Skip to content
NewGot a product? Test it with real Nigerians on 9jatesters
RANKED
Add business

Legal

Privacy Policy

Last updated: 11 September 2026 · Effective: 29 May 2026

Who we are

Ranked is operated by Ranked Technologies Ltd, a company incorporated in the Federal Republic of Nigeria and acting as the data controller of the personal data processed through the ranked.ng website (the “Service”). References to “we”, “our” and “us” in this policy mean Ranked Technologies Ltd.

We comply with the Nigeria Data Protection Act 2023 (NDPA), the implementing regulations issued by the Nigeria Data Protection Commission (NDPC), and where it applies to international users, the EU GDPR.

Ranked Technologies Ltd is registered with the NDPC as a data controller and data processor of major importance under section 44 of the NDPA. Registration ID NDPC/DCP/14538, granted 3 September 2026. You can verify this registration on the NDPC portal.

The short version

  • We do not require accounts to browse the directory.
  • We do not sell personal data. Not ever, not to anyone.
  • We run no third-party advertising network and currently use no Google AdSense. Ranked's own Featured and Sponsored placements are visibly labelled, set no advertising cookies, and never change ranking order. A self-hosted, cookie-less analytics tool measures aggregate use, while Google Analytics 4 loads only after you give consent. You can decline cookie-based analytics without losing access to any content.
  • Business listings come from Google Places, OpenStreetMap, published Nigerian regulator data, and user submissions. Reviews carry their authors’ attribution from Google.
  • You can exercise any NDPA right (access, correction, deletion, objection, portability, withdrawal of consent) by emailing support@ranked.ng. We respond within 30 days.

What we collect, why, and on what lawful basis

NDPA Art. 25 requires us to disclose the categories of data we process and the lawful basis for each category. The table below makes that explicit.

1. Request logs

  • What: URL visited, referrer, user-agent string, and your IP address. Our web server keeps standard access logs that contain the full IP address. The application itself never stores it: where it needs to recognise a source it keeps a SHA-256 hash, or a /24 prefix (see 2).
  • Why: Rate-limit abuse on the lead-click tracker, detect malicious crawlers, calculate aggregate traffic patterns.
  • Lawful basis: Legitimate interests (NDPA Art. 25(1)(f)) for operating a public service.
  • Retention: Web-server logs rotate daily and are deleted after 14 days (15 days at most). A hash stored with a submission stays with that submission.

2. Lead-click events

  • What: When you click an outbound link on a business listing (Call, WhatsApp, Directions, Visit Website), we record the destination type, a coarsened IP prefix (/24 subnet, not the full address), the referring page, and a timestamp.
  • Why: Show business owners “X leads this month” signals; protect the Service from click fraud.
  • Lawful basis: Legitimate interests (NDPA Art. 25(1)(f)). No personal identifier is stored alongside the click.
  • Retention: Individual click rows are deleted after 180 days by a daily job. The counts we show business owners are computed from the rows still held.

3. Submitted business listings

  • What: Business name, address, phone, website, and the submitter’s name + email (your own personal data when you self-submit).
  • Why: Verify the submission and follow up if we have questions; build the directory.
  • Lawful basis: Consent (NDPA Art. 25(1)(a)). you actively submit the form. You can withdraw consent and request deletion at any time.
  • Retention: Business data: indefinitely (if approved, it becomes part of the directory). Submitter name and email: if the submission is rejected or found to be a duplicate, a daily job erases them 90 days after the decision. If it is approved, the submitter is normally the business owner, and we keep the contact details for as long as the listing is live so we can reach the owner about it and, for paid listings, keep the payment record.

4. Business claim, report and advertising submissions

  • What: Claimant or reporter name, email, phone, role at the business, proof URL, message. The “Advertise with us” form adds business name, budget and timeline.
  • Why: Verify ownership / investigate the reported issue; reply to the submitter.
  • Lawful basis: Consent and our legitimate interest in maintaining directory data quality.
  • Retention: Decision records are kept as an audit trail, and payment records for as long as Nigerian tax law requires. For rejected or duplicate claims and for resolved reports, a daily job erases the name, email and phone 90 days after the decision. For approved claims we keep the owner's contact details for as long as the listing is claimed. Advertising enquiries are kept while we are in contact.

5. First-party reviews

  • What we publish: the review text, the rating, the timestamp, and a display name. If you tick “Post without my name” the display name is simply “Anonymous” and your name never appears on the page.
  • What we keep but never publish: the name you gave us (held so a moderator can tell one person from many), your phone number, and a one-way hash of a coarsened form of your network address (the first three blocks only, e.g. 105.112.10.0. Never your full address). While a verification code is live, the phone number sits in a short-lived code table that a daily job purges once the code has expired. If you verify, the number is stored on your reviewer record so we can recognise you when you come back and stop one person reviewing the same business twice. We do not text you about a review, and never for marketing.
  • Why: to publish the review, to stop the same person submitting the same business twice, and to let a moderator see when a burst of reviews comes from one person. Anonymity is about what we publish, not about whether we know who wrote it . A directory where nobody is accountable cannot maintain reliable records.
  • Lawful basis: Explicit consent (you tap “Submit”), and our legitimate interest in preventing fraudulent reviews.
  • Retention: The published review stays up indefinitely as user-generated content. The identity fields above are kept for as long as the review is live, for spam control. You can ask us to delete your review, or to detach your identity from it at any time. Email support@ranked.ng.

