Privacy Policy

Introduction

Cyber Ultimax Ltd ("Cyber Ultimax", "we", "our", "us"), a company registered in Nigeria, operates Spike Console. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website at www.spikeconsole.com, sign up for an account, or use the Spike Console console applications and API ("Services"). It should be read alongside our Cookie Policy and Subprocessors & Data Processing page, which go into more detail on those specific topics.

Information you provide

We collect information you provide directly, including:

• Account details: name, email address, and password (stored as a salted hash, never in plain text), or your Google account details if you sign in with Google
• Business and workspace details you enter during onboarding, such as company name, sector, and team size
• Operational data you or your team enter into the modules you use, which may include customer and contact records (CRM), employee and payroll records (People & HR), invoices and financial records (Finance), product and order data (Commerce), and project data
• Payment and billing information, processed by our payment processors (Paystack, Flutterwave, and Stripe) rather than stored by us directly
• Contact form submissions, support requests, and other communications you send us

Some of this information, particularly employee, payroll, and financial records you enter about your own customers or staff, is provided by you on behalf of a third party. In that case, we process it as described in our Subprocessors & Data Processing page, and you remain responsible for having a lawful basis to share it with us.

Information collected automatically

When you access our website or console, we automatically collect:

• Device and browser type, operating system, and IP address
• Pages visited, actions taken in the console, and referring URLs
• Cookies used to keep you signed in and to protect your account, described in full in our Cookie Policy

How we use your information

We use the information we collect to:

• Provide, maintain, and improve the Services, including authenticating you and keeping your workspace data isolated from other businesses
• Process subscriptions, invoices, and Partner Program payouts
• Power AI-assisted features (such as Advisor's business analysis tools), as described below
• Send transactional messages, such as verification, password reset, and invitation emails, and, where you have opted in, product updates
• Respond to enquiries and provide customer support
• Detect, prevent, and address technical issues, fraud, or security threats

AI-assisted features

When you use Advisor or other AI-assisted features, relevant business data you have entered (for example, strategy inputs or business details you are analysing) is sent to a third-party AI provider to generate a response. That provider processes the data to return a result to you and does not use it to train its models on our customers' behalf. See our Subprocessors & Data Processing page for the specific provider and more detail. Avoid entering data you are not permitted to share with a third-party processor into an AI-assisted feature.

Sharing your information

We do not sell your personal information. We share information with:

• Service providers who help us operate the Services, including payment processors, our AI provider, cloud hosting, and email/SMS delivery providers. See our full Subprocessors list for detail
• Partners you choose to engage through the Partner Program, limited to what is needed to fulfil the specific service request you submit
• Legal authorities when required by law or to protect our rights or the safety of our users
• Successors in connection with a merger, acquisition, or sale of assets

Data security

We implement technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. This includes encryption of data in transit and at rest, role-based access controls that keep each business's workspace data logically separated from every other business on the platform, and regular security reviews.

Data retention

We retain personal information for as long as necessary to fulfil the purposes described in this policy, or as required by law (for example, financial records may need to be retained for statutory periods). When you request deletion of your account or data, we will remove it within 30 days, except where we are required to retain it for legal or regulatory reasons.

International data transfers

We and our service providers may process and store information outside Nigeria, including in the United States, where our cloud hosting and AI providers operate. Where this happens, we take steps to ensure the transfer is subject to appropriate safeguards.

Your rights

Subject to applicable law, including the Nigeria Data Protection Act 2023, you may have the right to:

• Access, correct, or delete your personal information
• Object to or restrict certain processing of your data
• Request portability of your data
• Withdraw consent at any time where processing is based on consent

Where you enter data about your own customers or employees into the Services, requests about that data (for example, a request from one of your employees) should generally be directed to you as the business responsible for it; we will support you in fulfilling it. To exercise any of these rights over your own account data, contact us at hello@spikeconsole.com.

Children's privacy

The Services are intended for business use by adults acting on behalf of a company or organisation. We do not knowingly collect personal information from individuals under 18, and the Services are not directed at children.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the Services after changes are posted constitutes acceptance of the revised policy.