Privacy Policy

This policy describes how 9jatesters ("we", "us", "our") handles personal information when you visit our websites at 9jatesters.com, create an account, or take part in a user-testing session or AI-data contribution job.

It applies whether you are a tester, an AI-data contributor, a client running a test, or simply a visitor browsing the marketing pages.

Account data: your full name, email address, phone number, role (tester or client), and the password hash held by our authentication provider (Supabase).

Tester profile data: Bank Verification Number (BVN), bank account number, bank name, date of birth, gender, state of residence, languages spoken, device and network details, and a Paystack-verified account name.

Session data: screen + voice recordings you submit while testing a client's product, the transcripts and summaries our AI generates from them, and metadata such as timestamps and durations.

Annotation data: voice recordings, transcripts, and any text you produce while completing AI training-data jobs.

Payment data: payout amounts in naira, Paystack transfer references, and the limited card or account metadata Stripe or Paystack returns to us. We never receive or store your full card number or BVN copy — only what is needed to match and pay.

Technical data: IP address, browser user agent, and the cookies described in the Cookies section below.

BVN is a Central Bank of Nigeria identifier used by every Nigerian bank to verify the real identity of an account holder. We collect your BVN once, at onboarding, for the sole purpose of confirming with Paystack that the bank account you provided for payout belongs to you.

We never reveal your BVN to clients, AI-data buyers, or any third party other than our verification processor (Paystack). It is stored encrypted at rest and is only ever sent over TLS.

We do not perform credit checks, marketing, or any secondary use of your BVN. You may request deletion of your BVN at any time by emailing privacy@9jatesters.com — note that doing so disables payouts until you submit fresh verification.

Under the Nigeria Data Protection Regulation 2019 and the Nigeria Data Protection Act 2023, we process personal data on the following bases:

Performance of a contract: to operate the marketplace, route tests, pay testers, and deliver results to clients.

Consent: for marketing emails, optional demographic fields, and the use of session recordings in case studies (we ask separately for case-study consent).

Legitimate interests: fraud prevention, security monitoring, and product analytics that do not override your rights.

Legal obligation: tax reporting, AML record-keeping, and lawful requests from Nigerian regulators.

Clients only see what is necessary to act on your session: your first name, state, age band, language, device, and the redacted recording + summary. They do not see your BVN, full name, phone number, or bank details.

AI-data buyers receive your voice recordings under an anonymous contributor ID, plus the demographic stratification (state, age band, language). They never receive your name, contact details, or BVN.

Our processors: Supabase (auth + database hosting), Vercel (web hosting), Paystack (Nigerian payments + BVN verification), Stripe (international card billing for clients), Google Gemini (transcript + summary). Each is bound by data-processing terms compatible with the NDPR.

We will disclose data when legally compelled by a Nigerian court or regulator, and we will tell you about it unless prohibited from doing so.

Account and BVN verification data: for the life of your account plus 7 years after closure, to satisfy Nigerian financial-record-keeping obligations.

Recordings and transcripts: retained for as long as the underlying client engagement requires, then deleted within 90 days unless the recording is part of a buyer-licensed AI dataset (in which case retention follows the buyer's licence terms).

Marketing email subscriber lists: until you unsubscribe, plus 30 days.

You have the right to access the personal data we hold about you, correct it, request its deletion, restrict our processing, object to processing, and request a portable copy of it.

To exercise any of these rights, email privacy@9jatesters.com. We will respond within 30 days. You may also lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

Data in transit is protected by TLS 1.2+. Data at rest is encrypted using AES-256 by our hosting providers. Access to production data is limited to named engineers using SSO and audit-logged.

We will notify affected individuals and the NDPC within 72 hours of becoming aware of a personal-data breach likely to result in risk to your rights and freedoms.

We use a small number of strictly-necessary cookies for authentication (Supabase session cookies, our dev session cookie in non-production environments only) and Vercel's analytics. We do not use third-party advertising cookies.

Some of our processors (Supabase, Stripe, Google) operate servers outside Nigeria. Where data leaves Nigeria, we rely on contractual safeguards consistent with section 41 of the NDP Act 2023 and the NDPC's adequacy guidance.

We will post any material changes to this page and update the "last updated" date at the top. If a change materially reduces your rights, we will email registered users at least 14 days in advance.

Data Protection enquiries: privacy@9jatesters.com

General enquiries: hello@9jatesters.com

9jatesters operates within Nigeria. Mailing address available on request.