Legal
This explains what personal data EstateCopilot collects, why, who we share it with, and the choices you have — whether you're a landlord, a tenant, a verified artisan, a referral partner, a visitor to this website, or someone who messages us on WhatsApp.
On this page
EstateCopilot is a property-management platform for Nigerian landlords, tenants and verified artisans, operated by B.S.O.E LTD (trading as the British School of Outdoor Education), a company registered in England and Wales, company number 08938266. We are the "data controller" for the personal data described below — we decide what it's used for and how.
This one policy also covers the shared WhatsApp line that fields enquiries for two related campaigns — AI Academy (practical AI/technology classes) and Becoming a New Nigerian (a mindset and nation-building community under the Return to Nigeria Initiative) — because messaging any of the three starts on the same number. Each has its own scope, described in section 3.
Name, email, phone number, a password (stored hashed, never in plain text), state, subscription payment records, and the connected bank account you provide so rent can be paid straight to you. We use this to run your account, process your subscription payment, and give you the dashboard (properties, tenancies, finance & levies, maintenance, bookings, legal requests, AI-drafted tenant replies).
Name and phone number (added by your landlord when they invite you), the tenancy and rent-payment details needed to run your tenancy, messages you exchange with your landlord (Correspondence), maintenance reports, and your e-signature on the tenancy agreement. Where a landlord runs identity vetting on a prospective tenant, we process the NIN or BVN only to confirm a name match against the national database — the number itself is never stored or shown to anyone, only the match outcome and a display-safe resolved name.
Phone number, name, business name and bio, the state/LGA you're based in and willing to cover, your trades and years of experience, work-sample photos, and availability. To verify your identity (which is what lists you publicly), we process your NIN or BVN the same way as above — checked only for a name match, the number itself never stored or shown. Once listed, your name, business name, trades, ratings, work photos and phone number are shown publicly in the artisan directory so landlords and tenants can find and contact you directly — that visibility is the point of joining the directory.
Name, email, phone number, a password (stored hashed), agency name, the states you cover, and the bank account you add so your share of an agency fee can be paid to you. We record which listings you shared, the viewing requests that came through your link, and the deals a landlord confirms with you.
When you book a daily or student stay we collect your name, phone and email, your dates, and the payment reference. Every guest gives a BVN or NIN for an identity check against their name: we send it to our identity-verification provider for a single name match and keep only the type of ID, its last four digits and the name the registry returns — never the full number, and the host never sees it. For student stays we also collect your school, a photo of your student ID (stored privately and shown only to the host of the place you asked to book), and the name, phone, email and relationship of a parent, guardian or sponsor, who is your emergency contact and may be sent the payment link and booking updates. Move-in and move-out condition reports (notes and room photos), problems you report, your caution-fee record and any review you leave are kept with the booking. Your review is shown publicly with your first name only.
The app (iOS and Android) uses the same account and data as the website. In addition it handles: photos you choose to attach to a property, repair or condition report; a short voice note a tenant may record to describe a repair (the microphone is used only while you are recording); and, on iPhone, a push-notification token so we can tell you about repairs, quotes and rent reminders. If you switch on the app lock, Face ID / fingerprint checks are done by your phone — we never receive biometric data. The app keeps a copy of your most recent screens on your phone so it works offline; signing out clears it. The app contains no advertising and does not track you across other apps or websites. You can delete your account in the app (Account → Delete account) or as described on our account deletion page.
Your phone number, name and bank details (once you add them to be paid), and records of which landlords signed up through your referral link, so we can calculate and pay your commission.
If you fill in a form on this site — booking a property viewing, requesting an artisan quote, submitting a legal or handyman enquiry — we collect what that form asks for (typically name, phone, and email) to act on your request and, only if you tick the box, to send you WhatsApp updates.
Rent, subscription and other payments on EstateCopilot are processed by Paystack. We never see or store your card number, CVV or full bank login — Paystack handles that directly and we only receive a payment reference and amount.
When you message us on WhatsApp — about EstateCopilot, AI Academy, or Becoming a New Nigerian — or agree to receive WhatsApp messages from us, we process:
Why. To answer your enquiry; to help you search property listings, contact verified artisans, book viewings, enquire about AI Academy classes, or register for Becoming a New Nigerian; to capture and follow up leads; and, where you've opted in, to send you relevant updates. Our legal basis is your consent for marketing messages, and our legitimate interest — or steps to enter a contract at your request — for responding to enquiries.
See section 4 for how the automated assistant works, section 10 for the AI Academy for Teens safeguard, and section 6 for who we share this with.
Two features use an AI model (Anthropic's Claude) to help draft or generate replies:
Neither makes a decision with a legal or similarly significant effect about you. The message text involved is sent to Anthropic for processing — see section 6.
This site does not use advertising or analytics cookies. The only thing we store in your browser is a small marker — for up to 30 days — recording which referral partner's link you arrived from, if any, so that partner is credited correctly if you later sign up as a landlord. It contains no personal data and is never read by anyone but this site.
Data is processed primarily in Nigeria and Western Europe (Microsoft Azure West Europe), with some providers based in the United States (Anthropic, Meta, Twilio, Resend) and India (Microsoft support). Where data leaves Nigeria, we rely on the provider's own standard safeguards (such as Standard Contractual Clauses) as applicable.
We keep account and tenancy records for as long as the account is active, plus a reasonable period afterwards to meet legal, accounting or dispute-resolution needs. WhatsApp conversation records are kept for up to 24 months after your last message, then deleted or anonymised, unless we need to keep them longer for a legal obligation. NIN/BVN numbers themselves are never stored at all — see section 2.
To exercise any of these, contact us using the details in section 14. This processing is carried out in line with the Nigeria Data Protection Act 2023 and, where applicable, UK GDPR.
The university-student and working-professional AI Academy programmes deal directly with the enquirer, as normal.
Passwords are stored hashed, never in plain text. Access to production systems and the WhatsApp conversation console is restricted to authorised team members. NIN/BVN numbers are never stored — only the outcome of a single verification check. No system is perfectly secure, but we take reasonable technical and organisational steps to protect what we hold.
Any request from a government body, court, regulator or law-enforcement agency for personal data we hold is routed to a named person on our team and is not actioned by anyone else. Before any disclosure we:
Where lawful, we notify the affected user before disclosure. We have not provided personal data to a public authority for a national-security request in the past 12 months.
We may update this policy as the platform changes. Material changes will be reflected by updating the "Last updated" date at the top of this page.
For anything about this policy, or to exercise any of your rights above, contact us at john@bsoedu.org.