01 Who We Are
Null Labs Limited (RC 9592210), a company registered in Nigeria, operates NullBot ("NullBot", "we", "us"). We are the data controller for personal data processed through the NullBot Telegram bot, the web dashboard at app.nullbot.io, and this website (together, the "Service").
This policy explains what we collect, why, who processes it, how long we keep it, and your rights under the Nigeria Data Protection Act 2023 and other applicable laws. Contact us about your data at any time: [email protected].
02 Data We Collect
Account data:
- If you sign in with Google or X: your email address, name and profile picture.
- If you link Telegram: your Telegram user ID and username.
- If you link X or Discord in the bot: those handles.
Wallet data:
- The public addresses of wallets you create or import.
- Their private keys, encrypted with AES-256 before storage. A key is decrypted in memory only to sign a transaction you set up. Keys are never logged or shared.
- We never request or store a seed phrase.
Activity data:
- Mint jobs, Copy Mint mirrors, gas and sweep settings, and notification preferences.
- The history of mints and transfers we run for you.
- Notifications we send, and support tickets you open.
Payment data: your personal deposit address, and the amount, network and transaction hash of each subscription payment. We never handle cards or bank details.
Device and usage data (see Cookies and Analytics):
- A random analytics ID stored in your browser.
- The pages you open and how long they stay open.
- Your country.
- If you turn on push notifications, a push endpoint from your browser.
Security data: a log of account actions such as key exports, plan changes and sign-in links, used to protect your account.
03 Google User Data
Signing in with Google requests only the standard openid, email and profile scopes. We use them to create your account, sign you in, and show your name and picture in the dashboard. We do not request access to Gmail, Drive, Contacts or any other Google service.
We do not use Google user data for advertising, do not sell it, and share it only with the sign-in provider that processes it on our behalf.
NullBot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
04 How We Use Your Data
- To provide the Service: running the jobs you set up, signing and broadcasting the transactions they need, and showing you their results.
- To send notifications to the places you choose.
- To manage your plan, confirm payments and apply account credit.
- To answer support requests and communicate about your account.
- To keep the Service and your account secure, and to detect and prevent fraud and abuse.
- To understand usage in aggregate and improve the Service.
- To meet legal obligations.
We do not sell personal data, use it for advertising, or make decisions about you that produce legal effects based solely on automated processing.
05 Lawful Bases
Under the Nigeria Data Protection Act 2023, we process personal data on these bases:
- Contract: to provide the Service you signed up for. That covers your account, wallets, jobs, notifications and plan.
- Legitimate interests: to secure the Service, prevent abuse and improve it, where those interests are not overridden by your rights.
- Consent: for optional features such as push notifications. You can withdraw consent at any time.
- Legal obligation: to keep records the law requires, and to respond to lawful requests.
07 International Transfers
Our servers and several of our providers are outside Nigeria, including in the United States. When personal data is transferred out of Nigeria, we rely on the safeguards the Nigeria Data Protection Act 2023 permits, such as contractual protections with our providers, and we take reasonable steps to make sure the data keeps an adequate level of protection.
08 Public Blockchain Data
Transactions on a blockchain are public and permanent. Anyone can see a wallet address and its activity. We cannot change, hide or delete data once it is on-chain, and your rights over personal data do not extend to public blockchain records.
09 How Long We Keep Data
- Account, wallet and activity data: for as long as your account exists.
- Payment records and the security log: for as long as needed for accounting, legal and security purposes.
- Individual analytics visits: 90 days. After that only daily totals remain, with no link to you.
- When you delete your account, we delete or anonymise your personal data within a reasonable time, except where we must keep it by law.
10 Security
We protect personal data with technical and organisational measures. Private keys are encrypted at rest, and the encryption key is stored separately from the database. Access to production systems is restricted, and connections to the Service are encrypted in transit.
No system is completely secure. Use dedicated mint (burner) wallets and keep only what you need in them.
If a personal data breach is likely to put your rights at risk, we will notify the Nigeria Data Protection Commission and, where required, you, as the law requires.
11 Your Rights
Under the Nigeria Data Protection Act 2023, you have the right to:
- be informed about how your data is processed
- access your personal data and get a copy of it
- correct inaccurate or incomplete data
- have your data erased
- restrict or object to processing, including processing based on legitimate interests
- receive your data in a portable format
- withdraw consent at any time, without affecting earlier processing
- not be subject to a decision based solely on automated processing that significantly affects you.
Many controls are built in. You can export private keys from Wallets, change or turn off notifications in Account → Notifications, and remove wallets and mirrors at any time.
For anything else, email [email protected]. We may need to verify your identity, and we respond within the time the law allows. Export your private keys before asking us to delete your account; once it's deleted, they cannot be recovered.
You can also complain to the Nigeria Data Protection Commission, or to the data protection authority where you live.
13 Children
The Service is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
14 Changes to This Policy
We may update this policy. We will change the "Last updated" date and, for material changes, tell you in the dashboard or the bot before they take effect.
15 Contact
Null Labs Limited (RC 9592210), Nigeria. Email [email protected], or open a support ticket in the Telegram bot.
See also our Terms of Use and FAQ.