V
VEKAby TheDaveka

VEKA Privacy Policy

Last updated 25 October 2026

VEKA is an AI receptionist that answers enquiries and takes bookings for businesses. It is developed and operated by THEDAVEKA TECHNOLOGIES (CAC BN 9784117), “TheDaveka”, “we” or “us”. This policy explains what we do with personal data under the Nigeria Data Protection Act 2023 (NDPA). It covers two groups of people: businesses that use VEKA, and customers who message or book with those businesses.

In plain words

  • We keep as little as possible: for customers, just a name, phone number and the booking.
  • Chat messages are deleted automatically after 30 days.
  • We never ask for medical details. Clinics book by appointment type only.
  • We never sell personal data or use it for advertising.
  • VEKA never holds your money. Payments go straight to the business through Paystack.
  • You can ask us to see, correct or delete your data at any time.

1. Who is responsible for your data

  • Business accounts: TheDaveka is the data controller for the details a business gives us to run its VEKA account.
  • Customers of a business: the business you contact is the data controller. TheDaveka is its data processor: we handle your details only to provide VEKA to that business and only on its instructions.

2. Data we collect

From businesses:

  • Account details: name, email address and password (stored only as a secure hash).
  • Business profile: business name, industry, phone, email, address, website, description, opening hours, timezone, currency and logo.
  • Billing records: plan and payment status. Card details are handled by Paystack; we never see full card numbers.
  • Security records: sign-in times and network (IP) addresses, used to protect accounts.

From customers of a business:

  • Your name and phone number.
  • Your booking: the service, date, time and status.
  • The messages you send to the business's assistant.
  • Whether you agreed to receive offers, and when.

We do not ask for health information, birthdays, home addresses or identity documents. If you share medical details in a chat, the assistant will not store or repeat them and will ask you to share them with the clinic directly.

3. Why we use it, and our lawful basis

  • To provide the service (contract): running business accounts, answering enquiries, making and confirming bookings, and sending booking reminders.
  • Legitimate interests: keeping VEKA secure, preventing fraud and abuse, and keeping short-term chat records so a business can check what was agreed.
  • Consent: promotional messages from a business, only if you said yes. Reply STOP at any time to opt out.
  • Legal obligations: tax, accounting and regulatory records.

4. Who we share it with

We share data only with service providers that help us run VEKA, under contracts that require them to protect it and use it only for us:

  • Hosting and database (Replit, United States).
  • An AI language-model provider that drafts the assistant's replies. Names, phone numbers and emails are removed before any text is sent.
  • Messaging (Meta's WhatsApp Business Platform) to send and receive chats.
  • Email delivery (Resend) for account and security emails.
  • Payments (Paystack) for subscriptions and for payments to businesses.

Businesses using VEKA are told before we add a new provider. We may also disclose data when Nigerian law requires it. We never sell personal data.

5. International transfers

Some of our providers are in the United States. We transfer data there under sections 41 to 43 of the NDPA, only as needed to provide the service you or the business asked for, with contractual safeguards, and after removing direct identifiers wherever practical.

6. How long we keep it

  • Chat messages: deleted automatically after 30 days.
  • Booking records: kept for the business’s records while it uses VEKA. A business can delete a customer at any time.
  • Business accounts: kept while the account is active and deleted within 30 days of closure, except billing and tax records, which we keep for up to six years as the law requires.
  • Security records: up to 12 months.

7. Security

Data is encrypted in transit (HTTPS). Passwords are stored as secure hashes. Each business’s data is kept separate from every other business’s. Access by our staff is limited to what is needed to run and support the service. Users can sign out of every device at once. No system is perfectly secure, but we work to prevent unauthorised access, loss or misuse.

If a breach affects personal data, we tell the affected business within 24 hours of confirming it and notify the Nigeria Data Protection Commission (NDPC) within 72 hours where required.

8. Your rights

Under the NDPA you can ask to:

  • see the personal data held about you and get a copy;
  • correct anything that is wrong;
  • have your data deleted;
  • object to, or restrict, how it is used;
  • withdraw consent at any time (for example by replying STOP);
  • receive your data in a format you can take elsewhere.

Customers of a business can ask that business directly, or email us at support@thedaveka.com and we will help. We respond within 30 days. You can also complain to the NDPC.

9. Children

VEKA accounts are for adults aged 18 and over. Businesses must not use VEKA to collect data from children without the consent required by law.

10. Changes and contact

If we change this policy we will update the date above, and tell businesses using VEKA about important changes before they take effect. See also our Terms of Service.

THEDAVEKA TECHNOLOGIES (CAC BN 9784117), No 12, Memunat Shitta Street, Ologolo, Lekki, Lagos, Nigeria.
Email: support@thedaveka.com · Phone: 0808 108 8007