LaundryOS Privacy Policy

Version 1.0 · Last updated: 7 September 2026

1. Who controls your data

LaundryOS is operated by Udinna Technologies Limited ("Udinna", "we"), a company registered in Nigeria (RC 9107166) with its registered office at 15 Baale Street, Ogoyo, Lekki Peninsula, Lagos, Nigeria. LaundryOS is a multi-business platform, so two parties handle your data:

• The Laundromat you order from determines how it uses your data to provide its laundry service, and is a data controller for that purpose.
• Udinna operates the Platform and its shared infrastructure (accounts, payments tooling, hosting, notifications). Depending on the activity, Udinna acts as a processor for the Laundromat and as a controller for platform-level purposes (security, fraud prevention, service operation).

For data-protection questions or requests, contact us at hello@udinna.com.

2. The personal data we process

• Account data: your full name, email address and/or phone number, a securely hashed password (we never store your password in readable form), your language/locale preference, and email/phone verification status.
• Address data: pickup/delivery addresses you save or enter for an order (label, address lines, area, city, contact phone).
• Order data: bookings, items and services chosen, order status and history, and messages/notes on an order.
• Payment data: the amount, currency, status, and processor reference for each transaction, and our settlement ledger. Card payments are handled by Paystack through its hosted checkout. Udinna does not receive or store your full card number or CVV.
• Communications: notifications we send you (verification codes, order updates, reminders) and their delivery status.
• Technical and security data: limited technical logs, and audit records of sensitive actions taken on your account/orders (including IP address) kept to protect the service and detect misuse.

We do not seek to collect special-category or sensitive data, and ask that you do not provide it.

3. Why we process it, and our lawful bases

Where we rely on legitimate interests, we balance them against your rights; you may object (section 7).

4. Payments

Card and online payments are processed by Paystack, a PCI-DSS-compliant payment provider, via its hosted checkout. We share the order amount, currency, reference, and your email with Paystack to process the payment and receive back the transaction status. We keep card data off our servers by design.

5. Who we share data with

• The Laundromat you order from, to fulfil and support your order.
• Payment processor: Paystack, to take and reconcile payments.
• Communication providers: the email and/or SMS gateways we use to deliver messages.
• Infrastructure providers: hosting and database providers that run the Platform under contract.
• Authorities, where required by law or to establish, exercise, or defend legal claims.

We do not sell your personal data. Each Laundromat only sees the data of its own customers; the Platform is designed to keep tenants' data isolated from one another.

6. International transfers

The Platform serves Laundromats in Nigeria and the United Kingdom, so data may be processed in either location and by infrastructure providers that may process data outside your country of residence. Where we transfer personal data across borders, we rely on a lawful transfer mechanism providing adequate protection (for example, adequacy findings or standard contractual clauses, as required by the NDPA 2023 and UK GDPR).

7. Your rights

Subject to applicable law, you can ask us to: access a copy of your data; correct inaccurate data; erase your data; restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on consent. To exercise these, contact hello@udinna.com; because a Laundromat may be the controller for its own service, we may route or coordinate your request with it.

You also have the right to complain to a regulator:

• Nigeria: the Nigeria Data Protection Commission (NDPC).
• United Kingdom: the Information Commissioner's Office (ICO).

8. How long we keep it

We keep personal data only as long as needed for the purposes above, then delete or anonymise it, retaining what we must for legal, tax, accounting, and dispute-resolution purposes (up to seven years for financial records). Audit logs are retained for up to 24 months.

9. How we protect it

Passwords are hashed with a strong algorithm (argon2) and checked against known-breached passwords; data in transit is encrypted (HTTPS); tenant data is isolated (including database row-level security); access to sensitive actions is role-restricted and recorded in an audit log; and we apply rate limiting and account-lockout protections. If a personal-data breach occurs, we will notify the relevant regulator and affected individuals as required by the NDPA 2023 and UK GDPR.

10. Cookies and local storage

The Platform uses strictly necessary storage to keep you signed in and remember your preferences (for example, language). We do not currently use non-essential or advertising cookies. If we introduce analytics or non-essential cookies in future, we will describe them and obtain your consent first.

11. Children

The Platform is not directed to, and not intended for, children under 18. We do not knowingly collect their data.

12. Changes

We may update this Policy; material changes will be notified through the Platform or by email, with the "Last updated" date revised above.

13. Contact

Privacy questions or requests: hello@udinna.com, or write to Udinna Technologies Limited, 15 Baale Street, Ogoyo, Lekki Peninsula, Lagos, Nigeria.