Privacy & Terms
Back to Vello
Trust · Compliance · Security

Privacy Policy

At VELLO, we believe estate security begins with transparent data custody. Discover how we protect residents, automate 90-day visitor privacy, and operate under the Nigeria Data Protection Act 2023.

Statutory Compliance • NDPA 2023

VELLO Privacy Policy

Effective Date: October 2026 • Version: PP-2026.3 • Jurisdiction: Federal Republic of Nigeria
Official Legal Addenda: Data Processing Addendum (NDPA DPA PDF) Master Services Agreement (MSA PDF)

1. Plain-Language Executive Summary

This Privacy Policy explains how Vellum and Vector Technologies Limited ("VELLO", "we", "us", RC: 9843533) collects, safeguards, and processes personal data across our visitor management ecosystem, including the VELLO Resident App, Guard Tablet App, and Estate Manager Dashboard.

  • No Tracking / No Ad Profiling: We do not track residents across third-party websites or sell access rosters.
  • On-Device Biometrics: Biometric authentication (FaceID, fingerprint) operates strictly through your phone's secure hardware enclave. VELLO never receives, uploads, or stores raw biometric templates.
  • Single-Contact Selection: When creating a guest pass from your phonebook, our application accesses only the individual contact chosen by you. Your global address book is never scanned or cloned.

2. Legal Roles under the Nigeria Data Protection Act 2023

Section 65 of the NDPA 2023 distinguishes between two critical statutory roles:

Entity Legal Designation Statutory Responsibilities
Estate Residents' Association / Facility Management (HOA) Data Controller Determines physical access criteria, decides approved resident lists, establishes visitor curfew bylaws, and owns estate admission records.
Vellum and Vector Technologies Ltd Data Processor Operates the cloud infrastructure, encrypts QR payloads, issues verification OTPs, and executes automated 90-day data purging under the Controller's instructions.

3. Data Collected at Gates and In-App

3.1 Resident Personal Data

Full legal name, verified residential unit number, primary mobile number, email address, household occupant list, and encrypted authentication tokens.

3.2 Visitor Perimeter Ingress Data

Visitor full name, mobile telephone number, vehicle license plate number, destination residential plot, entry/exit timestamp, admitting security guard identifier, and gate verification access record.

3.3 Security Device & Guard Telemetry

Guard badge ID, gate device battery level, network connection state, offline sync backlog queue size, and pass scan speed.

4. Google Play Developer Policies & Mobile Device Data Safety

VELLO applications (com.vellumvector.residentapp and com.vellumvector.guardapp) are strictly engineered to comply with the Google Play Developer Programme Policies, including the User Data Policy, Personal and Sensitive User Data Policy, and Device Identifiers Policy:

4.1 Absolute Ban on Persistent Device Identifiers (IMEI, IMSI, MAC Address)

Google Play policy strictly prohibits linking persistent device identifiers to personal and sensitive user data. VELLO apps do NOT collect, access, transmit, or link persistent hardware identifiers (such as IMEI numbers, IMSI numbers, SIM card serial numbers, or hardware MAC addresses). Our systems use only revocable, resettable application-level tokens:

  • Resettable Push Tokens: Firebase Cloud Messaging (FCM) / Expo push tokens used exclusively for gate arrival alerts and security broadcasts. Tokens reset automatically on app reinstallation or data clear.
  • Cryptographic Session Tokens: Ephemeral, time-limited JSON Web Tokens (JWT) stored securely on-device and purged immediately upon user logout or account deletion.

4.2 Mobile Runtime Permissions & Prominent In-App Disclosures

All runtime permissions in VELLO applications require affirmative user consent and are preceded by prominent, contextual in-app disclosures explaining what information is accessed and why:

