Draft for legal and operational review. Provider locations, retention periods, the published subprocessor list, and the live analytics-consent configuration must be confirmed before this notice becomes effective.
Draft updated: September 30, 2026
1. Who we are and what this notice covers
Clearaccess is operated by [CLEARACCESS LEGAL ENTITY], registered in [JURISDICTION OF REGISTRATION], with its registered address at [REGISTERED ADDRESS] ("Clearaccess," "we," "us," or "our"). This notice covers the Clearaccess website, individual accounts, and information processed through Clearaccess services. The Terms of Service cover use of the public website and individual accounts.
An Organization may publish its own privacy notice for people whose information it adds to Clearaccess. For Organization operational data, read this notice with that Organization's notice and its agreement with Clearaccess. The Organization's agreement and data-processing schedule govern Clearaccess's handling of that data on the Organization's behalf.
2. Our roles
An Organization usually decides why and how it processes information about its members, staff, students, residents, tenants, visitors, contractors, event attendees, and other people in its operations. The Organization is normally the controller of that operational data. Clearaccess normally processes it on the Organization's documented instructions to provide, secure, and support the service.
Clearaccess separately determines purposes for some information, including account authentication, platform security and abuse prevention, direct support and business inquiries, Clearaccess subscription billing, and compliance with legal obligations. For those activities, Clearaccess acts as a controller where applicable law assigns that role.
The actual role depends on the activity and applicable law. An agreement or a particular integration may specify a different role for a defined activity.
3. Information we handle
Depending on how you or an Organization uses Clearaccess, information may include:
- Account and authentication information: name, email address, phone number, username, account settings, sign-in provider, passkey and multi-factor authentication records, session and recovery information.
- Organization and membership information: Organization name and type, role, membership reference, assignment to a place or space, invitation, and account-status records.
- Access and operations information: visitor or guest details supplied for a pass, purpose and validity of a pass, Access Point, admission result, check-in or check-out event, operator and scanner session, incident or emergency record, and related audit history.
- Organization-specific information: depending on enabled features, place and vehicle details, school or event attendance information, notices and messages, payment or collection records, and other information an Organization chooses to enter.
- Transactions and billing: plan, invoice and subscription information, payment amount, transaction or provider reference, wallet or settlement record, and limited payment-account details needed for reconciliation. Payment providers may collect payment credentials directly.
- Technical and security information: device and browser details, IP and connection information, approximate region where available, timestamps, diagnostic events, and authentication or security logs.
- Website and inquiry information: details you provide through contact, demo, support, or other inquiry forms, and limited information about how you use public pages.
- Notification information: notification preferences and delivery identifiers for push, email, or other channels you enable.
Please provide only information needed for the relevant operation. Standard features do not receive verification templates, identity-document images, or identity-document numbers. If a separately approved local verification integration is enabled, an additional notice and schedule will identify the limited authenticated outcome sent to Clearaccess, its purposes, safeguards, recipients, and retention; templates and source documents remain with the Organization-controlled local system.
4. Why we use information
We use information, as applicable to our role, to create and secure accounts; provide access, membership, event, payment, and administrative features; record and review Organization operations; process subscriptions and transactions; respond to inquiries; send service and user-requested notifications; troubleshoot and improve reliability; protect people and the service; and meet legal obligations.
An Organization determines its lawful purpose and basis for Organization operational data, provides required notices, and handles requests about that data. Clearaccess determines and documents an appropriate legal basis for its own processing under applicable law. Depending on the activity and jurisdiction, that may include a contract, legal obligation, legitimate interests where available, or consent where required.
Clearaccess does not sell visitor or access records. We do not use identifiable Organization operational data to target third-party advertising. We may use service statistics that no longer reasonably identify a person or Organization to understand and improve the service.
5. When information is shared
We may make information available to:
- the Organization and its authorized owners, managers, operators, or other users, according to the Organization's configuration and access permissions;
- service providers that host, secure, authenticate, process payments, deliver notifications, or support analytics for the features in use;
- a third-party integration that an Organization or user chooses to connect;
- regulators, courts, law enforcement, or other recipients when we are legally required or permitted to disclose it; and
- a successor in a business reorganization, subject to appropriate safeguards and applicable law.
