Privacy policy

This explains what Terrain collects when you use the Terrain app or terrain.ng, why we need it, who sees it, how long we keep it, and what you can ask us to do. We follow the Nigeria Data Protection Act 2023.

The short version

We collect what we need to run a safe property marketplace: your phone number, name, the listings and messages you send, and, for companies, the details we use to verify them.
Chats, offer letters and deal records are kept on record. That is the point: it protects buyers and honest companies when something goes wrong.
We do not sell your data. The app has no advertising or analytics trackers, and we do not track you across other apps or websites.
You can see, correct and delete your account in the app. Some records stay after deletion, and we say exactly which below.

1. Who we are

Terrain is a Nigerian marketplace for land and homes from verified real estate companies. “Terrain”, “we” and “us” mean the company that runs the Terrain app and terrain.ng. We decide how your personal data is used, so we are its data controller.

2. What we collect

Your account

Phone number. You sign in with it, and we verify it by sending a one-time code by SMS.
Name and email address. We verify your email with a code too. If you choose to sign in with Google, Google shares your name and email address with us.
Profile details you choose to add: a photo, a short bio, the area you are based in (typed by you), and, for people selling, links to your WhatsApp, social media or website. These are shown on your public profile.
What you are looking for. When you sign up we ask what kind of property you want, where, and your budget, so we can show you the right listings.
Saved listings and companies you follow.

Location

If you allow it, the app uses your phone’s location while you are using it: to show you on the map, to start the map in your state, to fill in “use current location”, and to help a company place a listing on the map. To turn your position into an area name (such as your state), the app sends it to our map provider, Mapbox. Terrain’s own servers do not receive or store your device location. The app remembers the area it found on your phone. You can turn location off at any time in your phone’s settings and choose an area yourself.

When a company places a listing using its current location, that point becomes the listing’s location, which buyers can see.

Listings and files companies upload

Photos, videos and 360° room photos, title documents, the listing’s address, map location and boundaries, prices and descriptions. If a company imports a video from an Instagram or TikTok post, we store the post link and account name with it.

Chats, calls and deals

Messages, and any voice notes, photos or files sent in the chat, are stored on Terrain’s own chat server and kept on record. They cannot be edited or deleted after sending. Chats are not end-to-end encrypted: our server can read them, which is what lets us keep a reliable record, check for fraud, and help in a dispute.
Calls are connected through our own call server. We do not record calls. The chat shows that a call happened, and when.
Offer letters and signatures. When a buyer signs an offer letter we keep the letter, the drawn signature, the typed name, the email address verified for signing, the consent wording agreed to, the time, and the IP address and device used. These appear on an audit page in the signed copy.
Reports and blocks. If you report a listing or a chat, we keep the reason, any note you add, and whether you lost money. The company does not see who reported it. We also keep a record of blocks.

Company verification

Before a company can list, we verify it. We collect the company’s CAC registration (RC) number, registered name, business address, CAC certificate and logo, and, from the person applying, their National Identification Number (NIN), a contact phone number and a social media handle we can check. We may also record the company’s registered status and director names from the CAC register.

We do not store your NIN in readable form. It is stored only as a one-way keyed hash (HMAC) made with a secret key held on our servers, so it cannot be read back. It is never shown to buyers. We do not collect selfies or photos of ID cards.

Device and usage

Notifications. If you allow notifications, Apple gives your iPhone a push token. We store it on our chat server so we can tell you about new messages and calls. It is removed when you sign out.
App and device details.With each request the app sends its version, your phone’s model and its operating system version. It does not send your phone’s name.
Listing views. The app creates a random ID when it is installed, so we can count how many different people view a listing. If you are signed in, the view is linked to your account.
Server logs.Our servers log each request’s address, time, result and IP address, for security and to fix problems. They do not log what you send. These logs are kept for a short time and overwritten automatically.
Crash reports.If the app crashes or our server hits an error, a report goes to Sentry so we can fix it: what went wrong, the app version, and your phone’s model and operating system. We set it up not to send your name, messages, documents or contact details.

The app does not use advertising or analytics software, and does not read your contacts.

On terrain.ng

If you join the waitlist, we keep the email address you give us and the page or campaign link you came from. If you sign in on the website, your browser stores your session. Some campaign pages use the Meta Pixel to measure whether our adverts work; it sends Meta details of your visit to that page.

