Legal
Privacy Policy
What personal data Round Table collects, why, who receives it, how long it is kept, how it is protected, and your rights under the Nigeria Data Protection Act 2023.
Effective 6 October 2026
The short version
- We collect what we need to run Round Table: your name and email, what you put on boards, and basic technical data to keep it secure.
- We never sell your data, show you ads or use your content to train AI models.
- Private cards are encrypted and visible only to you. Search engines never see boards, workspaces or recordings.
- Some features use trusted providers (hosting, email, AI, speech recognition), some of them outside Nigeria, with safeguards the law requires.
- You can ask to see, correct, export or delete your data, and you can complain to the Nigeria Data Protection Commission.
This summary helps you read the privacy policy; the full text below is what applies.
Contents
- 1. Who we are
- 2. What we collect
- 3. When your organisation is in charge
- 4. Why we use it, and our lawful basis
- 5. AI and automated processing
- 6. Who receives your data
- 7. Transfers outside Nigeria
- 8. How long we keep it
- 9. How we protect it
- 10. Your rights
- 11. Cookies and storage on your device
- 12. Children
- 13. The mobile app
- 14. Changes to this policy
- 15. Contact and data protection officer
1. Who we are
The operator of Round Table runs Round Table and is the data controller for the personal data described in this policy, within the meaning of the Nigeria Data Protection Act 2023 ("NDPA"), except where Section 3 says an organisation is the controller.
Write to us by replying to any email Round Table has sent you.
This policy applies to the Round Table website, web app, mobile apps, API and integrations. It follows the NDPA and the General Application and Implementation Directive (GAID) issued by the Nigeria Data Protection Commission ("NDPC" or "the Commission").
2. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | What it includesName, email address, profile picture, presence colour, the sign-in method you use (email link, Google, Microsoft or Apple) and the identifier that provider gives us. | Where it comes fromYou, or the sign-in provider you choose. |
| Your Content | What it includesBoards, cards, comments, decisions, outcomes, action items, check-ins, files and pictures, documents you add to a workspace's knowledge, templates you submit, and the AI output generated from them. | Where it comes fromYou and people in your workspaces. |
| Calls | What it includesYour name in the call, live audio and video (passed through, not stored), and when a host turns them on: captions, transcripts, recordings, translations and speaking-time levels used for private host nudges. | Where it comes fromYou and other participants. |
| Organisation and membership | What it includesOrganisations, workspaces and roles you belong to, invitations sent and accepted. | Where it comes fromYou and organisation admins. |
| Usage and activity | What it includesWhat happened on boards you can see (for activity feeds, notifications and catch-ups), your milestones (first board, first teammate, first finalised meeting) and aggregated usage counts. | Where it comes fromYour use of the Service. |
| Technical and security | What it includesIP address, browser or app type (user agent), sign-in times, device sessions and security events, kept to protect accounts and prevent abuse. | Where it comes fromYour device. |
| Communications | What it includesEmails we send you (sign-in links, mentions, reminders, digests, recaps), your notification choices and messages you send us. | Where it comes fromYou and the Service. |
| Integrations | What it includesAccess tokens for services you connect (encrypted), and the data each integration exchanges, such as calendar events or exported documents. | Where it comes fromYou and the connected service. |
| Visitors and guests | What it includesFor people who try a board before signing up, the board and their IP address (for fair-use limits). For call guests, the name they type. | Where it comes fromYou. |
Sensitive personal data. We do not ask for sensitive personal data (such as health, religious, political, biometric, sexual or genetic data, or data about children). Please do not put it on boards. If you do, you are responsible for having the explicit consent the NDPA requires. Voice recordings are used to transcribe what was said, never to identify people by their voice.
3. When your organisation is in charge
When you use Round Table through an organisation (for example your employer or school), that organisation decides who can see its workspaces and what happens to their content. For that content the organisation is the data controller and we are its data processor: we process it only on the organisation's documented instructions, under a duty of confidentiality, and with the security this policy describes.
If you have questions about workspace content controlled by an organisation, or want to exercise your rights over it, contact that organisation first. We will help it respond.