The current application code uses Cloudflare for the application platform and may use Paystack for payments, Google or Telegram for sign-in where enabled, OneSignal for notifications where enabled, and Cloudflare Zaraz for configured analytics. The active provider list, provider roles, processing locations, and applicable transfer safeguards are [TO BE CONFIRMED AND LINKED BEFORE THIS NOTICE BECOMES EFFECTIVE]. Not every provider is used for every Organization or feature.
An Organization may also enable integrations or connect its own services. The Organization is responsible for the instructions and information it sends to those services.
6. Cookies, browser storage, and analytics
Clearaccess uses browser storage and similar technologies needed for sign-in, sessions, security, and service preferences. The application also contains Cloudflare Zaraz analytics hooks for page views and selected marketing, pricing, contact, sign-up, and billing events when the relevant Zaraz configuration is active.
The Privacy page includes a Cookie preferences control that opens the consent manager when it is available. The specific tools, purposes, cookie identifiers, storage periods, and consent behavior depend on the live configuration. Those settings must be checked before this draft becomes effective. Where consent is required, optional analytics or advertising technologies must not run before consent and must respect withdrawal.
You can also manage or clear browser storage through your browser settings. Blocking necessary storage may prevent account or service features from working.
7. Retention and deletion
We keep personal data only while reasonably needed for the purposes described in this notice, the applicable organization agreement, or a legal obligation. Organization operational data is retained or deleted according to the Organization's instructions and configured retention policy, subject to legal, security, transaction-reconciliation, audit, and backup requirements.
Account and support records are retained while needed to provide the account or handle the request. Billing and transaction records may be retained for accounting, dispute, fraud-prevention, and legal requirements. Security and audit records may be retained where needed to protect the service or establish what occurred. The specific retention periods, backup deletion window, and any longer legal-retention categories are [TO BE CONFIRMED BEFORE THIS NOTICE BECOMES EFFECTIVE].
Closing an account does not automatically delete Organization records that the Organization controls or records that must be retained by law. Contact the Organization about its operational records. Contact Clearaccess about account information we control.
8. International processing
Clearaccess and its providers may process information in countries other than the country where a user or Organization is located. The countries and transfer safeguards depend on the providers and deployment in use. The current hosting and processing locations and transfer mechanisms are [TO BE CONFIRMED AND LINKED BEFORE THIS NOTICE BECOMES EFFECTIVE]. We do not promise local data residency unless a signed agreement expressly provides it.
9. Security
We use technical and organizational measures designed to protect information against unauthorized access, loss, alteration, and disclosure. Access to Organization information is controlled by Organization roles and service permissions. No online service can guarantee perfect security. Any specific security control, certification, or data-residency commitment must be confirmed in the applicable security materials or signed agreement.
10. Your choices and privacy rights
Depending on applicable law, you may have rights to request access, correction, deletion, restriction, portability, or objection; withdraw consent; ask for human intervention or challenge certain decisions based solely on automated processing; or complain to a privacy regulator such as the Nigeria Data Protection Commission.
If your information was entered or is controlled by an Organization, contact that Organization first. Clearaccess will reasonably assist the Organization with requests concerning information we process on its instructions. For an account or inquiry that Clearaccess controls, contact privacy@clearaccess.app. We may need to verify your identity and may retain information where the law permits or requires it.
If an Organization uses Clearaccess for a School, it must determine the applicable safeguards, notices, permissions, and rights process for students, including children where relevant.
11. Automated access support
Clearaccess may evaluate an access request against an Organization's configured rules and record a result such as allow, payment required, blocked, or manual review. The Organization controls those rules. An authorized operator remains responsible for the final physical admission decision. Contact the Organization to question an access decision; contact Clearaccess if the concern is about our own processing or account security.
12. Changes and contact
We may update this notice when our processing changes. We will post the revised notice and update its effective date. Material changes affecting Organization operational data will also be handled under the applicable organization agreement.
Privacy questions or requests: privacy@clearaccess.app. Clearaccess's legal identity and registered address are [TO BE INSERTED BEFORE THIS NOTICE BECOMES EFFECTIVE].