3. Why we use it, and our legal basis

Under the Nigeria Data Protection Act 2023, we need a lawful basis for each use of your data. We rely on:

Providing Terrain to you (performing our contract with you): creating and securing your account, showing listings, saving what you save, delivering messages and calls, sending notifications, offer letters and sign-in codes.
Our legitimate interests in keeping Terrain safe: verifying companies and listings, keeping the chat and deal record, checking messages for fraud, handling reports, preventing abuse, and counting listing views so companies know their listings are seen. We balance these against your rights, and you can object (section 6).
Legal obligations: keeping records the law requires and responding to lawful requests from courts, the police or regulators.
Your consent: location, notifications and the website’s Meta Pixel. You can withdraw consent at any time in your phone or browser settings.

We do not sell personal data. We share it only as follows.

Other Terrain users

Your public profile (name, photo, bio, area and any links you add) and, for companies, the company page, listings and verified status.
The people in a chat see the messages, files, offer letters and deal updates in it. In a chat with a company, the company’s team members can see it.

Service providers who work for us

They may use your data only to provide their service to us:

Hetzner: hosts our servers, database and chat server.
Cloudflare: stores photos, videos, documents, voice notes and signatures (Cloudflare R2) and delivers them quickly.
Amazon Web Services (Amazon SNS): sends SMS sign-in codes to your phone number.
Resend: sends emails, such as email sign-in and signing codes and team invites.
Apple: delivers notifications to iPhones.
Mapbox: provides maps and turns locations into place names. The Mapbox software in the app may also collect technical and location data under Mapbox’s privacy policy.
Sentry: receives crash and error reports so we can fix problems.
Google: only if you choose to sign in with Google.
Meta: only through the Meta Pixel on some website campaign pages.

When the law requires it, or to protect people

We may share information with the police, courts or regulators when the law requires it, or when it is needed to prevent fraud or protect someone’s safety. If Terrain is ever sold or merged, your data would move with it under this policy, and we would tell you first.

5. How long we keep it

We keep your account details while your account is open. When you delete your account (Profile, then Delete account):

Straight away, your account is closed, you are signed out everywhere, and your listings come down. If you run a company on your own, the company closes and its listings come down too.
For 30 days you can change your mind: signing back in cancels the deletion and restores your listings.
After 30 dayswe erase your name, phone number, email, photo, bio, area, links, what you said you are looking for, your saved listings and follows, and your sign-in sessions and codes. From your company verification we erase your NIN hash, documents and contact details. The company’s public register details (its RC number, registered name and directors) stay with the company.

Some records are kept after deletion, because others rely on them:

Chatsstay for the other people in them, with your name shown as “Deleted user”.
Offer letters and deal records are kept exactly as signed, including the signer details listed above. They are the legal record of an agreement between a buyer and a company.
Reports and blocks, so we can handle fraud properly.
Listing view counts.

Copies of photos and files you uploaded can remain in our file storage after erasure, no longer linked to your name. If you want them removed sooner, ask us and we will delete them unless they form part of a deal record.

Waitlist sign-ups are kept until you ask us to remove them.

6. Your rights

Under the Nigeria Data Protection Act you can ask us to:

tell you what personal data we hold about you and give you a copy;
correct anything that is wrong (most of it you can edit in Profile);
delete your data (in the app: Profile, then Delete account), subject to the records described in section 5;
restrict how we use it, or object to a use based on our legitimate interests;
give you your data in a format you can take elsewhere;
stop a use you consented to, at any time.

Contact us as shown in section 10. We will answer within the time the law sets, and we may ask you to confirm it is really you. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission.

7. Keeping it safe

Data travels to and from Terrain encrypted. Sign-in and signing codes are stored only as hashes, NIN numbers only as a keyed hash, and the app keeps your sign-in in your phone’s secure storage. Only staff who need it can see your data. No system is perfectly secure; if a breach puts you at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.

8. Children

Terrain is for adults. You must be 18 or older to use it. We do not knowingly collect data from anyone under 18, and if we learn we have, we will delete it.

9. Changes to this policy

When we change how we use your data, we will update this page. If a change matters to you, we will tell you in the app or by email before it takes effect.

10. Contact us

For any privacy question or request, talk to us in the app (Profile, then Help & safety) or on WhatsApp at +234 814 774 6701. Our Terms explain the rules for using Terrain.