Permission & Application Operational Purpose Prominent Disclosure & Scope Limitation
Contacts (READ_CONTACTS)
Resident App Only		 Visitor Entry Pass Creation Single-Contact Selection Only: When creating a guest pass, residents may choose to tap "Pick from Contacts". A prominent in-app disclosure explains the purpose before launching your phone's native contact picker. VELLO accesses only the single contact (name and phone number) explicitly selected by the user to autofill the form. VELLO NEVER scans, accesses, harvests, or uploads your phone's full address book or contact roster to any server.
Camera (CAMERA)
Guard App & Resident App		 Gate QR Pass Scanning & Incident Verification Guard App: Used exclusively for real-time optical scanning of visitor QR codes and access PINs at estate gates. Operates strictly as a barcode scanner; no visitor photographs are taken or stored.
Resident App: Used solely if the resident explicitly chooses to capture a new profile photo or snap an image of a physical maintenance issue (e.g., broken barrier, street light fault).
Photos / Media (READ_MEDIA_IMAGES)
Resident App Only		 Profile Photo & Maintenance Attachments Uses the system-level Photo Picker. Grants access strictly to the individual photo explicitly selected by the resident for profile customization or maintenance tickets. No global photo library access.
Biometrics (USE_BIOMETRIC)
Resident & Guard Apps		 Secure Local Application Unlock 100% On-Device Hardware Enclave: Biometric authentication (fingerprint, Face ID) is processed entirely by the Android BiometricPrompt system within your phone's secure hardware enclave (TEE/SE/KeyStore). Raw biometric data NEVER leaves your device and is NEVER accessed, transmitted, or stored on VELLO servers.
Push Notifications (POST_NOTIFICATIONS)
Resident & Guard Apps		 Gate Arrival Alerts & Emergency SOS Delivers real-time notifications when a visitor arrives at the estate gate, walk-in clearance requests, and critical emergency SOS broadcasts. Can be disabled at any time in device or in-app settings.
Location
All VELLO Apps		 Perimeter Safety Only Zero Background Location Tracking: VELLO applications do NOT track your geographic location in the background. Emergency SOS alerts broadcast your registered household unit address.
Microphone / Audio
All VELLO Apps		 Not Requested / Blocked Microphone access and audio recording permissions are explicitly blocked in our application configuration. VELLO does not record audio.
4.3 Absolute Prohibition on the Sale of Personal and Sensitive User Data

Vellum and Vector Technologies Ltd does not sell, rent, commercialize, lease, trade, or transfer personal or sensitive user data to data brokers, ad networks, or third-party marketing companies for monetary or other commercial consideration under any circumstances. All data collected is utilized solely to deliver gated community physical security, pass validation, and estate management services.

4. Lawful Basis of Processing (NDPA Section 25)

VELLO processes personal data under clearly established statutory grounds:

  • Legitimate Interests (NDPA Section 25(1)(v)): Processing perimeter ingress/egress records is necessary to secure lives and property, prevent unauthorized trespass, and maintain safe gated communities.
  • Performance of Contract (NDPA Section 25(1)(b)): Processing resident credentials and issuing access passes as requested by registered residents under estate bylaws.
  • Vital Interests (NDPA Section 25(1)(d)): Dispatching emergency SOS broadcasts to gate guards and estate first-responders during medical or security incidents.

5. Automated 90-Day Purge & Data Minimization

Pursuant to the Storage Limitation principle under Section 24(1)(e) of the NDPA 2023, VELLO enforces automated cloud-side pruning jobs:

  • Access Verification Records: Detailed visitor pass logs and security gate check-in records are permanently pruned after 90 calendar days.
  • Visitor Contact Numbers: Mobile phone numbers collected at gate ingress are redacted and masked after 90 days.
  • Aggregate Archives: Only non-identifiable quantitative counts (e.g., "Main Gate admitted 412 vehicles in June") remain for traffic analysis.

6. Your Statutory Rights (NDPA Part VI)

As a data subject in Nigeria, you hold enforceable rights:

  1. Right of Access: Request a copy of all visit logs associated with your account or vehicle plate.
  2. Right to Rectification: Correct outdated household member or vehicle records.
  3. Right to Erasure ("Right to be Forgotten"): Request immediate account deletion and pseudonymization of historical records via our automated self-service portal at vello.com.ng/delete-account or in-app via Settings > Delete Account.

7. Sub-Processors & Infrastructure Partners

To deliver enterprise-grade availability and communications, VELLO utilizes audited third-party service providers bound by strict confidentiality and Data Processing Addenda (DPAs):

Partner / Provider Service Role Data Handled & Security Measures
Render & AWS Cloud Core Hosting & Databases Cloud infrastructure hosted in enterprise facilities adhering to ISO 27001 and SOC 2 standards. Encrypted data storage at rest (AES-256) and in transit (TLS 1.3).
Termii SMS & WhatsApp OTP Dispatch Phone numbers and OTP codes for login and verification dispatch only. No promotional tracking.
Resend Transactional Email Delivery Delivery of security verification codes, account notices, and manager onboarding emails.
Nigerian Telco Networks Cellular SMS Transit MTN, Airtel, Glo, and 9mobile transit network routing for SMS delivery.

Under no circumstances is personal data leased, shared, or brokered to commercial ad networks, data brokers, or marketing profiling companies.