Privacy

Privacy, in plain terms.

This notice follows the Nigeria Data Protection Act 2023.

Who we are

WantMyTime is run by Kredit Technologies Limited (RC 9834452), House No. 348, Jamaina Road, Pompomari Bypass, Maiduguri, Borno State, Nigeria. We decide how your personal data is used, which makes us the data controller. Our data protection officer can be reached at [email protected].

Anonymous messages

Talk Am is for adults aged 18 and over. Recipients receive your message and its campaign source, but not your account, email, browser credential, device details or network address. What you write can still identify you. We use a separate random browser credential to let you return to your conversations. It expires after 180 days; losing it can lose access unless you explicitly save your conversations to your verified account. Saving them never reveals that account to recipients.

Talk Am history persists until deletion, rather than disappearing after 30 days. Creators can pause submissions, block a browser relationship, report content or delete a conversation for both sides. Hidden-word matches may be held for review. Authorized moderators can inspect reported content and take audited action. Deleting your account removes its Talk Am content and claimed conversations. Security rate limits and internal account links are never sold as identity hints. When enabled, voice notes are disguised before delivery, using pitch, formant and timbre changes. Disguise cannot guarantee anonymity. Source recordings are processed in memory and never saved to our media bucket. Images are decoded and re-encoded without EXIF/GPS metadata. Processed media is delivered when sent, unless a creator’s hidden-word filter holds the message. Recipients can access it. Prepared attachments that are not sent expire after a day. Deleted media is made inaccessible immediately and queued for storage deletion. You can voluntarily reveal a clue, name or profile after confirmation; recipients may keep a copy. Optional reply notifications contain no message text. When video is enabled, it is pixelated and its audio is disguised; visible context can still identify you. Optional gifts use WMT’s payment provider and ledger. The provider receives the billing details needed for payment, while recipients receive only the gift amount and status. Financial records are retained as required for reconciliation and accounting. Reaction exports are public only when a creator chooses to share them.

What we collect

• Timed chats: the text, voice recordings, photos and documents the two booking participants exchange, read positions and short-lived foreground activity. We use these to deliver the conversation and its read/typing indicators.
• Questions and videos: the question, any file the buyer attaches, and the text, voice or video answer. A question can include sensitive details, such as health or legal matters, if the buyer chooses to write them; the seller sees them, and we use them only to deliver the answer. If a buyer sends a request as a gift, we also keep the name and email address they give for the recipient, and email the recipient a link to the answer. The camera and microphone are used only when a seller presses record. Each delivered answer has its own link. Anyone with that link can open the answer, even when the question is hidden. The buyer chooses whether to show their question and permit the seller to feature the answer on their page. We also keep a list of the buyers a seller has blocked.
• Your account: your email address and name, and the sign-in sessions you open.
• If you take bookings: your link, photo, short bio, profile link, prices, available hours and bank account for payouts. We store the full account number encrypted and show only its last four digits.
• Bookings and offers: who booked whom, when, for how long and for how much; the note a buyer may add about what they want to talk about; meeting links; reported problems, no-shows and cancellations.
• Payments: payment references, amounts and status from our payment provider. In countries where refunds are sent back to your mobile money wallet, the wallet number you pay from, stored encrypted. We do not take card payments, and we never see your bank login or mobile money PIN.
• Live events: your check-in details, optional marketing consent, chat, voice questions, votes, reactions and viewer presence. An account owns attendance linked through its verified session; guest attendance is controlled by its original browser credential. Event hosts and authorized operators can see event contributions and attendance. Free events use viewer-to-viewer sharing by default: while you watch, your browser may send video to a few other viewers, up to a small data limit each hour. It pauses on low battery, Data Saver and when the tab is in the background. Peer connections and their trackers can reveal your network address to the viewers you share with or to tracker services. You can turn sharing off in the player at any time. Use “Your event data” on the event page to download or erase your guest contributions. This does not cancel tickets or erase financial records.
• Google Calendar, only if you connect it: when your calendar is busy (not what your events are), plus an encrypted access grant.
• Notifications, only if you switch them on: the address your browser gives us for delivering notifications to that device, and which notifications were sent. Turning them off, or deleting your account, removes it.
• How you found us: a first-party cookie, kept for 30 days, that records the ad campaign or website that brought you here and, for an invite link, who invited you. It is attached to your link if you create one, so we can see which campaigns work and pay referral rewards. No advertising company receives it.
• Product and security records: anonymous product events (for example “link copied”), the actions taken on your account, and request logs used to keep the service secure.

