Privacy notice - Qubicweb

Who we are

Qubicbox Limited (“Qubicbox”, “we”, “our”) operates Qubicweb, Qlutterbox, Qubictry, the Trust Badge, and E-Fraud Watch. We generally act as controller for direct customer and platform processing, and may act as processor only under a verified agreement with another controller.
Our registered office is 61 Ondo Street, Irawo, Mile 12, Kosofe, Lagos State, Nigeria.

Identity & verification: names, pronouns, government-issued IDs, guild certificates, selfie/video captures when needed to issue badges.
Contact details: email, phone, messaging handles, notification preferences, and optional waitlist details.
Incident & listing context: narratives, artefacts, inspection logs, fraud evidence, TrustOps annotations, and marketplace inventory metadata.
Payments & protected payment metadata: payout accounts, transaction references, invoice numbers, and commission statements flowing through Qlutterbox or Qubictry.
Technical telemetry: device fingerprints, IP addresses, session identifiers, MFA events, moderation audit logs, rate-limiting fingerprints.
Trust graph signals: E-Fraud reports, badge status, referrals, leaderboard rank, DSAR tickets, and transparency acknowledgements.

Contract: fulfilling verification, publishing stories, processing protected payment, inspections, payouts, disputes, and restitution workflows you request.
Legal obligation: meeting a specific applicable legal, tax, payment, consumer-protection, or preservation requirement where it applies.
Legitimate interest: preventing fraud, securing the platform, measuring product usage with privacy-preserving telemetry, and improving moderation accuracy. Legitimate interest assessments are reviewed annually.
Consent: optional marketing updates, saved searches, referrals, biometric capture where explicit consent is mandated. Consent can be withdrawn anytime without affecting prior lawful processing.

Verification dossiers, TrustOps case files, and protected payment records: active relationship plus 5 years to support appeals and regulatory audits.
Fraud reports and anonymised advisories: retained indefinitely after personal identifiers are removed for public-interest archiving.
Evidence uploads: 24 months unless legal holds apply, then securely deleted from primary and backup storage.
Audit logs and access records: minimum 36 months for accountability and forensic investigations.
Marketing preferences: until withdrawn; requests honoured within 72 hours.

Some approved providers may process data outside Nigeria. We assess applicable transfer requirements and safeguards before relying on a cross-border transfer, and do not represent an unverified country or transfer mechanism as current fact.

Proportionate encryption, access control, session protection, and audit logging are applied according to the system and data risk.
Mandatory MFA for TrustOps, Curators, payout actors, and admin tooling.
Rate limiting, abuse prevention, and verification controls protect public and privileged workflows where implemented.
Evidence access is restricted and material evidence actions are recorded. Additional sanitisation applies where the relevant workflow supports it.
Privileged access, vendors, and incidents are subject to documented governance review and exception tracking.

Approved hosting, database, storage, communications, monitoring, and security providers receive only the data needed for their service. Provider and region details are verified before being represented as current.
Payment providers, including Paystack where used, process payment and payout data under their applicable provider terms. Qubicbox does not represent itself as a bank or escrow provider.
Partner ecosystems: Qlutterbox, Qubictry, and the Trust Badge service when necessary to fulfil referrals, protected payment, or badge updates.
Law enforcement or regulators: only when legally compelled or vital to prevent imminent harm. Every disclosure is logged in immutable TrustOps audit trails.
We never sell personal data or permit uncontrolled sub-processing.

Access, rectification, deletion, restriction, portability, and objection to processing based on legitimate interests.
Withdrawal of consent without affecting prior lawful processing.
Right to complain to the Nigeria Data Protection Commission (NDPC) or your local EU/EEA supervisory authority.
Right to obtain information about automated decision-making; we do not run solely automated decisions with legal effects.

Submit a request via privacy@qubicbox.com with the subject “Data Subject Request” and include the email/phone tied to your account.
We acknowledge within one working day and fulfil within 30 days (extendable by 15 days for complex cases).
Registered office: Qubicbox Limited, 61 Ondo Street, Irawo, Mile 12, Kosofe, Lagos State, Nigeria. Telephone: +234 1 700 2100.

Qubicweb & E-Fraud Watch: community submissions are reviewed and anonymised before publication. Reporters can remain anonymous; personal contact remains private.
Qlutterbox & Qubictry: protected payment payouts and guild membership require verified identity and payout details to meet NDPR and financial regulations.
Trust Badge: verification results, references, provenance, and necessary audit metadata are retained according to the approved schedule. Raw identity evidence is minimised where those records are sufficient, subject to legal holds and implemented deletion controls.

We review this notice quarterly or whenever regulations, processors, or product scope changes. Updated versions appear here with a new revision date.
Latest revision: 27 August 2026.