consent, where the law allows it and no other safeguard is available.

You can ask us for more information about these safeguards at privacy@njiwa.tech.

• Data is encrypted in transit (HTTPS) and at rest by our storage provider.
• Recordings are kept in private storage. They can only be played through short-lived signed links, and only by you, the reviewers checking them, and authorised staff.
• Database access rules restrict every user to the data their role needs.
• Staff access is limited to people who need it to run the platform.

No system is perfectly secure. If a breach puts your rights at risk, we will notify you and the relevant authorities within the time limits set by law, for example within 72 hours of becoming aware of it where the GDPR or Nigeria's Data Protection Act applies.

Depending on where you live, you have some or all of these rights:

• Access: get a copy of the personal data we hold about you.
• Portability: receive your data in a machine-readable format.
• Correction: have inaccurate data corrected. You can change your languages yourself at any time.
• Deletion (erasure): have your data deleted.
• Withdraw consent: at any time, without affecting processing that took place before.
• Objection and restriction: object to processing based on legitimate interests, or ask us to limit how we use your data.
• Not to be discriminated against for exercising your rights.
• Complain to a data protection authority (see below).

How to exercise them:

• In the app, open Privacy and data from the menu. You can download a copy of your data, change your email preferences, and delete your account there.
• For everything else, including withdrawing consent and having your recordings and personal data deleted, email privacy@njiwa.tech from the address on your account (or the address that was on it, if you have already closed it). We may ask you to confirm your identity first. An authorised agent can act for you where your law allows it, with proof of their authority.

We respond within 30 days, or sooner where your law requires it. If a request is complex we may extend this where the law permits, and we will tell you why. Requests are free unless they are clearly unfounded or excessive.

Data protection authorities include the Nigeria Data Protection Commission, Kenya's Office of the Data Protection Commissioner, South Africa's Information Regulator, Ghana's Data Protection Commission, the supervisory authority in your EU country, the UK Information Commissioner's Office, and the California Privacy Protection Agency. We would appreciate the chance to resolve your concern first.

Closing your account and deleting your data are two separate steps.

Closing your account. You can close your account at any time in the app under Privacy and data. This ends your sign-in and removes your profile. We pay out your confirmed balance to the payout details you give us, even if it is below the usual $5.00 minimum; earnings still pending review are cancelled. Closing your account does not withdraw your consent: your contributions are kept and continue to be used as described in section 4, linked only to a random contributor identifier.

Withdrawing consent and deleting your data. To withdraw your consent and have your recordings, written submissions and other personal data deleted, email privacy@njiwa.tech at any time, for any reason, whether or not your account is still open. This is free of charge. Here is what happens:

• From the day we receive your request, we stop using your contributions in any new dataset or licence, and, if your account is still open, you can no longer submit or review work.
• Within 30 days, we delete your recordings, written submissions and personal data from our systems, close your account if it is still open, and confirm by email.
• If your account is still open, we pay out your confirmed balance, even if it is below the usual $5.00 minimum. Pending earnings for submissions that were not yet accepted are cancelled, because those submissions are deleted.
• We keep only what the law requires us to keep, such as payment records and the record of your consent and its withdrawal (see section 8).

Datasets already delivered. If your contributions were included in a dataset licensed to a customer before you withdrew consent, we will notify those customers and require them, under their licence, to delete your contributions from their copies where reasonably feasible. However, an AI model that has already been trained on data cannot always "forget" it. Withdrawing consent does not make processing that took place before the withdrawal unlawful. We tell you this up front so you can decide whether to contribute.

You must be at least 18 to use the app. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has signed up, contact privacy@njiwa.tech.

We use only what is strictly necessary to run our sites: the app stores your sign-in session in your browser. We do not use advertising cookies, cross-site tracking or third-party analytics.

Our sites load fonts from Google Fonts, which means Google receives your IP address when the page loads. If we ever add analytics or other non-essential cookies, we will ask for your consent first where the law requires it, and update this policy.

We will post any update on this page with a new effective date. If a change is material, we will tell you by email or in the app before it takes effect. If a change affects what you consented to, we will ask for your consent again, and we will not apply the change to your contributions unless you give it.

Privacy questions and requests: privacy@njiwa.tech. General support: support@njiwa.tech.