Draft for legal review. This policy describes how this website, TYGR accounts and TYGR Academy work today. It must be reviewed by a Nigerian data protection lawyer before launch. [TODO: legal review]
This policy explains what personal data TYGR collects through this website, your TYGR account and TYGR Academy, why, and the rights you have under the Nigeria Data Protection Act 2023 (NDPA). Our plain-language summary is on the privacy pledge page.
1. Who we are
TYGR is operated by [TODO: legal entity name, CAC registration number and registered address]. We are the data controller for the personal data described in this policy.
- Privacy contact: privacy@tygr.example
- Data Protection Officer: [TODO: name or role, and contact details]
This policy covers:
- this website, tygrwellness.com, and its forms;
- your TYGR account, the one sign-in shared by the TYGR apps;
- TYGR Academy at academy.tygrwellness.com, including the Academy guide, a chat assistant that uses AI to answer your questions.
Before Clinic, Market or The Streak open, we will add them to this policy or give them their own privacy notice, so you know how each one handles your data, including health information, before you use it.
2. What we collect on this website
| Where | What we collect |
|---|---|
| Waitlist forms | Your email address or WhatsApp number, the wings you chose, the page you signed up on, and the date. |
| Specialist interest form | Your name, email, phone number, profession, regulatory body and registration number, years in practice, how you would like to work with us, languages and anything you add. |
| Vendor application form | Your business name, your name, email, phone number, CAC registration number, product categories, number of registered products, website and anything you add. |
| Contact form | Your name (optional), email or WhatsApp number, topic and message. |
| Coach reviews | The coaching option you reviewed, your star rating, your review, the name or nickname you chose (optional) and the date. We also keep a scrambled (hashed) version of your IP address, only to stop spam; your actual address is never stored or shown. We do not ask for your email or phone number. |
| If you message us on WhatsApp, we receive your number, name on WhatsApp and the messages you send. |
What we do not collect. This website loads no advertising trackers and sets no cookies of its own. If you have signed in to TYGR Academy, your browser also sends the Academy’s sign-in cookies to this website (section 4 explains them), but this website does not read or use them. Your answers to the Find your path quiz stay on your device and are never sent to us. Your theme and discreet mode settings are saved only in your own browser.
Visit statistics. We use Plausible Analytics to count visits. It does not use cookies, does not store IP addresses and does not build a profile of you. We see only totals, such as how many people visited a page.
Server logs. Our hosting provider records technical information such as IP addresses when pages are requested, to keep the site secure and working. [TODO: confirm hosting provider log retention.]
Please do not send health details through these forms. We do not need them here.
3. Your TYGR account and TYGR Academy
You can browse the Academy without an account. You need a TYGR account to ask the Academy guide questions.
| What | What we collect |
|---|---|
| Your TYGR account | Your email address, when you created the account, when you confirmed you are 18 or over, and when you last signed in. |
| Signing in | Each time you sign in, we email a 6-digit code to your address. For security, our account provider records the IP address and browser of each device you sign in on. |
| Academy guide chats | Each question you ask and each answer, when they were sent, a chat title made from your first question, which AI model wrote each answer and how much processing it used. We count your questions from the last hour and day to apply the guide’s limits. |
How the guide writes its answers. When you ask a question, our server sends it to Moonshot AI, the company that runs the Kimi AI model, which writes the answer. With your question we send the guide’s instructions and up to the last 20 messages from that chat, so the answer follows your conversation. We do not send your email address, your account details or your IP address. Everything you type in a question is sent, so leave out your name, phone number and anything else that identifies you.
Answers from the guide are written by an AI model. They are for learning, they can be wrong, and they are not medical advice. The guide does not make decisions about you.
4. Cookies
This website does not set any cookies of its own.
TYGR Academy sets sign-in cookies when you sign in. They are set for the whole tygrwellness.com domain, so that one sign-in works across the Academy, Clinic, Market and The Streak. This means your browser also sends them to this website, which does not read or use them.
tygr-authkeeps you signed in. It holds your session with Supabase, our account provider: security tokens, your account ID and your email address. When it is too large for one cookie, it is split intotygr-auth.0,tygr-auth.1and so on. It lasts up to 400 days and is renewed while you keep using TYGR.- Cookies whose names start with
tygr-authand end incode-verifierare set when you ask for a sign-in code. Each holds a random security value used during sign-in, and no personal data. They last up to 400 days.
These cookies are strictly necessary. They are set only when you choose to sign in, they are used only to keep you signed in, and they are never used for advertising or to follow you across other websites.
Signing out removes them from that browser. Signing out of one TYGR app signs you out of all of them in that browser; your other devices stay signed in until you sign out there too. You can also delete them in your browser settings, which signs you out.
5. Why we use your data, and our lawful basis
| Purpose | Lawful basis under the NDPA |
|---|---|
| Telling you when the wings you chose open | Your consent. You can withdraw it at any time. |
| Reviewing specialist and vendor applications, including licence and registration checks | Steps you asked us to take before entering a contract with you, and our legitimate interest in keeping TYGR safe. |
| Showing your review of Coach TYGR’s coaching, after we have checked it | Your consent, given when you send the review. You can ask us to remove it at any time. |
| Replying to messages | Our legitimate interest in answering you, or steps you asked us to take. |
| Creating your TYGR account and signing you in | [TODO: lawful basis, for example performance of a contract with you] |
| Answering your questions in the Academy guide and keeping your chat history | [TODO: lawful basis, for example your explicit consent, as questions may include health information] |
| Keeping the website, your account and the Academy secure, including the guide’s question limits | Our legitimate interest in protecting TYGR and its users. |
| Meeting legal duties | Legal obligation. |
We never use your data for advertising, and we never sell it.
