Privacy policy
Effective 1 November 2026. This policy is a draft and will be finalised before Mouthpiece goes live with dealers.
Who we are
Mouthpiece is a WhatsApp sales assistant for used-car dealers, operated by Al-Hafiz Technologies (RC 9977206) (“Mouthpiece”, “we”), Nigeria. This policy explains what personal data we handle, why, and what rights you have under the Nigeria Data Protection Act 2023.
We hold personal data in two different roles:
| Whose data | Our role | What it means |
|---|---|---|
| Whose dataCar dealers who use Mouthpiece, and visitors to usemouthpiece.com | Our roleData controller | What it meansWe decide why and how this data is used, and we are responsible to you for it |
| Whose dataBuyers who message a dealer's Mouthpiece sales number | Our roleData processor, on the dealer's behalf | What it meansThe dealer is the data controller of their buyers' data. We process it only to run the dealer's assistant, on the dealer's instructions and under a written agreement with them |
If you are a buyer, the dealer you messaged is responsible for your data. You can contact them, or us, about your rights (see “Your rights”).
What we collect and why
We only collect what we need to run the assistant, and each use has a lawful basis under section 25(1) of the NDPA.
| Whose data | What we collect | Why | Lawful basis (NDPA s.25(1)) |
|---|---|---|---|
| Whose dataDealers | What we collectName, business name, business address, WhatsApp number, email, car stock (photos, prices, details), inspection hours, WhatsApp account credentials (stored encrypted), plan and payment records | WhyTo set up and run your assistant, bill you and support you | Lawful basis (NDPA s.25(1))Performance of our contract with you, s.25(1)(b)(i). Payment records also for legal obligations, s.25(1)(b)(ii) |
| Whose dataDealers we contact about Mouthpiece | What we collectBusiness name and the public contact number or handle from your car listings | WhyTo introduce Mouthpiece to car businesses | Lawful basis (NDPA s.25(1))Our legitimate interests, s.25(1)(b)(v). You can tell us to stop at any time and we will (s.36) |
| Whose dataBuyers (on the dealer's behalf) | What we collectWhatsApp number and profile name, your messages and any photos or voice notes you send, the car you're interested in, your budget and buying timeline, and inspection bookings | WhyTo answer your questions about the dealer's cars, book inspections, and pass your chat to the dealer when needed | Lawful basis (NDPA s.25(1))Set by the dealer as controller: usually taking steps at your request before a contract, s.25(1)(b)(i), and the dealer's legitimate interests, s.25(1)(b)(v) |
| Whose dataWebsite visitors | What we collectYour IP address and browser details in short-lived server and security logs | WhyTo keep the site running and protect it from abuse | Lawful basis (NDPA s.25(1))Our legitimate interests, s.25(1)(b)(v) |
What we don't do:
- We don't use advertising cookies, analytics trackers or session recording on usemouthpiece.com. Fonts are served from our own domain.
- The assistant never asks for ID documents, bank details, card numbers or payments. Please don't send them, and the assistant will hand any payment question to the dealer.
- We don't intentionally collect sensitive personal data (s.30), such as health, religion or ethnicity.
- We don't sell personal data, and we don't use buyers' data for our own marketing.
AI replies
When you message a dealer's Mouthpiece number, an AI assistant replies automatically and says that it's an assistant. It uses the dealer's stock list and answers to common questions. It also notes the car you want, your budget and your timeline, so it can offer inspection times and decide when to pass your chat to the dealer.
The assistant does not make decisions with legal or similarly significant effects on you. It doesn't agree final prices, approve payments, sell cars or decide financing. The dealer does those things. You can ask for a person at any time, and the assistant will hand your chat to the dealer (s.37). You can also object to this processing (s.36).
