Privacy Policy

1Who we are

Lennoy is a conversational commerce platform that gives a business a digital employee — an AI teammate that answers customers, sells, collects payment, and arranges delivery inside Instagram, Messenger, and WhatsApp.

The Lennoy platform is operated by Lennoy Limited (RC 9883764), 10 Olusola Faronbi Street, Isolo, Lagos, Nigeria (“Lennoy”, “we”, “us”). We are the data controller for the data described in sections 4.1, 4.3 and 4.4 below, and a data processor for the conversation data described in section 4.2.

2What this policy covers

This policy applies to:

• this website (lennoy.co) and the merchant platform (app.lennoy.co);
• the Lennoy service that a merchant connects to their Instagram, Messenger, or WhatsApp business account;
• messages, comments, and orders that we handle on a merchant’s behalf;
• support, onboarding, and any other contact you have with us.

It does not cover what a merchant does with the data in their own systems, or the privacy practices of Meta or any other third party.

3Our two roles

3.1 We are the controller for your Lennoy relationship

When you create a merchant account, train your AI employee, or email our support team, we decide how that data is used. We are the controller for it.

3.2 We are a processor for your customers’ conversations

When a customer messages a merchant on Instagram, Messenger, or WhatsApp, the merchant is the controller of that conversation and we process it only to deliver the service the merchant signed up for — answering, selling, taking payment, and arranging delivery. If you are a customer and want a conversation deleted, you can ask the merchant directly, or ask us and we will pass the request on and action it for the merchant.

4What we collect

4.1 Information you give us

• Account and identity data — name, business name, phone number, email address, password credentials, and the verification details we need to open your account.
• Business data — your catalogue, prices, stock, opening hours, policies, and the knowledge you teach your AI employee.
• Payment and payout data — the settlement account details and transaction records needed to pay you. Card and bank credentials are held by our licensed payment partners; we do not store full card numbers.
• Support data — the content of emails, calls, and messages you send us.

4.2 Information that arrives through your channels

• Messages and comments — the text, images, and attachments a customer sends to your business account, and the replies your AI employee sends back.
• Customer identifiers — the platform-scoped identifier (an Instagram-scoped ID or WhatsApp phone number), the display name or username the platform shares, and the timestamps of the exchange.
• Order data — what was ordered, the delivery address and phone number the customer provides, payment status, and delivery events.

4.3 Information we create

• Conversation summaries and knowledge your AI employee learns from your corrections.
• Orders, payment records, delivery records, and the ledger entries your business generates.
• Service logs used to debug, secure, and bill for the service.

4.4 Technical information

• Device, browser, operating system, and approximate location derived from IP address.
• Session, security, and usage logs (including sign-in times and feature usage).
• Cookies and similar storage used to keep you signed in and remember your preferences.

5Data from Meta platforms

When you connect an Instagram, Messenger, or WhatsApp business account, Meta sends us the data needed to run the conversation:

• the platform-scoped identifier of the person who messaged you (not their password, and not their full profile);
• the content of the message, comment, or attachment they sent;
• basic public profile information the platform makes available to a business account, such as a display name or username;
• delivery and read status needed to show whether a reply was received;
• account and permission metadata needed to keep the connection healthy.

We use this data only to provide the service to the merchant who connected the account. We:

• do not sell it, rent it, or trade it;
• do not use it for advertising, ad targeting, or building profiles of people who did not ask for our service;
• do not use it to train general-purpose AI models — your conversations stay inside your account;
• do not combine it with data from other merchants or other sources to identify a person;
• handle it in line with the Meta Platform Terms, the Instagram Platform Terms, and the WhatsApp Business Terms, in each case as applicable.

6How we use it

• To answer customers, recommend products, take orders, collect payment, and arrange delivery.
• To create and secure your account, and to verify who you are.
• To train your AI employee on your catalogue, prices, hours, and policies.
• To settle money to you, keep your ledger, and reconcile transactions.
• To provide support, diagnose faults, and improve the reliability of the service.
• To detect fraud, abuse, and prohibited activity, and to meet our legal and regulatory obligations.
• To send service messages — receipts, security alerts, channel-status warnings, and material changes to our terms. We do not send marketing without your consent, and you can withdraw it at any time.

7Lawful bases

We process personal data under the Nigeria Data Protection Act 2023 (and, where it applies to you, comparable legislation elsewhere). Our bases are:

• Performance of a contract — providing the service you signed up for.
• Legitimate interests — securing the platform, preventing fraud, and improving reliability, balanced against your rights.
• Legal obligation — tax, accounting, anti-money-laundering, and lawful requests from authorities.
• Consent — where we ask for it, for example to send marketing. You may withdraw consent at any time.

Where we process conversation data as a processor, the merchant is responsible for having a lawful basis for that conversation.

8Who we share it with

We share personal data only as needed to run the service:

• Meta Platforms — to receive and send messages and comments through Instagram, Messenger, and WhatsApp.
• AI processing providers — the language models that draft replies. Conversation content is sent for inference only, under contractual confidentiality, and is not used by them to train their public models.
• Payment providers — licensed partners that collect from customers and settle to you.
• Delivery partners — including our logistics partner Vutto, which receives the customer’s name, address, and phone number to complete a delivery.
• Cloud and infrastructure providers — hosting and storage of the platform and its data.
• Professional advisers and authorities — where we are legally required to disclose, or need advice.

We do not sell personal data. Where a processor handles data for us, it may only act on our instructions and must protect it to at least the standard described here.

9International transfers

Some of our providers process data outside Nigeria. Where that happens, we rely on appropriate safeguards — contractual protections with the provider and a transfer basis recognised under the Nigeria Data Protection Act — and we keep the transfer to what the service needs.

10How long we keep it

• Conversations and orders — for as long as your account is active, then deleted or anonymised on request, unless a transaction record must be kept.
• Transaction, payout, and tax records — kept for the period Nigerian law requires (currently up to 7 years for financial records).
• Security and access logs — kept briefly for security and debugging, then deleted.
• Support correspondence — kept while your account is open and for a reasonable period afterwards.

When we delete data, we remove it from live systems and from backups as those backups rotate.

11Security

We use encryption in transit, access controls, least-privilege internal access, credential hashing, monitoring for abnormal activity, and routine review of our providers. No system is perfect: if a breach affects your data, we will notify you and the Nigeria Data Protection Commission where the law requires it.

12Your rights

Subject to the law, you may:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete data we no longer need (see data deletion);
• object to or ask us to restrict certain processing;
• ask for your data in a portable format;
• withdraw consent where processing is based on consent;
• complain to the Nigeria Data Protection Commission.

Email support@lennoy.co with the subject “Data protection request”. We respond within 30 days, and we may ask you to verify your identity first. If you are a customer of a merchant, we may need to refer your request to that merchant as the controller.

13Cookies

We use essential cookies and local storage to keep you signed in, remember your preferences, and protect the platform against abuse. We do not use advertising cookies on this website.

14Children

Lennoy is a business tool and is not intended for children. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn we have.

15Changes

If we make a material change to this policy, we will update the date at the top and tell merchants by email or in the platform before the change takes effect.

16Contact

Data protection enquiries: support@lennoy.co. General and merchant support: support@lennoy.co. Postal: Lennoy Limited, 10 Olusola Faronbi Street, Isolo, Lagos, Nigeria. Our full business details are on the contact page.