Privacy notice

Who is speaking

Asiri Compliance Ltd, a Nigerian company, operates asiri.ng, app.asiri.ng and the Asiri mobile apps. For the account you hold with us and for this website, we are the data controller.

For the records our customers keep inside their workspaces — their registers, their evidence, their people — the customer is the controller and Asiri processes on their instructions under the data processing agreement. This notice is about what we collect about you; what a workspace holds about its own data subjects is governed by that workspace’s own notice.

What we collect, and why

Your account: your work email address, your name, and — if you set them — a short name and job title. The email address is the account; sign-in works by a six-digit code sent to it, so there is no password for us to hold or lose.

Your sessions: when you sign in we record the platform, a device label if your client offers one, and the city and country your connection resolved to — never the full network address. This exists so the sessions page can answer “was that me?”, and so a session you do not recognise can be ended.

Your device, if you allow notifications: a push registration token, the platform, and the app version, so statutory clocks and messages can reach your lock screen. The registration is retired when you sign out.

Billing, where you are the person who pays: the billing contact and the amounts, processed by our payment provider in Nigeria.

Support and contact: what you write to us, kept with the ticket it belongs to.

What we deliberately do not do

We do not sell personal data, and we do not use your data to advertise to you.

The product’s assistant, Eri, answers from your registers. The facts we assemble and send carry no personal data, and nothing is used for training. The question you type is sent as you wrote it — screened first, so an email address, a phone number or a long identifying number is refused rather than sent. A name written into a question as ordinary prose is not something that screen can catch, so treat a question as something that leaves us. This is stated with the rest of our sub-processor facts on the trust page, where changes to it are announced as changes.

Error reports are scrubbed before they leave our infrastructure; a stack trace has never carried a customer field.

Where it goes

Asiri is hosted with Amazon Web Services in Cape Town, South Africa — the nearest region AWS operates to Nigeria. That is a transfer out of Nigeria, and we treat it as one: assessed, with contractual safeguards in place, rather than described as local.

The full list of companies that process data on our behalf — who they are, what they do, what they can see, and where they are — is published and kept current at asiri.ng/trust. When the list changes, the change is announced there with notice, not slipped in.

How long we keep it

Your account exists while you hold it. Sessions expire on their own and expired session records are swept; sign-in codes die within minutes of being issued and are deleted once spent or stale.

Workspace content follows the workspace: retention inside a workspace is set by its own controls, and when a workspace is deleted its deletion runs through a recorded request made by its owner. Every workspace can export the whole of its own data first, without charge.

Your rights

The Nigeria Data Protection Act 2023 gives you the right to know what we hold about you, to have it corrected, to have it deleted where nothing lawful requires us to keep it, to receive a copy, and to complain to the Nigeria Data Protection Commission.

Write to security@asiri.ng and we will answer as the Act requires. We will ask you to confirm you control the email address the account is held under, because answering anyone else would itself be the breach.

Cookies

The application uses a single strictly-necessary session cookie — it is how you stay signed in, and it does nothing else. It is not used to track you across other sites.

Changes

This notice is effective from 25 August 2026. If it changes materially, the change will be announced to account holders before it takes effect, and the previous wording remains available on request.