Who we share it with
We share personal data only with the service providers we need to run Mouthpiece. Each one works under a written agreement and processes the data only for us (s.29).
| Provider | What they do for us | Where the data may be processed |
|---|---|---|
| ProviderMeta Platforms (WhatsApp Business Platform) | What they do for usDelivers WhatsApp messages between buyers and the dealer's number | Where the data may be processedOutside Nigeria, including the United States |
| ProviderAnthropic | What they do for usAI model that writes the assistant's replies. Under its commercial terms, it may not train its models on our content. | Where the data may be processedUnited States |
| ProviderNeon | What they do for usDatabase hosting | Where the data may be processedConfirmed at setup |
| ProviderCloudflare | What they do for usWebsite and application hosting, security | Where the data may be processedGlobal network |
| ProviderUpstash | What they do for usShort-term message queue (minutes) | Where the data may be processedConfirmed at setup |
| ProviderPaystack | What they do for usDealer payments (dealers only) | Where the data may be processedNigeria |
We also share data with the dealer you are chatting with, and with authorities when the law requires it. The dealer can read their own buyers' chats, including your phone number, through a private read-only web link we give them.
Transfers outside Nigeria
Some of these providers process data outside Nigeria. We only transfer personal data abroad where the recipient is bound by contractual clauses or similar commitments that give adequate protection (s.41(1)(a) and s.42). Where that isn't enough, we rely on a basis in s.43, such as the transfer being necessary to take steps at your request before a contract (s.43(1)(b)). We keep a record of the basis for each transfer (s.41(2)).
How long we keep it
We keep personal data only as long as needed for the purpose it was collected for (s.24(1)(d)), then delete it automatically.
| Data | Kept for |
|---|---|
| DataBuyer conversations and bookings | Kept for12 months after the last message, or less if the dealer tells us to delete them sooner |
| DataEverything we hold for a dealer who leaves | Kept forDeleted within 30 days of the account closing. Backups roll off within a further 30 days |
| DataDealer account and payment records | Kept forWhile the account is open, then as long as tax and accounting law requires |
| DataUsage records (counts and costs, no message text) | Kept for24 months |
| DataWebsite server and security logs | Kept for30 days |
How we protect it
We use technical and organisational measures appropriate to a small service (s.39). These include encryption in transit, encryption at rest for WhatsApp credentials, and access limited to the people who run Mouthpiece. We also keep message text out of our application logs, delete data on a schedule, and review our providers' security commitments.
Children
Mouthpiece is for car dealers and adult car buyers, not for children. The NDPA takes its definition of a child from the Child's Right Act 2003, and requires a parent's or guardian's consent before a child's data is processed on the basis of consent (s.31). We don't knowingly process children's data. If we learn that a child has been messaging an assistant, we'll delete that conversation.
If something goes wrong
If a breach affects buyers' data we hold for a dealer, we'll tell that dealer without delay, with what we know about it (s.40(1)). Where we are the controller, we'll notify the Nigeria Data Protection Commission within 72 hours of becoming aware of a breach that is likely to put people at risk (s.40(2)). If the risk to you is high, we'll tell you directly and explain what you can do (s.40(3)). We keep a record of every breach (s.40(8)).
Your rights
Under Part VI of the NDPA you can:
- Access your data: ask whether we hold it, why, who receives it and for how long, and get a copy in a common electronic format (s.34(1)(a) and (b))
- Correct data that is inaccurate, out of date or incomplete (s.34(1)(c))
- Erase your data (s.34(1)(d))
- Restrict processing while a request or objection is being resolved (s.34(1)(e))
- Withdraw consent at any time, where we rely on consent (s.35)
- Object to processing, including to any direct marketing, at any time (s.36)
- Ask for a person instead of the AI assistant and contest an automated outcome (s.37)
- Receive or move your data in a machine-readable format (s.38)
How to use them:
- Buyers: send “delete my data” (or any other request) to the dealer's Mouthpiece number, or email privacy@usemouthpiece.com. We'll pass it to the dealer and help them act on it.
- Dealers and anyone else: email privacy@usemouthpiece.com.
We'll respond within 30 days and may ask you to confirm who you are first.
Complaints: if you're unhappy with how we handled your data, you can complain to the Nigeria Data Protection Commission (s.46). We'd appreciate the chance to fix it first.
Changes and contact
We'll update this policy when our processing changes and show the new effective date at the top. For material changes, we'll tell dealers directly.
Al-Hafiz Technologies (RC 9977206), Nigeria · privacy@usemouthpiece.com · Effective 1 November 2026