1. Introduction

Lalapinta ("we", "our", "us") is operated by Dee Empire, a company registered in the Republic of Sierra Leone. We are committed to protecting the privacy and personal data of every person who uses our platform.

This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights you have over your personal data. It applies to your use of the Lalapinta mobile application, website, and all related services.

By registering an account or using Lalapinta, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use our services.

2. Who We Are (Data Controller)

For the purposes of data protection law, the data controller responsible for your personal information is:

Dee Empire

Freetown, Republic of Sierra Leone 🇸🇱

Email: privacy@dee-empire.com

Dee Empire is registered as a business entity in Sierra Leone under the Companies Act 2009. Our operations are subject to the laws and regulations of the Republic of Sierra Leone, including applicable regional frameworks adopted by Sierra Leone as a member state of the Economic Community of West African States (ECOWAS).

3. Information We Collect

a) Information you provide directly

Full name and username
Email address and password (stored as a secure hash — never in plain text)
Profile photo and cover photo
Bio, city, country, and optional website link
Posts, comments, messages, stories, reels, and any other content you create
Marketplace listings (product name, price, description, location, photos)
Seller verification information submitted during the verification process
Reports and communications you submit to our support team

b) Information collected automatically

Device type, operating system version, and unique device identifiers
IP address and derived approximate geographic location (city/country level)
App usage data: screens visited, features used, session duration
Push notification tokens (for delivering notifications to your device)
Crash reports and performance diagnostics
Log data: timestamps, referrer URLs, error messages

c) Information from third parties

If you sign in using a third-party provider (e.g. Google, Apple), we receive your name and email address from that provider in accordance with your permissions.
If another user tags you in content or sends you a message, that interaction is recorded as part of the platform's normal operation.

4. How We Use Your Information

We use the information we collect to:

Provide our services — create and manage your account, deliver your feed, enable messaging, live streaming, and marketplace functions.
Personalise your experience — tailor content, recommendations, and notifications based on your activity and preferences.
Communicate with you — send service notifications, security alerts, updates about the platform, and (where you have opted in) marketing communications.
Ensure safety and security — detect and prevent fraud, abuse, spam, identity theft, and violations of our Community Guidelines.
Process marketplace transactions — facilitate connections between buyers and sellers and support dispute resolution.
Improve and develop Lalapinta — analyse usage patterns to fix bugs, build new features, and improve overall performance.
Comply with legal obligations — respond to valid legal process, court orders, or regulatory requirements under Sierra Leone or applicable law.

5. Legal Basis for Processing

In accordance with the ECOWAS Supplementary Act A/SA.1/01/10 on Personal Data Protection (adopted 16 January 2010), which establishes the regional data protection framework for ECOWAS member states including Sierra Leone, we process your personal data on the following legal bases:

Performance of a contract — processing necessary to provide the Lalapinta service you have signed up for (account creation, content delivery, messaging, marketplace).
Legitimate interests — processing necessary for our legitimate interests in operating, securing, and improving the platform, provided those interests do not override your fundamental rights and freedoms.
Consent — where you have given explicit consent, such as for optional marketing communications or push notifications. You may withdraw consent at any time.
Legal obligation — processing required to comply with applicable Sierra Leone law, including the Electronic Crimes Act 2021 (Act No. 8 of 2021) and any order from a competent authority or court.

ECOWAS Data Protection Principles

The ECOWAS Supplementary Act A/SA.1/01/10 sets out the following principles that we observe: lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Our data processing practices are designed to comply with these principles.

7. Data Storage & Security

Your data is stored on Supabase infrastructure with the following protections in place:

HTTPS/TLS encryption for all data in transit
Encryption at rest for stored data
Password hashing — we never store your password in readable form
Row-level security (RLS) policies on all database tables — each user can only access data they are authorised to see
Regular security reviews and vulnerability assessments
Access controls limiting which staff can access personal data

No method of electronic storage or transmission is completely secure. In the event of a data breach that affects your personal information, we will notify you without undue delay, and in any case within the timeframe required by applicable law.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:

Account data — retained until you delete your account. Following deletion, we remove your personal data within 30 days, except where we are required to retain certain data for legal or compliance purposes.
Content — posts, comments, and media you delete are removed from public view immediately; residual copies may remain in backup systems for up to 90 days.
Log and diagnostic data — retained for up to 12 months for security and operational purposes.
Legal holds — where data is subject to a legal obligation or dispute, we may retain it beyond the standard retention period until the matter is resolved.

9. Your Rights

Under the ECOWAS Supplementary Act A/SA.1/01/10 and applicable Sierra Leone law, you have the following rights regarding your personal data:

Right of Access — request a copy of the personal data we hold about you.
Right to Rectification — update or correct inaccurate information. Most profile information can be updated directly in the app settings.
Right to Erasure — request deletion of your account and associated personal data. Submit a request to privacy@dee-empire.com or delete your account directly from the app.
Right to Restriction — request that we restrict processing of your data in certain circumstances (for example, while you contest its accuracy).
Right to Data Portability — request your data in a structured, commonly used, machine-readable format.
Right to Object — object to our processing of your data on grounds of legitimate interests or for direct marketing purposes.
Right to Withdraw Consent — where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at privacy@dee-empire.com. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

10. Children's Privacy

Lalapinta is not intended for children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you are a parent or guardian and believe your child has registered an account on Lalapinta, please contact us immediately at privacy@dee-empire.com and we will delete the account and associated data without delay.

Users between the ages of 16 and 18 must have obtained parental or guardian consent before using Lalapinta.

11. Third-Party Services

Lalapinta integrates with the following categories of third-party services to operate the platform:

Supabase — database, authentication, and real-time infrastructure
LiveKit — real-time audio/video infrastructure for live streaming
Google Vertex AI (Gemini) — only when you use Salone 80s: your selfie is used to create your 80s photo (and, if you choose, that photo is turned into a short video) and deleted within 24 hours (or kept privately for up to 6 months if you choose to help improve the feature). Not used to train models
Google Vertex AI (Gemini) — only when you use AI Assist: the photos you selected, or the post you are replying to, are processed to suggest a caption or comment. Not used to train models; we keep the suggested text and a photo fingerprint for up to 30 days, never the photo itself
Cloud storage providers — for storing user-uploaded media files
Push notification services — Apple APNs and Google FCM for delivering notifications to your device
Analytics services — anonymous, aggregated usage analytics to help us improve the platform

Lalapinta may also contain links to external websites operated by third parties. We are not responsible for the privacy practices of those websites and encourage you to review their policies before providing any information.

12. International Data Transfers

Our service providers may process your data outside of Sierra Leone, including in the European Union and the United States. Where your data is transferred internationally, we ensure appropriate safeguards are in place, such as:

Standard contractual clauses approved by data protection authorities
Transfers to providers operating in jurisdictions with adequate data protection standards
Data processing agreements requiring providers to maintain equivalent protections

These transfers are made in compliance with the principles of the ECOWAS Supplementary Act A/SA.1/01/10, which requires that personal data transferred internationally receives an adequate level of protection.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will notify you by posting a prominent notice in the Lalapinta app and/or sending an email to the address associated with your account.

Continued use of Lalapinta after the effective date of an updated Privacy Policy constitutes your acceptance of the changes. If you do not agree with any change, you should stop using the service and may request deletion of your account.

14. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact our Data Protection contact:

Lalapinta — Dee Empire