Why we use it, and on what legal basis

• To run the bookings, questions, videos and payments you ask for (performing our contract with you): sign-in, booking pages, emails about your sessions, collecting payment and paying sellers.
• To meet legal duties: keeping payment, refund and payout records for tax and anti-money-laundering law, and answering lawful requests.
• For our legitimate interests: preventing fraud and abuse, keeping the service secure, and understanding which features are used, using only anonymous events.
• With your consent: connecting Google Calendar. You can disconnect at any time.
• With your consent: our news and offers, which can include other products from Kredit Technologies. We ask when you sign up or make an offer, and you can untick the box. Unsubscribe any time with the link in every email or under Settings. We keep a record of when you agreed and the wording you saw. Saying no never affects your bookings, and booking emails keep coming either way.

We do not sell personal data, show advertising, or use your data to train AI models.

Who we share it with

Only the service providers we need, each under a contract that limits what they may do with it:

• Kora and Fincra (payments and payouts in the African countries where sellers are paid; which one depends on the seller’s country).
• Cloudflare (hosting of profile photos, private chat attachments and the private files and video answers for questions and videos, call relay when configured, and protection of the site).
• Our email provider (sign-in codes, booking emails and, if you agreed to them, news emails). If we use a separate mailing service for news, it gets only your name and email and each person’s unsubscribe link.
• Google, only if you connect Google Calendar.
• Your browser’s notification service (Google, Apple, Mozilla or Microsoft, depending on your device), only if you switch notifications on. Each notification is encrypted so that only your device can read it.
• Our error-reporting service, which receives technical error details without form contents.
• Our hosting and database provider.

Some of these providers process data outside Nigeria. When they do, we rely on the safeguards the Act allows, such as contractual protections, and we choose providers with strong security.

The person you book sees the name and email you give when booking, and the note if you add one. Nobody else sees your note. It is deleted when you or the seller delete your account, and from unpaid holds after 90 days. People who visit a seller’s page see only what the seller chose to publish.

Google Calendar

If you connect Google Calendar, WantMyTime reads only when your primary calendar is busy, not what your events are, so booked times don’t clash with your other plans. It adds an event for each booking, with a Google Meet link, to a calendar you own, and updates or removes that event when the booking changes. Buyers aren’t added as guests. WantMyTime stores an encrypted access grant and the busy time ranges for your booking window, and deletes both when you disconnect. Disconnecting also revokes WantMyTime’s access at Google. Events already added stay on your calendar.

WantMyTime’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. This data is used only to provide these calendar features. It is never sold, used for advertising, or read by people except to fix a problem you ask us to fix, for security, or where the law requires it.

How long we keep it

• Sign-in codes: deleted a day after they expire.
• Sign-in sessions: deleted 30 days after they end.
• Meeting links: removed 30 days after the call.
• Files a buyer attaches to a question: removed 180 days after the question is sent. Unfeatured written, voice and video answers: removed 365 days after they are given. Featured answers and the buyer’s question stay with the booking record. Unresolved problem or no-show reports preserve evidence until resolution.
• Chat messages, voice notes, photos, documents and call session details: removed after 90 days unless a reported problem or no-show is still unresolved. Retention resumes after resolution. Foreground chat activity expires after five minutes during the hourly cleanup.
• Encrypted copies of outbound emails used for reliable retries and their attempt records: removed after 30 days. Email delivery and click measurement records: 400 days.
• Names on unpaid holds: removed after 90 days. Emails on closed offers: removed after 180 days.
• Live check-in details and contributions: queued for erasure after 90 days from check-in. Voice-question recordings expire after 30 days. Attendance access lasts seven days; the separate privacy credential lasts up to 90 days. Event recordings use the retention shown for that event. Anonymous delivery totals and financial evidence are retained separately. Guest downloads and erasure also remain available at /live/your-event-slug/privacy when event delivery is unavailable.
• Anonymous product events: 13 months.
• Payment, refund, payout and accounting records: reviewed for deletion after six years from the last financial activity. Unfinished payments, disputes or a documented legal obligation can require longer retention. Account deletion removes your account name and email once outstanding obligations are settled.
• Backups: encrypted copies are scheduled to expire within 14 days. Deletion completion is monitored, including copies held by storage providers.

Your rights

You can ask to see, correct or delete your data, to receive it in a portable file, to restrict or object to how we use it, and to withdraw consent you gave. Most of this you can do yourself:

• Download your data or delete your account from Settings → Delete your account.
• Correct your name, link details and hours from your workspace.
• For anything else, email [email protected]. We reply within 30 days.

If you are unhappy with how we handled your data, you can complain to the Nigeria Data Protection Commission. If you live in another country, you can also complain to the data protection authority there, and you have the rights its law gives you as well as these.

Security

Connections are encrypted. Bank account numbers, calendar grants, meeting links and operator security keys are encrypted in our database with separate keys. Sign-in uses one-time email codes, and operator access needs a second factor. If a breach puts your data at risk, we will tell the Commission within 72 hours and tell you without delay.

Children

WantMyTime is for people aged 18 and over. We do not knowingly collect data from children.

Changes

If we change this notice in a way that matters, we will email account holders before the change takes effect. Last updated: 17 October 2026.