4. Why we use it, and our lawful basis
Section 25 of the NDPA allows personal data to be processed only on a lawful basis. These are ours:
| Purpose | Lawful basis (NDPA s.25) |
|---|---|
| Creating your account, signing you in, and providing boards, calls, AI Features, notifications and integrations you ask for | Lawful basis (NDPA s.25)Performance of a contract with you |
| Recording, transcribing or translating a call, when a host turns it on | Lawful basis (NDPA s.25)The host's or organisation's legitimate interests, with notice shown to every participant; consent where the law requires it |
| Connecting a service you choose | Lawful basis (NDPA s.25)Your consent, which you can withdraw by disconnecting it |
| Keeping the Service secure: detecting abuse, preventing fraud, rate limits, audit logs | Lawful basis (NDPA s.25)Our legitimate interests, and legal obligations |
| Product emails such as digests and the weekly summary | Lawful basis (NDPA s.25)Our legitimate interests in helping you follow through; you can turn each one off in Settings |
| Understanding how the Service is used, from counts and aggregated figures | Lawful basis (NDPA s.25)Our legitimate interests in improving the Service |
| Complying with law, court orders and regulators, and defending legal claims | Lawful basis (NDPA s.25)Legal obligation, and our legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and expectations, and we do not rely on them where your interests override ours. You can object at any time (Section 10).
We do not use your personal data for direct marketing by third parties, and we do not sell, rent or trade it.
5. AI and automated processing
- When you use an AI Feature, the parts of the board, transcript or document needed to answer are sent to our AI provider to produce the result. The AI only reads what you are allowed to see, and never anyone's private cards for someone else.
- We do not use your content to train AI models. Where a provider offers a setting to stop customer data being used to improve its models, we turn it on.
- Round Table does not make decisions based solely on automated processing that produce legal or similarly significant effects on you (NDPA s.37). Coach nudges, lessons and follow-through rates are suggestions for people to consider.
- Your kept-promise rate is shown only to you. Managers and organisation admins see team totals, never one person's record.
6. Who receives your data
People you work with. Members of your organisations and workspaces see what their role allows: board content, your name and picture, your presence on a board, and activity. People you send a share link, recap or call link to see what that link shows.
Service providers (data processors) who work for us under written contracts that require confidentiality, security and use only on our instructions:
| Provider | What they do | Data involved |
|---|---|---|
| Amazon Web Services | What they doHosting, storage and databases | Data involvedAll data the Service holds |
| Our email delivery provider | What they doSending sign-in links, notifications and summaries | Data involvedName, email address and email content |
| Anthropic | What they doAI Features and caption translation, when enabled | Data involvedThe board, transcript or document text an AI request needs |
| Deepgram | What they doSpeech recognition for captions and uploaded recordings, when enabled | Data involvedCall audio and uploaded recordings |
| Voyage AI | What they doMeaning-based search across meeting memory, when enabled | Data involvedText of decisions and notes being indexed |
| Google, Microsoft, Apple | What they doSigning in, if you choose them | Data involvedYour name, email and account identifier |
If the server does not use a speech provider, captions are produced by your own browser or phone's speech recognition, which may be provided by your browser or phone maker (for example Google in Chrome) under its own privacy terms.
Services you connect. Integrations send data to the services you choose, under their own policies.
Legal requirements. We disclose personal data where Nigerian law requires it, or in response to a valid court order or a lawful request from a regulator or law enforcement agency. We check that each request is lawful, disclose only what it requires and, where the law allows, tell you first.
Business transfers. If Round Table is merged, acquired or sold, personal data may pass to the new owner, who must keep honouring this policy. We will tell you before that happens.
7. Transfers outside Nigeria
Our hosting and some providers are located outside Nigeria. We transfer personal data abroad only as Part VIII of the NDPA (sections 41 to 43) allows: to a country, region or sector the Commission recognises as having adequate protection; or under appropriate safeguards such as binding contractual clauses that give your data protection at least equivalent to the NDPA; or, where neither applies, on another basis section 43 permits, such as the transfer being necessary to perform our contract with you.