6. Sensitive personal data
Health information is sensitive personal data under the NDPA. This website’s forms do not ask for it.
The Academy guide answers questions about health, including sexual and mental health, so what you ask may include health information about you. We use it only to answer you and to keep your chat history for you. We never use it for advertising, never sell it, and share it only with the providers in section 7 that we need to answer you. [TODO: legal to confirm the condition for processing health information in Academy chats, for example explicit consent at sign-in.]
Before the Clinic or any other TYGR app keeps health records, such as consult notes, we will ask for your explicit consent and explain how they are protected.
7. Who we share it with
We share personal data only with service providers who help us run TYGR, under contracts that require them to protect it. [TODO: confirm a data processing agreement is in place with each provider, including Moonshot AI.]
- Form processing: [TODO: name the form provider behind the form endpoint]
- Website hosting: [TODO: confirm, for example Vercel Inc.]
- Visit statistics: Plausible Analytics (no personal data stored)
- Messaging: WhatsApp, if you choose to contact us there
- TYGR accounts and Academy chats: Supabase, which runs sign-in and stores your account and your chats
- Academy guide answers: Moonshot AI, which runs the Kimi AI model. It receives each question you ask, the guide’s instructions and up to the last 20 messages from that chat, but not your email address or account details.
- Academy hosting: Vercel Inc., which runs the Academy app. Your questions pass through it on their way to Moonshot AI and Supabase.
- Sign-in emails: Resend, which sends your sign-in codes. It receives your email address and each code.
We may also disclose data when Nigerian law requires it. We never sell or rent your data.
8. Transfers outside Nigeria
Some of our providers store or process data outside Nigeria. The NDPA allows this only when the country or the provider gives your data an adequate level of protection, for example through its laws, binding contract clauses or a certification, or when another condition in the Act applies, such as your consent after you have been told the risks.
- Moonshot AI, China. Every question you ask the Academy guide, with the guide’s instructions and up to the last 20 messages from that chat, is sent to Moonshot AI, a company based in China, to write the answer. China’s data protection law is different from Nigeria’s, so your data may not be protected in the same way, and it may be harder for you to use your rights there. If you don’t want your questions sent to China, you can still browse the Academy without using the guide. [TODO: legal to confirm where Moonshot AI processes requests, the transfer mechanism, and whether members must give explicit consent to this transfer before their first question.]
- Supabase and Vercel. Supabase stores your TYGR account and Academy chats, and the Academy app runs on Vercel. Both are US companies. Your account and chats are stored in Ireland, in the EU, and the Academy’s server runs there too.
- Resend. Resend, a US company, sends your sign-in codes through servers in Ireland. It receives your email address and each code.
[TODO: legal to confirm the transfer mechanism for each provider.]
9. How long we keep it
- Waitlist details: until the wings you chose have launched and we have told you, then [TODO: period], or sooner if you ask us to delete them.
- Specialist and vendor applications: [TODO: period] after our decision, unless you join TYGR.
- Contact messages: [TODO: period].
- Reviews: approved reviews stay on the site until you ask us to remove them or we stop offering that coaching. Reviews we do not publish are deleted within [TODO: period]. The scrambled IP address is deleted after 30 days.
- Your TYGR account: until you ask us to delete it. [TODO: decide whether accounts are deleted after a period of no use, and how long sign-in records are kept.]
- Academy chats: until you delete them or your account is deleted. [TODO: decide a maximum period for keeping chats, and confirm how long deleted chats stay in Supabase backups.]
- Questions sent to Moonshot AI: [TODO: confirm from Moonshot AI’s API terms how long it keeps questions and answers, and that it does not use them to train its models.]
- Sign-in cookies: up to 400 days, or until you sign out.
10. How we protect it
All traffic to this website and to TYGR Academy is encrypted. We limit who can see personal data and protect it with access controls. Other members can’t see your account or your chats. TYGR is built with security engineers from TYGR Security. If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.
11. Your rights
Under the NDPA you have the right to:
- be told how your data is used, as in this policy;
- get a copy of the data we hold about you;
- correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use it;
- object to our use of it;
- receive your data in a common format, or have it sent to another organisation;
- withdraw your consent at any time, without affecting what we did before;
- not be subject to decisions based only on automated processing that significantly affect you.
Deleting your Academy chats and your account. You can delete any Academy chat yourself: open the guide, choose Your chats, and delete it. It is removed from your history and our database straight away. You can’t delete your whole TYGR account in the app yet. Until you can, email privacy@tygr.example from the address you sign in with, and we will delete your account and all your Academy chats, and tell you when it’s done.
To use any of these rights, email privacy@tygr.example. We will reply within [TODO: response period]. If you are not satisfied, you can complain to the Nigeria Data Protection Commission (NDPC).
12. Age
TYGR is for adults aged 18 and over. To create a TYGR account, you must confirm you are 18 or over. We do not knowingly collect personal data from anyone under 18. If you think we have, contact us and we will delete it.
13. Changes to this policy
If we change this policy, we will update the date at the top. If the change is significant, we will tell people on the waitlist and email TYGR members.