6. Cookies

We use only the cookies listed below.

  • ranked-consent (first-party, 6 months): stores your cookie-preference choice.
  • Google Analytics 4 cookies (third-party, set by Google only after you accept): used for consented aggregate measurement. We configure IP anonymisation and disable Google Signals and ad-personalisation signals.
  • Ranked's self-hosted analytics: cookie-less, first-party page-view and performance telemetry served throughranked.ng/_a. It does not build a cross-site profile.

Anonymisation of third-party data

Reviews ingested from public Google data are anonymised before display on Ranked: we show only the reviewer’s first name and the initial of their last name (e.g. “Adunni O.”). This is enforced server-side so the full name never appears in Ranked’s HTML, schema.org markup, or API responses.

Advertising and sponsored placements

Ranked Technologies Ltd does not currently use Google AdSense or any other third-party advertising network. We may sell our own Featured and Sponsored placements directly to businesses. Those placements are clearly labelled, do not set third-party advertising cookies, and do not change a listing's organic ranking or eligibility for inclusion.

The consent banner controls Google Analytics cookies separately; declining does not restrict access to rankings, listings, or other Service content.

Data we never collect

  • Account passwords (we don’t operate user accounts).
  • Payment-card or bank-account numbers.
  • BVN, NIN, passport numbers, or other government IDs.
  • Health, biometric, or other special-category data.
  • Children’s data. The Service is not directed at persons under 18.

Sharing and processors

We do not sell personal data. We only share it with the processors listed below, each contractually bound to NDPA-grade protections, and only as required to operate the Service.

  • Ranked's self-hosted VPS: runs the web application, nginx, and a local PostgreSQL database. The current server is in Phoenix, United States. It processes standard request logs and stores the directory and submission data.
  • Cloudflare, Inc.: DNS, reverse proxy, caching, and security services in front of the VPS. Cloudflare can see request metadata needed to provide those services.
  • Google LLC (Google Analytics 4): receives analytics events and cookies only after you accept the optional analytics cookies. IP anonymisation, Google Signals, and advertising personalisation signals are disabled.
  • IPLSMS (api.iplsms.com): delivers the review-verification code by SMS when first-party reviews are enabled. Receives only the phone number, the message body and the delivery status.
  • Paystack Payments Limited: processes card and bank payments for paid listings and claims. Paystack receives the details you enter on its own checkout page; we receive only the transaction reference, amount, status and the email you paid with, never card numbers.
  • DeepSeek: receives business-listing data and public review text to generate page copy and classify reviews. Receives no submitter, claimant or reviewer identity.
  • When required by Nigerian law (a valid court order, NDPC instruction, or regulatory request from a competent authority).

International transfers

The current self-hosted VPS is located in Phoenix, United States, and Cloudflare operates a global network. Google may process optional Google Analytics data outside Nigeria after consent. Where personal data is transferred internationally, we rely on applicable contractual safeguards and any NDPC requirements for cross-border transfer of personal data.

Security

We protect personal data with: TLS on every connection; a single production server reachable only through Cloudflare, with administrative access limited to one SSH key; database backups sealed with public-key encryption before they are written to disk, with the decryption key held off the server; hashed or truncated network addresses inside the application; and automated retention jobs that erase the fields described above on schedule. We will notify affected users and the NDPC of any notifiable personal-data breach within 72 hours of detection (NDPA Art. 40).

Your rights under NDPA 2023

As a data subject, you have the right to:

  • Be informed about how your data is processed (this page exists to deliver that information).
  • Access the personal data we hold about you.
  • Rectification: ask us to correct or update inaccurate data.
  • Erasure: ask us to delete your personal data (subject to lawful retention obligations).
  • Restriction: ask us to pause processing while we investigate a complaint.
  • Portability: receive a copy of the personal data you provided to us, in a structured machine-readable format.
  • Object to processing relying on legitimate interests, including direct marketing (we do not direct-market).
  • Withdraw consent at any time without affecting past lawful processing.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any right, email support@ranked.ng. We acknowledge within 7 days and respond substantively within 30 days. You won’t be charged a fee unless your request is manifestly unfounded or excessive (NDPA Art. 34).

Business data and reviews shown on the Service

Listings displayed on Ranked come from public APIs (Google Places), open data (OpenStreetMap, FCCPC, CBN, NCC, NAICOM, NMDPRA, NBS, NERC), and user submissions. Reviews shown on place pages are attributed to their original Google reviewers and remain their intellectual property; we display them with name anonymisation for informational purposes.

Business owners: if a listing about your business is incorrect, you can claim it via /submit, or email support@ranked.ng. You can also flag specific issues via the “Report a problem” link on any place page.

Changes to this policy

We may update this policy when our practices change. The “Last updated” date at the top reflects the most recent revision. Material changes will be flagged on the homepage for at least 30 days before they take effect.

Contact

Ranked Technologies Ltd
Federal Republic of Nigeria
Privacy & data-rights: support@ranked.ng
General support: support@ranked.ng