Privacy Policy

Who we are

Woye is operated by Woye AI (“Woye”, “we”, “us”), based in Lagos, Nigeria. This policy covers the Woye website at www.woye.ai, the Woye web app (including when it is installed on a phone), the Woye site box software, and the Woye app for Ring.

Our role and yours

Woye is used by organisations (our customers) to monitor their own premises and vehicles. For the video, images and telemetry that come from a customer’s cameras and trackers, the customer decides what is recorded and why. The customer is the data controller for that data, and we process it on their behalf and on their instructions.

For the account details of the people who sign in to Woye, and for the data we need to run, secure and bill the service, we are the data controller.

If you appear in footage from a camera that a Woye customer operates and you want to exercise your rights over it, please contact that organisation first. We will help them respond, and you can also write to us.

What we collect

Account information

Your name, email address and password (stored only as a salted hash).
Your organisation, your role in it, and the sites and cameras you can see.
Contact details you add for alerts, such as a phone number for SMS, and the push-notification subscription of each device you turn alerts on for.
Messages you send us for support.

Camera data

Video frames, short clips and snapshots from the cameras an organisation connects, including IP cameras, recorders, phones and laptops used as cameras.
What Woye produces from them: descriptions of what happened, alerts, counts, reports, logbook entries, evidence packs and the SHA-256 fingerprints of the frames in them.
Vehicle licence plates that are readable in view of a camera, where an organisation uses Woye’s plate log.
The camera rules, questions and instructions your team writes in plain language.

Ring data, when you link a Ring account

Through the Ring API, with your permission: information about the Ring devices you choose (name, model, location label, status), their motion and doorbell events, and the snapshots and recorded clips attached to those events.
The access token that lets Woye make those requests on your behalf, stored encrypted. When you link from the Ring app, Ring issues this token and we never see your Ring password. If you instead sign in to Ring from inside Woye, your Ring password and any one-time code are used only for that first sign-in and are deleted once Ring has issued the token.

Vehicle tracker data

Telemetry from GPS trackers an organisation connects: location, speed, heading, ignition state, trip start and end, and driving events such as harsh braking.

Documents for Teach Woye

Documents your team uploads so Woye understands how your place works, such as standard operating procedures, PDFs and exported WhatsApp chats. These can contain personal data about staff and other people; please upload only what you are entitled to share.

Technical data

Logs of requests to our servers (IP address, browser, time, the page or API called), the health of connected cameras and site boxes, and error reports.
A session cookie that keeps you signed in. We do not use advertising cookies or third-party tracking cookies.

How we use it

To provide the service: analysing camera frames and clips to detect events, verify them on several frames, send alerts, answer your questions about footage, count what happens in a space, and write daily reports, logbooks and evidence packs.
To deliver alerts by push notification, email and SMS to the people your organisation chooses.
To keep the service working and safe: monitoring camera and site-box health, preventing abuse, and investigating faults.
To measure and improve accuracy: using results and the feedback your team gives (for example, marking an alert as a false alarm) to check how well Woye performs and to fix what it gets wrong.
To talk to you about your account, support requests and important changes.

Where we act for a customer, we process camera data under our contract with them. Where we are the controller, we rely on performing our contract with you, our legitimate interest in running a secure and reliable service, our legal obligations, and your consent where the law requires it (which you can withdraw at any time).

Face recognition, only if you turn it on

Face recognition is off by default. A business can ask us to turn it on for workforce attendance or access control. When it is on:

Woye recognises only people the business has enrolled by hand, each with their own separate, opt-in consent. Consent to face recognition is never bundled with other permissions.
Woye does not identify strangers or passers-by, does not enrol anyone automatically, does not use pre-loaded face databases, and does not match faces against outside sources such as social media.
Enrolled faces and the data derived from them can be deleted at any time, and deletion is permanent. Face data is never sold or used for advertising.
Facial data is sensitive personal data. The business using it is responsible for telling its staff and visitors and for obtaining the consents that employment and data protection law require, including under the Nigeria Data Protection Act 2023.
On Ring cameras, face recognition follows Ring’s developer content policy in full.

What we don’t do

We never identify strangers, passers-by or anyone a customer has not enrolled. Face recognition is off unless a business turns it on, as described below.
We respect privacy zones. Areas you have masked in the Ring app are not visible in the media Ring provides to us, and we do not try to recover them.
We do not sell personal data, and we do not use it for advertising.
We do not look at your footage except to provide support you ask for, or to investigate a fault or misuse.

We use the following service providers (sub-processors) to run Woye. Each receives only what it needs for its job.

AI model providers, including Google (Gemini) and OpenRouter, which routes requests to model providers: frames and the text needed to analyse them, to return an analysis to us.
Railway: cloud hosting for our application servers and databases.
Vercel: hosting for the Woye website and web app.
Cloudflare R2: object storage for frames, clips and evidence packs.
Resend: sending email, including alerts and account emails.
Africa’s Talking: sending SMS alerts.
Browser push services run by Apple, Google and Mozilla, which deliver push notifications to your devices.

We also share data when your organisation asks us to (for example, when someone in it creates an evidence share link, anyone with that link can see that case), when the law requires it, or to protect people’s safety. If Woye is sold or merged, data would pass to the new owner under this policy.

International transfers

Some of the providers above process data outside Nigeria, including in the United States and the European Union. When personal data leaves the country, we rely on the transfer bases allowed by the Nigeria Data Protection Act 2023 and, where it applies, the GDPR. These include contractual safeguards with the provider and, where needed, your consent.

Where the law requires data to stay in the country, for example under the NDPA in Nigeria or the Data Protection Act in Zambia, we can host Woye in that country for your organisation. Ask us about this before you connect your cameras.

How long we keep it

Camera data and evidence: each organisation sets its own retention period. Frames, clips and evidence are kept until someone in the organisation deletes them or the retention period ends, whichever comes first. A case placed on legal hold is kept until the hold is lifted.
Recordings on your recorder stay there. Woye does not replace your recorder or move its archive.
Ring: when you unlink your Ring account, we delete the Ring access token straight away. Ring media already turned into alerts or evidence follows your organisation’s retention setting.
Account data is kept while your account is active and deleted when the account is closed, unless we must keep some of it longer by law (for example, billing records).
Server logs are kept for a limited period for security and fault-finding, then deleted.

Security

Data travels between your devices, your site box and our servers over encrypted connections (TLS). Each organisation’s data is kept separate from every other’s, and people can only see the sites and cameras their organisation gives them. Passwords are stored as hashes. Every frame in an evidence pack carries a SHA-256 fingerprint so it can be checked for tampering. No system is perfectly secure; if a breach affects your personal data, we will tell you and the regulator as the law requires.

Your rights

Under the Nigeria Data Protection Act 2023, and the GDPR where it applies to you, you have the right to:

ask for a copy of the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
object to, or ask us to restrict, how we use it;
receive your data in a portable format;
withdraw consent where we rely on it; and
complain to the Nigeria Data Protection Commission, or to your local data protection authority.

To use any of these rights, email israel@idbl.group. We will reply within the time the law allows, and may need to confirm who you are first. For footage from a customer’s cameras, see Our role and yours above.

Children

Woye is a business service and is not meant for anyone under 18. We do not knowingly create accounts for children. Cameras may capture children who pass through a monitored space; the organisation running those cameras is responsible for doing so lawfully.

Changes to this policy

We will update this policy when what we do changes. The date at the top shows the latest version. If a change matters, we will tell account holders by email or in the app before it takes effect.

Contact us

Woye AI, Lagos, Nigeria. Email israel@idbl.group. For help with the product, see Support.