We collect your name and business information to provide our services. We use your information only for legitimate business purposes and never sell, rent, or trade your personal data to third parties.
1. Introduction
Welcome to TALATUDB, a cloud-based business management platform operated by INDOSABEST LTD, a technology company registered in Nigeria and headquartered in Azare, Bauchi State.
TALATUDB provides the following services to businesses, schools, hospitals, and organisations around the world:
- Cloud Database Management — build and manage custom databases without SQL
- Invoice Generation — create, send, and track business invoices
- Appointment Scheduling — book and manage appointments with built-in chat
and video calling - School Report Card Management — store student records, generate report cards, and manage academic history
- Employee Attendance Management — track staff attendance, generate reports, and manage monthly summaries
Because our platform handles a wide range of personal and sensitive data — including student academic records, employee attendance records, health appointment data, and financial information — we take our data protection obligations very seriously.
This Privacy Policy explains what data we collect, why we collect it, how we protect it, who we share it with, how long we keep it, and what rights you have as a data subject.
By creating an account or using any part of the TALATUDB platform, you confirm that you have read and understood this Privacy Policy.
2. Legal Basis and Compliance
TALATUDB is fully committed to compliance with:
- Nigeria Data Protection Regulation (NDPR) 2019
- Nigeria Data Protection Act (NDPA) 2023
- Consumer Protection Council Act
- Child Rights Act 2003 (for data relating to students and minors)
INDOSABEST LTD acts as the Data Controller for personal data collected through the TALATUDB platform. Where organisations (such as schools, hospitals, or businesses) use TALATUDB to store data about their own customers, students, or employees, INDOSABEST LTD acts as a Data Processor on their behalf, and those organisations bear primary responsibility as Data Controllers for ensuring their use of TALATUDB complies with applicable data protection law.
Data Controller Contact:
INDOSABEST LTD
Azare, Bauchi State, Nigeria
Email: privacy@indosabest.com
3. Information We Collect
We collect data in three ways: information you provide directly, information collected automatically, and information stored by your organisation through our platform.
3.1 Account and Profile Data
When you register for TALATUDB, we collect:
| Field | Purpose |
|---|---|
| Full name | Account identification |
| Username | Login and workspace identity |
| Email address | Account access, notifications, support |
| Password (hashed, never plain text) | Authentication |
| Business name | Workspace and billing identification |
| Phone number | Account recovery, support (optional) |
| Role / job title | Access control and team management |
3.2 Database Management Data
When you use TALATUDB to build custom databases, we store whatever data your organisation chooses to enter. This may include:
- Customer names, contact details, and transaction history
- Product and inventory records
- Staff and HR records
- Any other structured data your organisation manages
You are the Data Controller for the records your organisation creates. We store and process this data solely on your instructions as your Data Processor.
3.3 Invoice and Financial Data
When you use the Invoice Generation module, we collect and store:
- Client names and contact information
- Invoice line items, amounts, and currencies
- Payment status and transaction references
- Billing address details
We do not store credit card numbers or bank account details directly. Payment processing is handled by Flutterwave with their own privacy policies.
3.4 Appointment and Scheduling Data
When you use the Appointment Scheduling module, we collect:
- Appointment dates, times, duration, and location (physical or virtual)
- Names and contact details of appointment participants
- Appointment notes, descriptions, and status
- Chat messages exchanged within appointment conversations
- Video call metadata — call start/end times, duration, participant count
(we do not record video or audio content) - Appointment history and cancellation records
Important note on video calls: TALATUDB uses Daily.co to power video
calls. Video and audio streams pass through Daily.co's infrastructure and
are not recorded or stored by TALATUDB. Please review Daily.co's privacy
policy for how they handle call data.
3.5 School Report Card Data
When schools use the Report Card module, we store data that may include:
- Student full names, registration numbers, and class information
- Date of birth and gender
- Academic scores, grades, and subject results per term
- Teacher comments and remarks
- Attendance summaries linked to report cards
- Parent or guardian contact information
This category includes children's data. Under the Child Rights Act 2003
and NDPA 2023, schools using TALATUDB are responsible for obtaining
appropriate consent from parents or guardians before entering student data
into the platform, and for ensuring student data is used only for
educational purposes.
