Privacy Policy

1. Who is responsible for your data

TRYSA TECHNOLOGIES LIMITED ("TRYSA", "we") is the data controller for information about account holders, staff users and visitors. When a studio stores information about its own clients, leads, models or guests in TRYSA, the studio is the controller and TRYSA is its processor (see Data Processing Terms). If you are a studio's client and want to see or delete your data, contact the studio first; we will help them respond.

We handle personal data under the Nigeria Data Protection Act 2023 (NDPA) and, where it applies to you, other privacy laws such as the GDPR. Privacy contact: privacy@trysa.app.

2. Age

TRYSA is for people 18 and over. We do not knowingly collect data from children for their own accounts. If you believe a child has an account, tell us at privacy@trysa.app and we will delete it. Studios that store photos or details of minors must have a parent or guardian's consent.

3. What we collect

• Account data: name, email, phone, username, password (stored hashed by our authentication provider), workspace and role details.
• Workspace content: clients, bookings, quotes, contracts, invoices, expenses, galleries, photos and files, messages and notes that you or your team enter.
• Payment data: payment status, amounts, references and the payer's name/email. Card and bank details go to our payment partner; we do not store full card numbers.
• Gallery interactions: favourites, selections, comments and proofing choices made by people with a gallery link; the PIN attempts count to protect galleries.
• Face-recognition data (optional feature): if a studio turns on face search in a gallery, a numerical face descriptor is created from photos. This is biometric, sensitive personal data and is used only for that feature. Studios must obtain explicit consent first (see section 8).
• Technical data: IP address, device/browser information, security logs and rate-limit counters, and basic usage analytics.
• Messages: email and WhatsApp messages sent through TRYSA are logged (recipient, template, delivery status).

4. Why we use it (lawful bases)

• To provide the service you asked for (contract).
• To keep TRYSA secure, prevent fraud and abuse, and fix problems (legitimate interests).
• To meet legal obligations, such as tax and record-keeping.
• With consent where required, for example optional cookies, marketing messages, and face recognition.

We do not sell personal data. We do not use workspace content to train AI models (see the AI Usage Policy).

5. Who we share it with

We use service providers who process data for us under contract, including providers for hosting and database (Supabase, Cloudflare), email delivery (Resend), WhatsApp and messaging (Bird), payments (Paystack), and video/real-time features. We may also disclose data when required by law or to protect rights, safety and security. A current list of providers is available at privacy@trysa.app.

6. Transfers outside Nigeria

Our providers run infrastructure in several countries, so your data may be processed outside Nigeria. We use providers that commit to appropriate safeguards and we only transfer data in line with the NDPA's requirements on cross-border transfers.

7. How long we keep it

We keep account data while your account is active and for a limited time after, as needed for legal, tax and dispute purposes. Workspace content is deleted after you close the workspace, within the periods in Delete your account. Records we must keep by law (for example invoice and payment records) are kept for the legally required period. Backups roll off on a schedule, so deleted data may remain in a backup for a short time before being overwritten.

8. Biometric (face) data and photos of people

Photos of people are personal data. Face recognition processes biometric data, which the NDPA treats as sensitive. Face search is off unless the studio turns it on. A studio that turns it on must (a) tell the people concerned clearly, (b) obtain their explicit consent, and for under-18s that of a parent or guardian, and (c) stop and delete face data on request. If you appear in a gallery and do not want to be searched by face, tell the studio or email privacy@trysa.app and we will help.

9. Your rights

Under the NDPA you may ask to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable format, withdraw consent at any time, and not be subject to solely automated decisions with significant effect. Email privacy@trysa.app and we will answer within 30 days. You may also complain to the Nigeria Data Protection Commission (NDPC).

10. Security

We use technical and organisational measures described on our Security page. No system is perfectly secure, and we cannot guarantee absolute security. We will notify the NDPC and affected people of a data breach as the law requires.

11. Cookies

See the Cookie Policy.

12. Changes

We will update this policy when our practices change and will notify account holders of material changes. The date at the top shows the latest version.