Privacy Policy

1. Data We Collect

We collect the following categories of personal data:

• Account information: full name, email address, and phone number (optional) provided during registration.
• Meter information: prepaid meter numbers, meter names, distribution company (DisCo), and meter addresses that you add to your account.
• Usage data: electricity unit readings, consumption logs, and timestamps that you record manually.
• Recharge data: recharge amounts, units added, payment references, and payment statuses that you log.
• Notification data: alert preferences, push notification tokens, and notification delivery records.
• Technical data: device type, browser information, IP address, and request metadata collected automatically for security and performance monitoring.

2. Purpose of Data Collection

We process your personal data for the following purposes:

• Service delivery: to provide meter monitoring, usage tracking, consumption predictions, and low-balance alerts.
• Account management: to create and maintain your account, authenticate your identity, and process profile updates.
• Notifications: to send you low-balance alerts, depletion warnings, and recharge confirmations via in-app notifications or push notifications.
• Security: to detect and prevent unauthorised access, fraud, and abuse through rate limiting and account lockout mechanisms.
• Improvement: to analyse usage patterns (in aggregate) to improve the platform and develop new features.

3. Legal Basis for Processing

We process your data based on your consent (provided when you create an account and agree to these terms) and our legitimate interest in providing and securing the MeterPal service.

4. Data Storage and Security

• Your data is stored on secure servers with encryption in transit (TLS) and at rest.
• Passwords are hashed using bcrypt with a cost factor of 12. We never store passwords in plain text.
• Access tokens expire after 15 minutes. Refresh tokens are rotated on each use and can be revoked.
• We implement rate limiting, account lockout after failed login attempts, and security headers to protect against common web vulnerabilities.

5. Third-Party Data Sharing

We do not sell your personal data. We may share limited data with the following third parties:

• Push notification services: Expo Push Notification Service receives your device push token to deliver alerts. No personal data beyond the device token and notification content is shared.
• Error monitoring: Sentry receives anonymised error reports to help us identify and fix technical issues.
• Legal compliance: we may disclose your data if required by law, court order, or regulation issued by the Nigeria Data Protection Commission (NDPC) or other competent authority.

6. Data Retention

• Active accounts: your data is retained for as long as your account is active.
• Deleted accounts: upon account deletion, usage logs, recharge logs, notifications, and push tokens are permanently deleted. Meter records are soft-deleted. Account identifiers are retained in anonymised form for audit and fraud-prevention purposes.
• Technical logs (server access logs, error logs) are retained for a maximum of 90 days.

7. Your Rights Under the NDPR

As a data subject under the NDPR and NDPA, you have the following rights:

• Right of access: you can view all your personal data through your profile and meter dashboard at any time.
• Right to rectification: you can update your name, phone number, and other profile information in Settings.
• Right to erasure: you can delete your account from Settings. This permanently removes your usage data, recharge data, notifications, and push tokens.
• Right to data portability: you can export all your data as a JSON file from Settings at any time.
• Right to object: you can disable notifications and alerts in your notification preferences.
• Right to withdraw consent: you can delete your account at any time, which withdraws consent for further data processing.

8. Cookies

MeterPal uses a single authentication cookie to maintain your login session. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

9. Children's Privacy

MeterPal is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email. Your continued use of MeterPal after such changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

Email: privacy@meterpal.app