We record the basis for each transfer, and you may ask us for information about the safeguards that apply.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account details | Kept forWhile your account is open; deleted at once when you delete it in Settings, or within 30 days of a request to us |
| Your Content | Kept forUntil you, or the organisation that controls it, delete it |
| Call recordings and transcripts | Kept forUntil deleted from the board or the board is deleted |
| Trial boards made before signing up | Kept for7 days, unless you keep the board by signing up |
| Sign-in links | Kept for15 minutes until they expire; removed a day later |
| Device sessions | Kept forUntil you sign out, or after 30 days without use |
| Security logs and audit records | Kept forUp to 12 months, longer only where needed for an investigation or legal claim |
| Backups | Kept forDeleted data leaves backups within 90 days |
We may keep data longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim, and only for as long as that need lasts. Aggregated figures that cannot identify anyone may be kept.
9. How we protect it
- Connections are encrypted with HTTPS (TLS). Private cards and integration access tokens are encrypted at rest with keys held separately from the data.
- Sign-in links and API tokens are stored only as one-way hashes. Session cookies cannot be read by scripts on the page.
- Access is limited by role. Site admins see account details and counts, never board content, and everything they do is written to an audit log.
- Boards, workspaces and recordings are hidden from search engines, and the API refuses to be indexed.
- We review security regularly and limit who can reach production systems.
If a breach happens. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Commission within 72 hours of becoming aware of it, as section 40 of the NDPA requires. Where it is likely to result in a high risk, we will tell you without undue delay, in plain language, with what happened, the likely consequences, and what we and you can do.
No system is perfectly secure. Protect your email account, since it is how you sign in.
10. Your rights
Under sections 34 to 38 of the NDPA you have the right to:
- be informed about how your personal data is used, which this policy does;
- access your personal data and receive a copy of it;
- rectify inaccurate or incomplete data (you can change your name, picture and colour in Settings at any time);
- erase your data where there is no longer a lawful reason to keep it;
- restrict processing while a concern is being resolved;
- data portability: receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically possible;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent where we rely on it, without affecting processing done before;
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects on you.
How to use them. Reply to any email Round Table has sent you from the email address on your account and say what you would like. We may ask you to confirm your identity. We respond within 30 days, free of charge, unless a request is manifestly unfounded or excessive. If we cannot do what you ask, we will explain why.
Many things you can do yourself at any time: edit your profile, change which emails you receive, sign out of every device, delete boards and cards you own, disconnect integrations, revoke API tokens, and delete your account in Settings, which erases your personal data at once (backups follow within 90 days).
Complaints. If you are unhappy with how we handled your data, please tell us first so we can put it right. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (ndpc.gov.ng).
11. Cookies and storage on your device
We use one essential cookie: a secure session cookie that keeps you signed in. Scripts cannot read it, and it expires after 30 days without use. Because it is strictly necessary to provide the Service you asked for, it does not need consent.
Your browser or phone also stores preferences locally, such as your theme, sidebar layout and announcements you have closed. They never leave your device and you can clear them at any time.
We use no advertising cookies, no third-party trackers and no cross-site tracking.
12. Children
Round Table is not directed at children. Anyone under 18 may use it only through a school or organisation that has obtained the consent of a parent or legal guardian as section 31 of the NDPA requires. We do not knowingly collect personal data from children without that consent. If you believe a child has given us personal data without it, contact us and we will delete it.
13. The mobile app
The app asks for permissions only when a feature needs them: the camera and microphone for calls, photos for pictures and uploads, and notifications for mentions and calls. You can turn any of them off in your phone's settings; the related feature then stops working.
14. Changes to this policy
We will post any update here with its effective date. If a change materially affects how we use your personal data, we will tell you by email or in the app before it takes effect and, where the law requires, ask for your consent again.
15. Contact and data protection officer
Write to us by replying to any email Round Table has sent you.
You can also reach the Nigeria Data Protection Commission at ndpc.gov.ng.