Skip to content
NewGot a product? Test it with real Nigerians on 9jatesters
RANKED
Methodology

Legal

Privacy Policy

Last updated: May 2026 · Effective: 29 May 2026

Who we are

Ranked is operated by Ranked Technologies Ltd, a company incorporated in the Federal Republic of Nigeria and acting as the data controller of the personal data processed through the ranked.ng website (the “Service”). References to “we”, “our” and “us” in this policy mean Ranked Technologies Ltd.

We comply with the Nigeria Data Protection Act 2023 (NDPA), the implementing regulations issued by the Nigeria Data Protection Commission (NDPC), and where it applies to international users, the EU GDPR.

The short version

  • We do not require accounts to browse the directory.
  • We do not sell personal data — not ever, not to anyone.
  • We display Google AdSense advertising to fund the Service. AdSense relies on cookies; you can decline these via our cookie banner without losing access to any content.
  • Business listings come from Google Places, OpenStreetMap, published Nigerian regulator data, and user submissions. Reviews carry their authors’ attribution from Google.
  • You can exercise any NDPA right (access, correction, deletion, objection, portability, withdrawal of consent) by emailing [email protected]. We respond within 30 days.

What we collect, why, and on what lawful basis

NDPA Art. 25 requires us to disclose the categories of data we process and the lawful basis for each category. The table below makes that explicit.

1. Anonymous request logs

  • What: URL visited, referrer, user-agent string, a SHA-256 hash of your IP address (raw IP discarded after hashing).
  • Why: Rate-limit abuse on the lead-click tracker, detect malicious crawlers, calculate aggregate traffic patterns.
  • Lawful basis: Legitimate interests (NDPA Art. 25(1)(f)) — operating a safe public service.
  • Retention: Raw logs ≤ 30 days, then aggregated and the source rows deleted.

2. Lead-click events

  • What: When you click an outbound link on a business listing (Call, WhatsApp, Directions, Visit Website), we record the destination type, a coarsened IP prefix (/24 subnet, not the full address), the referring page, and a timestamp.
  • Why: Show business owners “X leads this month” signals; protect the Service from click fraud.
  • Lawful basis: Legitimate interests (NDPA Art. 25(1)(f)). No personal identifier is stored alongside the click.
  • Retention: 180 days at row level, then aggregated to monthly counts.

3. Submitted business listings

  • What: Business name, address, phone, website, and the submitter’s name + email (your own personal data when you self-submit).
  • Why: Verify the submission and follow up if we have questions; build the directory.
  • Lawful basis: Consent (NDPA Art. 25(1)(a)) — you actively submit the form. You can withdraw consent and request deletion at any time.
  • Retention: Business data: indefinitely (if approved, it becomes part of the directory). Submitter contact data: 90 days from decision, then deleted.

4. Business claim and report submissions

  • What: Claimant or reporter name, email, phone, role at the business, proof URL, message.
  • Why: Verify ownership / investigate the reported issue; reply to the submitter.
  • Lawful basis: Consent and our legitimate interest in maintaining directory data quality.
  • Retention: Decision metadata 24 months (audit trail); contact details purged 90 days post-decision.

5. First-party reviews (when enabled)

  • What: Hashed phone number (for OTP), the review text, your chosen display name, rating, timestamp.
  • Why: Display the review on the business’ page; deduplicate the reviewer.
  • Lawful basis: Explicit consent (you tap “Submit”).
  • Retention: Review published indefinitely as user-generated content. Phone hash retained for spam control. You can request deletion at any time.

6. Cookies

We use only the cookies listed below.

  • ranked-consent (first-party, 6 months) — stores your cookie-preference choice.
  • Google AdSense cookies (third-party, set by Google when you accept) — used for advertising. Disabled until you explicitly accept via the banner.
  • Vercel Web Analytics — cookie-less, first-party page-view + Core Web Vitals telemetry. No personal identifier is collected.