3.6 Employee Attendance Data
When organisations use the Attendance Management module, we store:
- Employee full names and staff IDs
- Daily attendance records — present, absent, late, or on leave
- Clock-in and clock-out times
- Attendance tokens used for check-in
- Monthly attendance summaries and reports
- Organisation and branch information
This is employment data. Organisations using TALATUDB for attendance
management are responsible for informing their employees that their
attendance records are being stored digitally and for complying with
applicable employment law.
3.7 Automatically Collected Data
When you use TALATUDB, we automatically collect:
- Usage data — features used, pages visited, actions taken, session duration
- Device information — browser type, operating system, screen resolution
- Network data — IP address, approximate location (country and state level only)
- Audit logs — login times, record changes, API requests, key generation
- Session tokens — to keep you securely logged in
4. How We Use Your Information
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Creating and managing your account | Account data | Contract |
| Providing database management features | All workspace data | Contract |
| Generating and storing invoices | Invoice and financial data | Contract |
| Managing appointments and schedules | Appointment data | Contract |
| Powering chat within appointments | Chat messages | Contract |
| Facilitating video calls | Call metadata | Contract |
| Generating school report cards | Student academic data | Contract |
| Recording and reporting employee attendance | Attendance data | Contract |
| Processing payments | Billing data | Contract |
| Sending account notifications | Account data | Contract |
| Security monitoring and fraud prevention | Usage and audit data | Legitimate interest |
| Improving platform features (anonymised) | Aggregated usage data | Legitimate interest |
| Responding to support requests | Account and usage data | Legitimate interest |
| Complying with legal obligations | All relevant data | Legal obligation |
| Sending product updates (opt-out available) | Email address | Legitimate interest |
| Marketing communications | Email address | Consent only |
5. How We Protect Your Data
5.1 Encryption
- Passwords are hashed and you can recover your password, only reset it.
- API keys are hashed with SHA-256 — full keys are shown only once at generation
5.2 Access Controls
- Only authorised INDOSABEST personnel with a documented business need
can access production systems - Within your workspace, access is governed by the roles you assign to
your team members - All internal access is logged in our audit system
5.3 Backups and Recovery
- Automated daily backups with point-in-time recovery for up to 30 days
- Backups are encrypted at rest and stored separately from primary data
5.4 Video Call Security
Video calls are powered by Daily.co and use end-to-end WebRTC encryption. Call content is never recorded or stored by TALATUDB.
5.5 Infrastructure
TALATUDB is hosted on enterprise-grade cloud infrastructure with:
- 99.9% uptime SLA
- Automated security patching
- Network-level firewall protection
- Intrusion detection monitoring
6. Sensitive Data Categories
Under NDPR/NDPA, certain categories of data require extra care. TALATUDB handles the following sensitive categories on behalf of our customers:
| Category | Module | Extra Protection |
|---|---|---|
| Children's data (under 18) | School Report Card | Accessible only to school admins |
| Employment data | Employee Attendance | Accessible only to HR/Admin roles |
| Financial data | Invoice Generation | Payment data processed by PCI-compliant providers |
| Health-related appointments | Appointment Scheduling | Chat messages encrypted at rest |
Organisations storing these categories through TALATUDB are responsible for ensuring they have appropriate legal authority (consent, contract, or legitimate interest) to collect and process this data.
7. Data Sharing
We do not sell, rent, or trade your data or your customers' data to any third party, under any circumstances.
We share data only as follows:
7.1 Service Providers
We use trusted third-party providers who process data on our behalf under strict data processing agreements:
| Provider | Purpose |
|---|---|
| Cloud hosting provider | Infrastructure and database hosting |
| Flutterwave | Payment processing |
| Daily.co | Video call infrastructure |
7.2 Legal Requirements
We may disclose data when required by Nigerian law, a valid court order, or regulatory authority — for example, to the Nigeria Data Protection Commission (NDPC) or law enforcement with proper authority.
7.3 Business Transfers
In the event of a merger, acquisition, or asset sale, user data may be transferred. We will notify all users at least 30 days before any such transfer and before data becomes subject to a different privacy policy.
