Last updated 6 October 2026
Privacy policy
To notarise, certify or legalise a document for you, we have to handle it, and it usually carries some of the most personal information you have. This policy explains what we collect, why, who else sees it, how long we keep it, and the rights you have under the Nigeria Data Protection Act 2023.
1. Who we are
BondSeal (“we”, “us”) is a document-lodgement service based in Abuja, Nigeria. We take documents to notaries, commissioners for oaths, registries, ministries and embassies for our clients, then return them. For the personal data described here, we are the data controller.
Contact for anything about your data: contact@bondseal.ng.
2. What we collect
You give us
- Account details: your full name, email address, phone number, town if you give it, and a password. We store the password only as a one-way hash; nobody at BondSeal can read it.
- Your documents: the files you upload, and the information they contain. That can include identity details, dates of birth, addresses, signatures, and details of property, education, marriage or business.
- Request details: which service you need, how many copies and pages, which offices the document must visit, and any notes you add.
- Messages you send us in your case chat or through the contact form.
- Your authorisation signature: when you sign the letter appointing us to act for you, we keep an image of the signature, the exact wording you agreed to, and the time.
- Delivery details: the recipient’s name, phone number and address, anywhere in the world.
- Payment records: amounts, dates and payment references. If you pay by card we do not see or store the card number; the payment provider handles it.
From Google, if you sign in with Google
Your name, email address, whether Google has verified that address, and a Google account identifier. We do not get your Google password, contacts, files or anything else in your Google account.
Collected automatically
- Security and audit records: your IP address and browser details when you sign an authorisation or when staff take certain actions, and a record of what happened to your case and when.
- Document fingerprints: a SHA-256 hash of every file we store, so we can prove a document has not changed.
- Visit counts: the page you opened, the site that linked you to us, and the country, region and city your connection comes from. We work the location out from your IP address when you arrive and do not keep the address itself. To count each visitor once a day we keep a scrambled code made from your connection and browser that changes every day, so it cannot be used to follow you from one day to the next. We use this only to see how many people find the site and from where.
- Error logs: technical details when something goes wrong on the site. These never contain the content of your documents.
3. Why we use it, and on what basis
| What we do | Legal basis |
|---|---|
| Create and run your account; lodge, track and return your documents; quote and take payment | Performance of our contract with you |
| Keep a record of your authorisation and of every step taken on your case | Contract, and our legitimate interest in being able to settle any dispute over what happened |
| Keep financial and transaction records | Legal obligation (tax and accounting law) |
| Secure the service, prevent fraud, and fix faults | Legitimate interest |
| Count visits to the website and see which countries and cities they come from | Legitimate interest in knowing who our service reaches. No cookie, and no IP address is kept |
| Draft first replies to your messages with an AI assistant (see section 4) | Legitimate interest in answering you quickly. A person always takes over anything that needs judgement |
| Reply to a contact-form enquiry | Steps taken at your request before a contract |
We do not sell your data, use it for advertising, or send you marketing without asking you first.
4. Who we share it with
To carry out your request
Your document, and whatever of your details the office needs, goes to the offices on its route. That can be a notary public or commissioner for oaths, a court or corporate registry, a ministry (for example the Ministry of Education or the Ministry of Foreign Affairs), or an embassy or high commission. Your delivery details go to the courier returning your documents. Each of these handles your information under its own rules and legal duties.
Service providers who process data for us
| Provider | What for | Where |
|---|---|---|
| Vercel | Runs the website and application | United Kingdom (London) |
| Neon | Database holding your account and case records | United Kingdom (London) |
| Cloudflare (R2) | Encrypted storage of your uploaded and returned documents | European Union |
| Anthropic | The AI assistant that drafts first replies in your case chat. It sees the message you send and the case context needed to answer. Every AI reply is clearly labelled as AI | United States |
| Resend | Sending emails about your account and case | United States |
| “Continue with Google” sign-in, if you choose to use it | United States | |
| Paystack | Card and online payments, if you pay that way | Nigeria |
We may also disclose information when the law requires it: to a court, a regulator or the police, acting on a lawful request.
5. Data stored outside Nigeria
As the table shows, our systems are hosted in the United Kingdom and the European Union, and some providers are in the United States. Where we transfer personal data outside Nigeria, we do so as the Nigeria Data Protection Act 2023 allows: to countries with adequate protection, or under contractual safeguards with the provider, or where the transfer is needed to perform our contract with you.
6. How long we keep it
Our records are built so they can settle a disagreement about what happened to a document. For that reason, case records are never edited or removed: the documents on a case, its history and your signed authorisation. We keep:
- Case records and documents for as long as your account exists, and for at least six years after your last case closes. Six years is the ordinary period for bringing a contract claim in Nigeria.
- Financial records for as long as tax and accounting law requires.
- Contact-form enquiries that never became a case for up to two years.
- Error logs only as long as we need them to fix a problem, then we delete them.
If you close your account, we deactivate it so nobody can sign in to it. We keep the records above until their retention period ends.
7. How we protect it
- Documents are never available at a public web address. Every download is checked against your account first.
- Data travels only over encrypted connections, and passwords are stored only as one-way hashes.
- Each document is fingerprinted when it arrives and again when it comes back, so any change can be detected.
- Staff see only what they need for their role. Every action on a case is recorded.
No system is perfectly secure. If a breach puts your data at risk, we will tell you and the Nigeria Data Protection Commission as the law requires.
8. Cookies
We use only the cookies the site needs to work:
- Sign-in cookie: keeps you signed in, for up to seven days.
- Google sign-in cookie: exists for a few minutes while you sign in with Google, and protects that step against forgery.
We do not use advertising or tracking cookies. The visit counts described in section 2 use no cookie at all.
9. Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything inaccurate or incomplete;
- delete your data, where we are not required or entitled to keep it (see section 6);
- restrict or object to how we use it, including anything based on our legitimate interests;
- send your data to you or to another provider in a commonly used format;
- withdraw any consent you gave, without affecting what we did before.
Email contact@bondseal.ng. We may need to confirm who you are first, and we will answer within the time the law allows. If you are unhappy with our answer, you can complain to the Nigeria Data Protection Commission.
10. Children
Our service is for adults. You must be 18 or over to open an account. A parent or guardian can submit a document concerning a child, such as a birth certificate, on the child’s behalf.
11. Changes to this policy
We will update this page when our practices change, and revise the date at the top. If a change materially affects how we use your data, we will tell you by email or on your dashboard before it takes effect.
See also our terms of service.
Questions about this page? Email contact@bondseal.ng or use the contact form.