Anonymisation of third-party data

Reviews ingested from public Google data are anonymised before display on Ranked: we show only the reviewer’s first name and the initial of their last name (e.g. “Adunni O.”). This is enforced server-side so the full name never appears in Ranked’s HTML, schema.org markup, or API responses.

Advertising (Google AdSense)

Ranked Technologies Ltd uses Google AdSense to fund the Service. Where you accept cookies, Google may set and read cookies and device identifiers to:

  • Show ads based on your prior visits to this and other sites;
  • Measure ad performance (impressions, clicks);
  • Detect fraud and serve regionally relevant ads.

You can opt out of personalised advertising via Google Ads Settings or by tapping “Decline” in our cookie banner — ads will still appear, but as non-personalised inventory.

More on Google’s data handling for partner sites: policies.google.com/technologies/partner-sites.

Data we never collect

  • Account passwords (we don’t operate user accounts).
  • Payment-card or bank-account numbers.
  • BVN, NIN, passport numbers, or other government IDs.
  • Health, biometric, or other special-category data.
  • Children’s data — the Service is not directed at persons under 18.

Sharing and processors

We do not sell personal data. We only share it with the processors listed below, each contractually bound to NDPA-grade protections, and only as required to operate the Service.

  • Vercel Inc. — hosting and edge delivery. Processes standard request logs.
  • Neon — managed Postgres database. Stores the directory data and submitter contact data.
  • Google LLC (AdSense) — receives advertising cookies and page metadata only after you accept cookies.
  • Termii Ltd — sends review-verification OTPs via SMS / WhatsApp when first-party reviews are enabled. Receives only the phone number, message body, and delivery timestamps. Termii is a Nigerian processor; data stays in NG.
  • DeepSeek — receives anonymised review text for sentiment classification. Receives no personal identifiers.
  • When required by Nigerian law (a valid court order, NDPC instruction, or regulatory request from a competent authority).

International transfers

Vercel and Google operate globally and may process anonymous request data outside Nigeria. Where this happens, we rely on contractual safeguards (the relevant vendor’s Standard Contractual Clauses and certifications) and, where applicable, NDPC approvals for cross-border transfer of personal data.

Security

We protect personal data with industry-standard measures: TLS in transit, encryption at rest, principle-of-least-privilege access for our team, IP-hash rate limiting on public surfaces, and code review on every change that touches a personal-data path. We will notify affected users and the NDPC of any notifiable personal-data breach within 72 hours of detection (NDPA Art. 40).

Your rights under NDPA 2023

As a data subject, you have the right to:

  • Be informed about how your data is processed (this page exists to deliver that information).
  • Access the personal data we hold about you.
  • Rectification — ask us to correct or update inaccurate data.
  • Erasure — ask us to delete your personal data (subject to lawful retention obligations).
  • Restriction — ask us to pause processing while we investigate a complaint.
  • Portability — receive a copy of the personal data you provided to us, in a structured machine-readable format.
  • Object to processing relying on legitimate interests, including direct marketing (we do not direct-market).
  • Withdraw consent at any time without affecting past lawful processing.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any right, email [email protected]. We acknowledge within 7 days and respond substantively within 30 days. You won’t be charged a fee unless your request is manifestly unfounded or excessive (NDPA Art. 34).

Business data and reviews shown on the Service

Listings displayed on Ranked come from public APIs (Google Places), open data (OpenStreetMap, FCCPC, CBN, NCC, NAICOM, NMDPRA, NBS, NERC), and user submissions. Reviews shown on place pages are attributed to their original Google reviewers and remain their intellectual property; we display them with name anonymisation for informational purposes.

Business owners: if a listing about your business is incorrect, you can claim it via /submit, or email [email protected]. You can also flag specific issues via the “Report a problem” link on any place page.

Changes to this policy

We may update this policy when our practices change. The “Last updated” date at the top reflects the most recent revision. Material changes will be flagged on the homepage for at least 30 days before they take effect.

Contact

Ranked Technologies Ltd
Federal Republic of Nigeria
Privacy & data-rights: [email protected]
General support: [email protected]