8. Data Retention
| Data Category | Retention Period |
|---|---|
| Account information | Duration of account + 2 years after deletion |
| Database records (your data) | Duration of account + 30 days after closure |
| Invoice records | 7 years (Nigerian tax and financial regulation) |
| Appointment records and chat | 2 years from appointment date |
| Video call metadata | 90 days |
| Student academic records | Duration of school's subscription + 1 year |
| Employee attendance records | 3 years from creation |
| Audit logs | 2 years |
| Payment transaction records | 7 years |
| Backup data | 30 days rolling |
| Support communications | 3 years |
When your account is deleted, we will delete or anonymise your personal data within 30 days, except where longer retention is required by law.
9. Your Rights Under NDPR / NDPA 2023
As a data subject, you have the following rights:
Right to Access
Request a copy of all personal data we hold about you. We will respond within 30 days.
Right to Rectification
Request correction of inaccurate or incomplete data. Most information can be updated directly in your account settings.
Right to Erasure
Request deletion of your personal data. We will honour this unless we are legally required to retain it (e.g. invoice records for tax purposes).
Right to Data Portability
Request your data in a structured, machine-readable format (JSON or CSV). We will provide this within 30 days.
Right to Restrict Processing
Request that we limit how we use your data while a dispute is being resolved.
Right to Object
Object to processing for marketing or profiling at any time. You can unsubscribe from marketing emails using the link in any email we send.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw it at any time.
Right to Lodge a Complaint
If you believe we have mishandled your data, you may complain to:
Nigeria Data Protection Commission (NDPC)
Website: ndpc.gov.ng
Email: info@ndpc.gov.ng
To exercise any right, email privacy@indosabest.com with your full name, email address, and a clear description of your request.
10. Rights of Data Subjects Stored in Your Workspace
If your organisation uses TALATUDB to store data about other people — such as students, employees, clients, or patients — those individuals also have data rights under NDPR/NDPA.
As the Data Controller, your organisation is responsible for:
- Informing those individuals that their data is stored in TALATUDB
- Responding to their access, correction, or deletion requests
- Ensuring you have a lawful basis for collecting and processing their data
TALATUDB will assist you in fulfilling these obligations. Contact us at privacy@indosabest.com if you need help responding to a data subject request from someone whose data is stored in your workspace.
11. Cookies
What We Use
| Cookie Type | Purpose | Duration |
|---|---|---|
| Session cookies | Keep you logged in | Session end |
| Authentication cookies | "Remember me" login | 30 days |
| CSRF tokens | Security — prevent cross-site attacks | Session end |
| Preference cookies | Workspace and UI preferences | 1 year |
What We Do Not Use
- Third-party advertising or tracking cookies
- Social media pixels
- Behavioural profiling tools
- Cross-site tracking
12. Children's Privacy
TALATUDB's direct platform services (account registration, API access, dashboard) are intended for users 18 years and older.
However, schools using TALATUDB may lawfully enter student data (including minors) through the Report Card module, provided the school has obtained appropriate consent from parents or guardians. TALATUDB applies extra technical protections to student data and does not use it for any purpose other than powering the school's report card features.
If you believe a minor has registered a personal account without parental consent, contact us immediately at privacy@indosabest.com and we will delete the account promptly.
13. Data Breach Response
In the event of a personal data breach we will:
- Contain and assess the breach within 72 hours of discovery
- Notify the Nigeria Data Protection Commission (NDPC) as required
- Notify affected organisations and users without undue delay if the breach poses a high risk to data subject rights
- Provide details of what happened, what data was affected, and what steps we are taking
- Document the breach and our response in our internal incident register
14. Changes to This Policy
When we make material changes to this Privacy Policy, we will:
- Publish the new version on this page with an updated effective date
- Send an email notification to all registered account holders
- Display a notice inside the TALATUDB dashboard for 30 days
Previous versions remain accessible via the version history on this page. Your continued use of TALATUDB after the effective date constitutes acceptance of the updated terms.
15. Contact Us
INDOSABEST LTD — Data Privacy
Email: privacy@indosabest.com
Address: Azare, Bauchi State, Nigeria
General Support: support@indosabest.com
Sales Enquiries: sales@indosabest.com
We respond to all privacy enquiries within 5 business days.
This Privacy Policy was prepared in compliance with the Nigeria Data Protection Regulation (NDPR) 2019, the Nigeria Data Protection Act (NDPA) 2023, and the Child Rights Act 2003.