Legal

Privacy Policy

Last updated 3 November 2026

Zedapex Limited, Lagos ("Zedapex", "we", "us") runs Spyvoo and is the controller of your personal data. This policy explains what we collect, why, who we share it with, how long we keep it and the rights you have. We never sell your personal data.

We follow the Nigeria Data Protection Act 2023 ("NDPA"). Wherever you are, we honour the rights that the EU and UK GDPR, the California Consumer Privacy Act (CCPA) and similar laws give you.

1. What we collect

Account details: your name, email address, country, and your password (stored only as a secure hash), or your VooSquare Voo ID if you sign in with it. For Agency teams, who is on the team.
Billing: the plan you buy, amounts, order references, discount codes and the payment method. For crypto payments, the coin, network, amount and transaction ID. For bank transfer or mobile money, the payment details you send us so our team can confirm it. We never receive card numbers.
How you use Spyvoo: searches, saved searches, saved ads, boards, followed advertisers, alerts, downloads and AI requests, so we can run your features and plan limits.
Support chats: messages you send to support and the replies from our AI support agent and our team.
Emails: whether you opted out of marketing emails and weekly reports.
Technical data: IP address, browser type and login times, used for security, abuse prevention and to keep you logged in.

2. Ad data in Spyvoo

Spyvoo shows ads that advertisers published in Meta's public Ad Library, with the page names, pictures, text and media they made public. This is advertising content, collected so customers can research ads. If you are an advertiser and want something about you removed, write to [email protected] and we will review it promptly. Our Intellectual Property and Takedown Policy covers copyright and trademark requests.

3. How we use your data and our legal reasons

To run your account and plan (contract): log in, search, save, download, AI features, limits and support.
To take payments and keep records (contract and legal obligation): orders, receipts and tax records.
To send emails you expect (contract): receipts, renewal reminders, alerts, password resets and confirmations.
To send weekly reports and product news (legitimate interests, with a one-click opt-out in every email).
To keep Spyvoo secure (legitimate interests): prevent fraud, abuse, account sharing and scraping.
To improve Spyvoo (legitimate interests): understand which features are used so we can fix and improve them.
Where you consent, for anything else we ask you about. You can withdraw consent at any time.

We share data only with providers that help us run Spyvoo, each getting only what its job needs:

Railway, for hosting and our database.
Cloudflare R2, when switched on, for storing ad images and videos.
Our email provider (Resend, Brevo or Postmark, whichever we have switched on) to deliver emails to you.
Our AI provider (Anthropic, or OpenRouter or OpenAI if we switch to them; only one is used at a time) to create ad breakdowns, scripts, search answers and support replies. For ad analysis it receives ad text and transcripts, not your personal details. For support replies it receives your messages and the account details needed to answer, such as your first name, plan, usage and order status. Passwords are never sent.
OpenAI's transcription service (or the transcription service we switch on) to turn ad videos into text. It receives the ad's audio only.
Apify, our ad data provider, to collect public ads. It receives the search terms of our tracking rules, never your personal data.
Bachs, our card and local payments provider, to take card payments and renew card plans you have not cancelled. It receives your email, the amount and the order reference, and collects your card details directly; we never see or store your full card number.
Gatevoo, Zedapex's non-custodial crypto checkout, to create payment pages and confirm crypto payments. It receives the order amount and reference.
VooSquare, Zedapex's account hub, if you use a Voo ID. Spyvoo tells VooSquare about your plan payments (amount, plan, country, refunds) and your activity in short form (for example how many searches you ran in an hour, which advertiser's ad you saved, or that you made a board), for your own VooSquare dashboard and so a VooSquare partner who introduced you can be credited. Never the words of your searches, your boards' names or your email.

Crypto payments happen on public blockchains, where addresses and amounts can be seen by anyone. We share data with authorities only when the law requires it, to protect people from harm or fraud, or as part of a merger or sale of our business, in which case this policy keeps protecting your data.

5. International transfers

Spyvoo is run from Nigeria and used worldwide. Some of our providers process data in other countries, including the United States and the European Union, so your data may be processed outside the country where you live. When data crosses borders, we use the safeguards the Nigeria Data Protection Act and other laws that apply require, such as contractual protections with our providers.

6. How long we keep it

While your account is open, we keep your data so Spyvoo works.
When you delete your account in Account → Delete account, your personal data, boards, saved ads, searches, notifications, usage and support chats are deleted straight away. Paid order records are kept for tax and accounting, without your name or email.
Copies in backups are overwritten as backups rotate (we keep only the newest 14 backups).
Security logs are kept only as long as they are useful for security.

7. How we protect it

Connections use HTTPS, passwords are stored as secure hashes, provider keys are stored encrypted, and staff access is limited to admins. Our Security Policy has more detail. No system is perfectly secure; if a breach affects your personal data, we will tell you and the authorities as the law requires.

8. Your rights

You have the right to:

know what we hold about you and get a copy of it;
correct data that is wrong;
have your data deleted;
get your data in a portable format;
object to or limit how we use your data, including for marketing;
withdraw consent where we rely on it; and
not be treated differently for using these rights.

You can change your details in Account, switch off weekly reports and marketing emails, download your boards and delete your account yourself. For anything else, write to [email protected]. We may need to confirm who you are, and we reply within 30 days. You can also complain to the Nigeria Data Protection Commission, or to your local data protection authority.

9. Cookies

We use a few essential cookies and no advertising cookies. Our Cookie Policy lists them.

10. Children

Spyvoo is for adults. We do not knowingly collect data from anyone under 18. If you think a child has given us data, write to [email protected] and we will delete it.

11. Changes

We may update this policy. The date at the top shows when it last changed. Important changes are announced by email or in your dashboard before they take effect.

12. Contact

Zedapex Limited, Lagos · [email protected]