Privacy Policy

When you use Baalot, we collect only what is necessary to run a secure election. This includes: • Account information: name, email address, phone number, and a member or student ID where required, provided during registration. • Organisation data: the institution, organisation, or community you belong to (and details such as faculty, department, or group), used to assign you to the correct election. • Authentication data: we use Firebase Authentication (Google) to manage sign-in. We do not store passwords. • ID card images: when you scan an ID for membership verification, the image is read for its text and is not stored by Baalot after processing. • Identity verification: if you apply for the optional verified badge, your ID number and a liveness selfie are checked by Prembly. We keep only the result and a salted hash of the number, never the number itself. • Levi assistant: messages you type to Levi, and voice you record while holding the mic, are processed to produce a reply. Voice is not kept after it is transcribed. • Content you post: comments, photos and campaign reels. • Location data: optional location shared only when you turn on the live voter map. We do not track your location in the background. • Usage logs: app interactions and error reports used to improve the platform (via Sentry and Firebase Analytics). • Early-access list: if you join the list on baalot.site, we keep your email address to tell you when the Android app launches and to send product updates. We use it for nothing else. Reply to any of those emails, or write to [email protected], and we will remove it. Ads: the app shows ads in the news feed and between reels. Some are Baalot's own "Sponsored" reels, which collect nothing about you. The rest come from Google AdMob, labelled "Ad", which uses your device's advertising ID, IP address (for general location) and how you interact with the ad. In the EEA, UK and Switzerland Google asks for your consent first. Everywhere else Baalot asks once whether ads may be personalised, and until you answer they are not. You can change that answer in Settings › Security › Ad choices, and reset or delete the advertising ID in your Android settings. Non-personalised ads still use the ID to limit repeats, measure the ad and stop fraud. We do not collect payment card details. We do not sell data.

We use the information we collect for one purpose: running trustworthy elections. Specifically: • To create and manage your account. • To verify your identity and enrol you in the elections you are eligible for. • To display real-time election results and voter maps. • To send election notifications you have opted into. • To detect fraud and maintain election integrity. • To diagnose technical issues and improve platform reliability. • To show ads (Baalot's own sponsored reels, and Google AdMob ads, personalised only if you agree). • To comply with legal obligations and respond to valid regulatory requests. We will never use your information for marketing purposes without explicit opt-in consent.

Baalot is built on infrastructure from the following third-party providers: • Firebase (Google): authentication, Firestore database, and analytics. • Vercel: API hosting and serverless functions. No personal data is logged beyond standard access logs. • Sentry: error reporting. Error logs contain no personally identifiable information. • Prembly IdentityPass: ID number and liveness checks for the optional verified badge, and ID card reading. • Groq: processes Levi chat messages and voice recordings, and reads the text on scanned ID cards. • Google (Gemini): AI processing for the voice assistant (Levi). Gemini only answers general how-to questions and is not sent your name, institution, faculty or screen contents; Google may use these prompts to improve its products. • Google AdMob: ads in the news feed and between reels, using your device's advertising ID, IP address and ad interactions, for advertising, measurement and fraud prevention. • Paystack: plan payments. Card details are entered on Paystack's own checkout and never reach Baalot. • Cloudflare R2: storage for campaign reels. • Expo: push notification delivery. • Google Sign-In: optional social login using your Google account (email and profile only). Each provider operates under standard data protection agreements.

You have the following rights over your personal data: • Access: request a copy of all data we hold about you. • Rectification: request correction of inaccurate data. • Erasure: delete your account in the app, or see baalot.site/delete-account. Your personal data is erased 30 days later. • Portability: receive your data in a machine-readable format. • Objection: object to processing based on legitimate interests. • Restriction: request we limit how we process your data while a complaint is resolved. To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

We retain personal data only as long as necessary: • Account data: retained while your account is active. When you delete your account it is switched off at once, and your personal data is permanently erased 30 days later. Sign back in before then to cancel. • Election records: ballots (stored without your name), the record that you voted, your entry on the institution's member roster, any candidacy, and the audit chain are part of the institution's election result. They are kept when an account is deleted, because removing them would change a published count. • Aggregate election results: retained as public records.

Baalot is intended for voters aged 16 and above. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, please contact us and we will delete the account promptly.

If you have any questions about this Privacy Policy or how we handle your data, please contact: Developer: Adole Daniel Email: [email protected] Website: https://baalot.site If you are unhappy with our response, you have the right to lodge a complaint with the Nigeria Data Protection Bureau (NDPB) or your local supervisory authority. This policy was last updated: October 20, 2026.