Privacy Policy

1. Who we are

StackWeaver Cloud Solutions (“StackWeaver,” “we,” “us”), a business name registered with the Corporate Affairs Commission of Nigeria, operates stackweaver.cloud and related services. We are a compliance-engineering company serving regulated businesses in Nigeria and across Africa. This policy explains what we collect and why, in line with the Nigeria Data Protection Act (NDPA) and the GDPR where applicable.

2. Roles we hold

We act in two capacities:

• Controller for website and inquiry data — we decide why and how it is processed.
• Processor for engagement data processed on a client’s behalf, acting on their documented instructions under NDPA and GDPR.

3. What we collect

4. How we use it

• To respond to inquiries and run engagements.
• To deliver and support the StackWeaver platform and Partner Workspace.
• To meet legal, regulatory, and contractual obligations.
• To improve the site and services.

4a. Data from tools you connect

A workspace owner or admin can connect a tool such as Google Workspace or Microsoft Entra ID. An administrator of that tool approves StackWeaver's read-only access on the provider's own page. StackWeaver then reads the tool once a day, never changes anything in it, and keeps each result as evidence for the client's own compliance programme.

• What we access: the Google Workspace user directory, through the read-only permission admin.directory.user.readonly ("See info about users on your domain"), and, when you connect, your Google account's basic sign-in information (openid, email).
• Which fields we read: for each user, an opaque Google user id and whether they are a super administrator, enrolled in or required to use 2-Step Verification, suspended or archived, and when they last signed in. When you connect, we read your organisation's Google customer id, whether the connecting person is a super administrator, and the domain of the connecting account.
• What we keep: counts and opaque ids only, for example "12 of 14 active users are enrolled in 2-Step Verification". We do not store your users' names or e-mail addresses, and we never read Gmail, Drive, Calendar or any other Google service.
• How we use it: only to produce the compliance evidence shown to your workspace, and to the auditors or partners you choose to share it with. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train general artificial-intelligence or machine-learning models.
• Who can see it: people you give access to in your StackWeaver workspace. StackWeaver staff do not read it, except with your permission for support, for security investigations, or where the law requires it.
• How it is protected: the access token is encrypted at rest and is never shown again after you connect. All traffic uses HTTPS.
• Retention and deletion: Disconnect deletes the stored token and asks Google to revoke it. Evidence already collected stays as your audit trail for the engagement term plus 3 years, or until you ask us to delete it at [email protected] (actioned within 30 days). You can also remove StackWeaver's access at any time in your Google Admin console.

• What we access: the one Google Cloud project you choose, through the read-only permission cloud-platform.read-only ("View your data across Google Cloud services"), and, when you connect, your Google account's basic sign-in information (openid, email).
• Which fields we read: IAM policy bindings (to check whether any role is granted to allUsers or allAuthenticatedUsers), firewall rule names and source ranges (to check for ingress open to 0.0.0.0/0), Cloud Storage bucket names and their IAM policies (to check for public access), and the project's Cloud Audit Log configuration (to check whether Admin Activity and Data Access logging is on).
• What we keep: resource names and counts only, for example "2 firewall rules allow ingress from 0.0.0.0/0". We never read the data inside a bucket, a Compute Engine instance, or any other Google Cloud service, and we never read data from outside the one project you chose.
• How we use it: only to produce the compliance evidence shown to your workspace, and to the auditors or partners you choose to share it with. We do not use Google user data for advertising, we do not sell it, and we do not use it to develop, improve or train general artificial-intelligence or machine-learning models.
• Who can see it: people you give access to in your StackWeaver workspace. StackWeaver staff do not read it, except with your permission for support, for security investigations, or where the law requires it.
• How it is protected: the access token is encrypted at rest and is never shown again after you connect. All traffic uses HTTPS.
• Retention and deletion: Disconnect deletes the stored token and asks Google to revoke it. Evidence already collected stays as your audit trail for the engagement term plus 3 years, or until you ask us to delete it at [email protected] (actioned within 30 days). You can also remove StackWeaver's access at any time in your Google Cloud project's IAM settings or at myaccount.google.com/permissions.

StackWeaver's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• What we access: the Slack workspace a workspace owner or admin approves StackWeaver for, through the read-only bot scopes users:read, users:read.email and team:read.
• Which fields we read: each member's opaque Slack user id and whether they are an owner, admin, guest (restricted or ultra-restricted), deactivated, or have two-factor authentication on (when Slack makes that visible to a bot token). We never read messages, channels, files or direct messages.
• What we keep: counts and opaque Slack member ids only, for example "1 active owner/admin". We never store member names or e-mail addresses.
• How we use it: only to produce the compliance evidence shown to your workspace. We do not use Slack data for advertising, we do not sell it, and we do not use it to develop, improve or train general artificial-intelligence or machine-learning models.
• Retention and deletion: the same as above — Disconnect deletes the stored token and revokes the grant at Slack; evidence already collected stays as your audit trail. An admin can also remove the StackWeaver app from Slack's own Workspace Settings at any time.

The same rules apply: read-only access that an administrator of the tool approves, counts and opaque ids rather than names, use only to produce your evidence, no sale and no advertising, and removal by Disconnect or in the tool's own admin centre. The documentation page for each tool lists exactly what it reads.

5. Sub-processors & transfers

Our current sub-processors are listed on the Trust Center. Where personal data is transferred outside Nigeria or the EEA, we rely on appropriate safeguards such as data processing agreements and standard contractual clauses.

6. Your rights

Under NDPA and GDPR you may request access, correction, deletion, portability, restriction, and objection. Contact [email protected]. We respond within statutory windows (NDPA: 30 days; GDPR: one month).

7. Retention

• Inquiry data — 24 months.
• Engagement data — term of engagement plus 3 years.
• Deletion requests — actioned within 30 days, subject to legal-hold exceptions.

8. Contact

Data Protection Officer: [email protected]