Privacy Policy

MYLO is provided by DoubleU AI Africa Limited (RC 9689428), 20 Oba Adesoji Street, Annex Works and Housing Estate, Gwarinpa, Abuja, FCT, Nigeria (“DoubleU”, “we”). Contact us about anything in this policy at info@doubleuai.africa.

We decide how and why personal data is used for our own accounts: the businesses that use MYLO, their staff, people who sign up, and people who contact us. For this data we are the data controller.

When a business uses MYLO to take orders, that business decides how its customers’ data is used. The business is the data controller and we process its customers’ data on its behalf, under our Data Processing Addendum (mylo.africa/dpa).

Business owners and staff: name, phone number, email address, role, login details, and the IP address of login attempts (used to stop repeated wrong guesses).

A business’s customers: name, phone number, what was ordered, table or delivery address, payment receipts uploaded in chat, chat messages with the ordering agent, and any review left.

People who contact us or sign up: the details entered in the form — name, business, phone, email and message.

Businesses scored by our free Readiness Grader: information the business has made public on its Instagram business profile.

We do not collect payment card numbers. Card payments are handled by Paystack.

To provide MYLO — run your store, take and route orders, send order updates, print receipts, and bill for the service. The basis is the contract with the business.

To keep MYLO secure and working — rate limits, login protection and error monitoring. The basis is our legitimate interest in a safe, reliable service.

To keep financial records. The basis is our legal obligations.

To contact businesses about MYLO. The basis is our legitimate interest, and you can object at any time; each such email tells you how.

We do not sell personal data, and we do not use it for advertising.

We use the following service providers. Each receives only the data it needs for its job. The full list, with what data each one receives, is at mylo.africa/subprocessors.

Supabase — our database — where every account, catalogue, order and customer record is stored (Germany (Frankfurt, EU)).

Vercel — hosting the mylo app and storefronts, and storing uploaded images (United States (Washington DC), with a global delivery network).

Paystack — card and bank payments, for subscriptions and for businesses that take payments through mylo (Nigeria).

Voiceflow — the ai ordering agent's conversations (Canada and United States).

OpenAI — reading uploaded menus, writing product descriptions, and transcribing voice notes (United States).

Resend — sending account and order emails (United States).

Upstash — rate limiting and login protection (United States).

Sentry — error monitoring, so we can find and fix faults (United States).

Google Maps Platform — delivery-address suggestions and finding a business's public listing (United States).

Cloudinary — storing payment receipts a customer uploads in the ordering chat (United States).

PrintNode — sending orders to a business's receipt printer, where cloud printing is used (United Kingdom).

Google Workspace — our own email, where you write to us (United States).

For the free Readiness Grader only, we use Apify to read public Instagram business profiles. It never receives customer data.

A business’s customer data is also visible to that business and its staff, according to the roles the business sets.

Our database is in Germany, and several of our providers process data in the United States, Canada or the United Kingdom. Data leaves Nigeria because running the service requires it, and each provider is bound by its own data-protection terms with safeguards for the data it handles.

MYLO uses AI to answer customers in the ordering chat, read menus that businesses upload, write product descriptions, and transcribe voice notes.

We do not train AI models on your data. Our AI providers’ business terms do not allow them to train on it either: OpenAI does not train on data sent through its API, and Voiceflow does not use customer data to train AI models and runs its model providers with zero data retention.

AI replies can be wrong. A business reviews its prices and items before they go live.

We use a login cookie to keep you signed in, and browser storage to remember your preferences, keep orders taken while offline until they can be sent, and hold the ordering chat’s session. These are needed for MYLO to work.

We use no advertising or analytics trackers.

Business accounts and staff: while the account is active, and for 90 days after it ends.

Orders and payments: up to six years, the period for which Nigerian tax law requires financial records to be kept.

An unconverted free trial: at least 30 days after it ends, after which it may be archived (see the Terms).

Contact-form and sign-up enquiries that do not become customers: 24 months.

You can ask us to give you a copy of your data, correct it, delete it, or send it to you in a usable format. You can object to how we use it, including for direct marketing, and withdraw any consent you gave. We reply within one month.

If you are a customer of a business that uses MYLO, ask that business first, since it controls your data. We will help it answer you.

Write to info@doubleuai.africa. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission (ndpc.gov.ng).

Data is encrypted in transit (HTTPS). Payment and integration keys that businesses store with us are encrypted at rest (AES-256-GCM). Each business’s data is kept separate from every other business’s. Repeated wrong login attempts are locked out, and our error monitoring does not record screen sessions.

If a breach affects personal data, we notify the Nigeria Data Protection Commission within 72 hours where the law requires it, and tell the people affected where the risk to them is high. We tell affected businesses within 48 hours of becoming aware.

MYLO is not directed at anyone under 18. Businesses that sell alcohol or other age-restricted goods are responsible for their own age checks.

The version and date at the top show when this policy last changed. We email businesses about material changes before they take effect.